Your Rights Under the FCRA and FDCPA (Plain English Guide)
Two federal laws decide almost everything about how credit bureaus track you and how debt collectors are allowed to behave. They are the Fair Credit Reporting Act (FCRA) of 1970 and the Fair Debt Collection Practices Act (FDCPA) of 1977. Together, they hand consumers enormous leverage — leverage most people never use because they don't know it exists.
This guide walks through the actual statute sections that matter, in plain English. You'll learn what each law forces the other side to do, the exact dollar amounts you can recover when they break the rules, and the language to use when you invoke a right. We cite the U.S. Code so you can verify everything yourself.
A Brief History (And Why It Matters)
Before 1970, credit bureaus operated in the dark. They could collect rumors, sell whatever they wanted to whoever would pay, and refuse to tell consumers what was in their file. The FCRA — codified at 15 U.S.C. §§ 1681–1681x — changed all that by forcing accuracy, transparency, and a dispute process.
Seven years later, Congress turned to the collection industry. Threatening calls at midnight, fake court papers, harassment at workplaces — none of it was illegal at the federal level. The FDCPA, codified at 15 U.S.C. §§ 1692–1692p, drew clear lines. Cross them and a collector pays.
Both laws have been amended repeatedly — most importantly by the FACT Act of 2003, which gave consumers free annual reports — and both are enforced today by the Consumer Financial Protection Bureau (CFPB), the FTC, and state attorneys general. But the most powerful enforcer is you, because both statutes contain a private right of action with statutory damages and attorney fees.
FCRA Core Rights: What the Bureaus Owe You
The FCRA governs the three major credit reporting agencies (Equifax, Experian, TransUnion), specialty bureaus (LexisNexis, ChexSystems, the MIB), and the "furnishers" who feed them data (banks, lenders, collectors). Here are the rights that matter most.
1. The Right to Dispute Inaccurate Information — § 611
Under 15 U.S.C. § 1681i, when you dispute an item, the bureau must conduct a "reasonable reinvestigation" within 30 days (45 days if you supplement your dispute with new information during that window). They must contact the furnisher, review what you sent, and either correct, delete, or verify the item — and notify you of the result in writing. If they can't verify it, the law says they must delete it.
This is the engine that drives most credit restoration. Learn the mechanics in our breakdown of how to dispute credit report errors.
2. The Right to Free Annual Reports — § 612
Under 15 U.S.C. § 1681j, you're entitled to a free credit report from each of the three major bureaus once per year. Following pandemic-era changes that the bureaus made permanent, you can now request all three weekly for free at AnnualCreditReport.com. This is the only federally authorized source.
3. The Right to Fraud Alerts and Security Freezes — § 605A
15 U.S.C. § 1681c-1 lets you place a free fraud alert (initial alerts last one year, extended alerts for identity theft victims last seven years). A separate provision, 15 U.S.C. § 1681c-2, also lets identity theft victims block fraudulent information from appearing on their report entirely.
4. Maximum Retention Periods for Negative Info — § 605
15 U.S.C. § 1681c caps how long negative information can legally remain:
| Item | Maximum Reporting Period |
|---|---|
| Late payments, collections, charge-offs | 7 years from date of first delinquency |
| Chapter 7 bankruptcy | 10 years from filing date |
| Chapter 13 bankruptcy | 7 years from filing date |
| Civil judgments | 7 years (most no longer report at all post-2017) |
| Tax liens (paid) | No longer reported on consumer credit files |
| Hard inquiries | 2 years (most score impact gone in 12 months) |
For a deeper look at the 7-year rule and how the clock actually works, see our guide on how long late payments stay on your credit report.
5. The Accuracy Requirement — § 607
15 U.S.C. § 1681e(b) requires bureaus to "follow reasonable procedures to assure maximum possible accuracy" of the information in your file. This is the section courts cite most when consumers win FCRA lawsuits. Sloppy verification, mixed files, outdated data — all violations.
