Every hard inquiry on your report must have a permissible purpose under FCRA §604. In practice, that permission is either a written application you signed or an existing business relationship. Anything else is challengeable — and unauthorized pulls happen more than the industry admits.
What §604 requires
A consumer's report may only be furnished in response to a written instruction of the consumer, or in connection with a credit transaction the consumer initiated, or for other specifically enumerated purposes (employment with consent, insurance underwriting, certain government purposes).
If none of those apply, the pull is unauthorized. §616 and §617 provide statutory damages.
How to identify challengeable inquiries
Pull all three reports. Compare inquiries by date and lender name.
Anything you don't recognize gets flagged. Auto-finance shotgun inquiries (one dealer visit generating 8 inquiries) are a common source of unauthorized pulls.
Anything associated with an account you never opened is potentially identity-theft-related — that's a §605B path, not a §604 path.
The right letter, in order
First: written request to the furnisher (the entity that pulled) for proof of permissible purpose. They must produce it or delete.
Second: §611 dispute with the bureau, citing the furnisher's failure to produce.
Third: CFPB complaint if the inquiry persists.
Statutes & sources cited
- FCRA §604 — permissible purposes of consumer reports
- FCRA §616, §617 — civil liability for noncompliance
- FCRA §605B — identity theft block workflow