Fair Credit Reporting Act Violations: Where Dealers Get Exposed

The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) is the federal statute that governs consumer credit files: who may pull a report, what duties follow from using one, and what anyone who reports data to the bureaus owes the consumers being reported on. Most writing about Fair Credit Reporting Act violations speaks to consumers. This article is for the dealer desk, because a dealership touches the statute at three separate points, and most stores have never mapped all three.

We work with Georgia motor vehicle dealers on compliance and disputes, and FCRA exposure has a consistent shape: the violations are cheap to prevent, expensive to defend, and almost always traceable to a process nobody ever wrote down.

The three points where a dealership touches the FCRA

Picture a customer's credit file moving through your store. It gets touched three times.

You pull it. The moment anyone at the desk runs a bureau, the store is a "user" of consumer reports and needs a permissible purpose under § 1681b.

You use it. If financing is declined or priced off what the report shows, notice duties can follow under § 1681m.

You may report to it. A buy here pay here dealer that furnishes payment history to the bureaus takes on a third role, furnisher, with its own duties under § 1681s-2.

Each point has its own violations, and its own plaintiffs. Take them in order.

Pulling credit: FCRA permissible purpose is the whole ballgame

Section 1681b lists the only legal reasons to obtain a consumer report. For a dealership, three matter: the consumer's written instructions, a credit transaction the consumer is seeking, and a legitimate business need in connection with a business transaction the consumer initiated.

A completed credit application is a permissible purpose. So is a customer who asks you to arrange financing, even before the formal application is signed. FTC staff guidance has also said a dealer may check credit when a customer pays by personal check.

Here is what is not a permissible purpose: a test drive. The FTC addressed this directly in 1998 staff guidance, reasoning that asking to drive a car does not indicate an intent to buy one, so it does not initiate a business transaction. The same logic covers the photocopied driver's license. Stores routinely copy a license before a test drive for insurance reasons, and some desks have used that copy to run a bureau while the customer is out on the road. That is an impermissible pull. So is running credit on a cash buyer who never asked about financing, and so is "prequalifying" a shopper who only asked a price.

A signed credit application is a permissible purpose. A photocopied driver's license is not.

The shotgunning problem

The second pulling issue is what happens after a legitimate application: the desk blasts it to eight or twelve finance sources, and the customer wakes up to a wall of hard inquiries. Consumers sue over this, usually claiming they authorized one lender, not twelve. Courts have generally held that a genuine financing request gives the dealer and its finance sources a permissible purpose even when the customer tried to limit it, and a Wisconsin federal court reached exactly that result in 2018 against a consumer who arrived with outside financing already arranged. But winning that case still costs a store real money, and not every court reads the statute the same way.

The cheap insurance is paperwork. Use a written credit application with a clear authorization above the signature line covering both the pull and submission to multiple finance sources. Never run a bureau before that signature or a documented financing request. And log who pulled what, when, and on whose authority, because in an impermissible-pull case the store's own records are usually the whole defense.

Using credit: what follows the pull

Once a report influences the deal, notice duties can attach. When an application is denied based in part on a report, the FCRA requires an adverse action notice under § 1681m: the bureau's name and contact information, a statement that the bureau didn't make the decision, and the customer's right to a free copy and to dispute. In dealer-arranged financing the lender usually sends it, but a store that kills a deal itself, or spot-delivers and then unwinds, can end up owning the duty. A separate risk-based pricing regime requires notices when credit is offered on materially less favorable terms. These are their own subject; for now, know that the desk's obligations do not end when the report prints.

Furnishing: the BHPH dealer's third hat

Reporting to the bureaus is voluntary. Plenty of buy here pay here dealers do it anyway, some because reporting positive history helps customers rebuild, some because the threat of a reported default aids collections. Fair enough. But furnishing is a regulated activity under § 1681s-2, and it comes with two sets of duties.

The accuracy duty prohibits reporting information you know or have reasonable cause to believe is inaccurate, and requires prompt correction and updating. Regulators enforce that duty rather than private plaintiffs.

The dispute duty is where private lawsuits live. When a bureau forwards a customer's dispute, the furnisher must investigate, review the materials the bureau sends, report back, and correct or delete anything inaccurate or unverifiable, all inside the reinvestigation window in § 1681i, generally 30 days. A BHPH dealer whose DMS auto-verifies every dispute without anyone actually checking the account is manufacturing § 1681s-2(b) claims. And if information gets deleted and then reappears, the reinsertion rules require a furnisher certification of accuracy, so a sloppy re-report puts your store's name on the problem.

The same stores financing their own paper are usually collecting it too, which triggers a different federal statute with its own traps; we cover that in our article on FDCPA violations.

What FCRA violations cost

The statute runs damages on two tracks. A willful violation, which courts read to include reckless disregard of FCRA obligations, supports actual damages or statutory damages of $100 to $1,000 per violation, plus punitive damages and attorney's fees under § 1681n. Knowingly obtaining a report without a permissible purpose has its own line: actual damages or $1,000, whichever is greater. A negligent violation supports actual damages plus fees under § 1681o. The fee-shifting is the engine; a $1,000 claim with recoverable attorney's fees gets filed where a $1,000 claim alone never would. The FTC and CFPB can also bring their own enforcement actions with civil penalties.

The limitations period under § 1681p is the earlier of two years after the plaintiff discovers the violation or five years after it occurred. For dealers, the discovery trigger is the dangerous half: an impermissible pull from three years ago is still live if the customer only just noticed the inquiry.

What do consumers actually sue over? Three patterns dominate: impermissible pulls (the test-drive bureau, the cash-buyer bureau, the shotgunned application), errors that were deleted and then reinserted, and dispute investigations that never really happened. Two of the three run straight through a dealership.

A credit-file compliance checkup for your store

You can close most of this exposure in an afternoon. Walk these questions with whoever runs your desk:

1. Is there a signed, written authorization before every single bureau pull, with multi-lender submission disclosed in it?
2. Can anyone at the store pull credit, or only named users with logins? Who audits the pull log against signed applications?
3. What is the rule for test drives, cash buyers, and phone shoppers? If the answer is "we usually don't pull," you don't have a rule.
4. When a deal dies on credit, who confirms the adverse action notice went out, you or the lender?
5. If you furnish to the bureaus, who works disputes, on what deadline, and with what documentation? "The system handles it" is the wrong answer.
6. How long do you retain the signed authorizations? They are your defense file; five years is the outer limitations period.

If any of those answers made you wince, that's fixable, and far cheaper now than in discovery. A $500 Strategy Session will walk your credit-file practices end to end and hand you the fixes in writing, and for stores that want counsel on call year-round, The Driveway makes this review a membership benefit instead of a bill.