6. Statutory Damages — §§ 616 & 617
This is where the leverage lives. Under 15 U.S.C. § 1681n (willful noncompliance), you can recover:
- Actual damages, or statutory damages of $100 to $1,000 per violation
- Punitive damages (no statutory cap)
- Attorney fees and costs
Under 15 U.S.C. § 1681o (negligent noncompliance), you recover actual damages plus attorney fees. Recent settlements: Equifax paid up to $425 million in the 2017 data breach case; TransUnion paid $15 million in 2022 over inaccurate OFAC alerts; individual plaintiffs routinely win $5,000–$50,000 on mixed-file and re-aging cases.
Know Your Rights
The FCRA does not require you to prove the item is inaccurate before disputing — only that you dispute it in good faith. The burden of verification falls on the bureau and furnisher. If they can't produce evidence the account is yours and the data is right, the law requires deletion.
FDCPA Core Rights: What Debt Collectors Cannot Do
The FDCPA applies to third-party debt collectors — agencies that buy or are assigned debts. It generally does not apply to the original creditor (though many states have parallel laws that do). Here's what the statute forces collectors to do — and what it forbids.
1. Debt Validation — § 809
Under 15 U.S.C. § 1692g, within five days of first contact, a collector must send you a written notice with the amount owed, the creditor's name, and a statement that you have 30 days to dispute or request validation. If you dispute in writing during that window, the collector must cease all collection activity until they mail you verification.
This is the single most useful right in the FDCPA — and we cover the strategy in detail in our guides to the 609 dispute letter and removing collections from your credit report.
2. The Right to Demand They Stop Contacting You — § 805(c)
15 U.S.C. § 1692c(c) says that once you notify a collector in writing that you refuse to pay or want all communication to stop, they must cease — with only three narrow exceptions: (1) to confirm receipt, (2) to tell you they're invoking specific remedies, or (3) to tell you they intend to sue.
Sample language: "Pursuant to 15 U.S.C. § 1692c(c), I am notifying you in writing to cease all further communication with me regarding this alleged debt. Any further contact, other than as permitted by statute, will be treated as a violation."
3. No Contact at Work If Your Employer Prohibits It
Under § 1692c(a)(3), a collector may not contact you at work if they know — or have reason to know — that your employer prohibits such calls. One letter telling them this triggers the rule.
4. No Harassment — § 806
15 U.S.C. § 1692d prohibits: threats of violence, obscene language, publishing your name as a debtor (other than to a credit bureau), calling repeatedly with intent to harass, and calling without identifying themselves. Each separate call after a stop demand can be a separate violation.
5. No False or Misleading Statements — § 807
15 U.S.C. § 1692e bans roughly 16 specific deceptive practices, including:
- Falsely claiming to be an attorney, government employee, or credit bureau
- Misrepresenting the amount or legal status of the debt
- Threatening legal action they cannot legally take or do not intend to take
- Implying that nonpayment will result in arrest or wage garnishment when it cannot
- Sending documents that look like court papers when they are not
6. Time-of-Day Limits — § 805(a)
15 U.S.C. § 1692c(a)(1) bans contact before 8:00 a.m. or after 9:00 p.m. local time for the consumer. A call at 7:55 a.m. is a violation. A text at 9:01 p.m. is a violation.
7. Statutory Damages — § 813
Under 15 U.S.C. § 1692k, when a collector violates the FDCPA, you can recover:
- Actual damages (including emotional distress)
- Statutory damages up to $1,000 per lawsuit (not per violation, but multiple violations strengthen the case)
- Attorney fees and court costs — almost always shifted to the defendant
The one-year statute of limitations runs from the date of the violation, so don't sit on a clear violation.
Pro Tip
Save every voicemail. Screenshot every text. Keep envelopes. Modern FDCPA cases are won on documentation. A single voicemail at 7:48 a.m. — combined with a call after a written cease letter — is often enough to fund the rest of your credit restoration work.
FCRA vs. FDCPA: A Side-by-Side Comparison
| Element | FCRA | FDCPA |
|---|---|---|
| Year enacted | 1970 | 1977 |
| Who it regulates | Credit bureaus + data furnishers | Third-party debt collectors |
| Core right | Accuracy, dispute, access | Validation, no harassment |
| Statutory damages | $100–$1,000 per violation (willful) | Up to $1,000 per action |
| Punitive damages | Yes, no cap | No |
| Attorney fees | Yes (prevailing plaintiff) | Yes (prevailing plaintiff) |
| Statute of limitations | 2 years from discovery, 5 from violation | 1 year from violation |
| Where to file complaints | CFPB, FTC, state AG | CFPB, FTC, state AG |
How to Actually Invoke These Rights
Knowing the statute means nothing if you don't use it. Here's the playbook.
Step 1: Get the Evidence
Pull all three credit reports from AnnualCreditReport.com. Save every collector communication. If you don't know how to decode what you're looking at, our walk-through on how to read a credit report is the place to start.
Step 2: Dispute Inaccuracies in Writing (FCRA § 611)
Mail disputes via certified mail with return receipt. Keep copies. Cite specific items, explain why they're inaccurate, and include supporting documents. The 30-day reinvestigation clock starts when the bureau receives the letter.
Step 3: Demand Validation (FDCPA § 809)
For any third-party collector, send a validation request within 30 days of first contact. Sample language:
"This letter is sent pursuant to 15 U.S.C. § 1692g(b). I dispute this alleged debt and request validation, including the original signed agreement, complete payment history, the chain of assignment from the original creditor, and proof that you are licensed to collect in my state. Until validation is provided, you must cease all collection activity, including reporting to credit bureaus."
Step 4: File a Complaint
Complaints create a public regulatory record that bureaus and collectors take seriously — often more seriously than dispute letters alone. Use:
- CFPB — consumerfinance.gov/complaint. Companies must respond within 15 days. This is the fastest-moving channel.
- FTC — reportfraud.ftc.gov. Builds the federal enforcement record.
- State Attorney General — most states have a consumer protection division that takes complaints by web form.
Step 5: Sue If They Don't Comply
You don't need a lawyer to file in small claims court, and most FDCPA cases settle before trial because the defendant has to pay your attorney's fees if they lose. Consumer-rights attorneys typically work on contingency for exactly that reason.
Watch Out
The FDCPA's one-year statute of limitations is short. If a collector violates the law on January 5, you have until January 5 of the following year to sue. The FCRA gives you more time — generally two years from discovery or five from the violation — but evidence gets stale fast. Move quickly.
How CSN Combines Both Laws Strategically
Most consumers — and a lot of credit repair companies — treat FCRA and FDCPA as separate tools. They aren't. The smartest restoration strategy stacks them.
Example: A collection account appears on your report. The collector never sent a validation notice (FDCPA § 809 violation). The reported balance is $40 higher than what they later claim is owed (FCRA § 607 accuracy violation, plus FDCPA § 807 misrepresentation). The date of first delinquency on the tradeline is two years older than the actual delinquency, illegally extending the 7-year clock (FCRA § 605 re-aging violation).
That's three separate violations on one account. A dispute letter that cites all three — sent to the bureau, the furnisher, and the CFPB simultaneously — gets that tradeline deleted far faster than a generic "not mine" dispute ever would. That's the difference between credit repair vs. credit restoration: amateurs send templates, professionals build leverage.
This is what we do for our clients every day, and it's how Credit Success Network has helped fund $6.7M+ in new credit for the people we work with. Strategy beats volume.
The Bottom Line
The FCRA and FDCPA are the two most powerful consumer-protection statutes in American finance. They give you the right to demand accuracy, the right to silence harassment, and the right to make the other side pay when they violate either standard. Most consumers never use any of it.
If you've been ignored, talked over, or pushed around by a collector or a bureau, you have more leverage than you think. The next move is to use it — strategically, in writing, and with documentation. If you want help building the right sequence, that's what we're here for. Start at the home page or jump straight into a strategy call below.