Has Your Credit Report Been Viewed Illegally?

Mari Frank couldn't figure out how an identity thief got her Social Security number and birthdate -- until she noticed that her credit report had been viewed by a company she never heard of.

"I had to go through my credit report with a fine-tooth comb," said Frank, a California attorney who has become an expert on identity theft since her run-in with it in 1996. "There was an inquiry there from a mortgage company -- I wasn't buying a house, I hadn't refinanced."

Though most credit report inquiries are legitimate, there are several scenarios that can easily lead to it being read by someone who shouldn't. The information contained there can be used to steal your identity, damage your credit or, at the very least, invade your privacy.

A limited number of entities can legally view your report, under provisions of the Fair Credit Reporting Act. Those include a company planning to offer you insurance or credit (this includes landlords and utilities), a company with which you have an existing debt, an employer or prospective employer, or a court, state or law enforcement agency. You do have the option to voluntarily give permission to anyone you choose to see your report and, of course, you can see it yourself. That's it.

But there are a surprising number of ways your credit report could wind up in the wrong hands.

In Frank's case, it turned out to be a clerk at a law firm that was representing a mortgage company who misused her credit report. The firm had legitimate access to the credit reporting system, but the rogue employee used it to set up credit cards and get loans in Frank's name. It took 11 months to clear up more than $50,000 in fraudulent debts that were attributed to her, Frank said.

Illegal viewing of your credit report should be taken seriously, says Cary Flitter, partner at consumer law firm Flitter Lorenz in Philadelphia. "When people get your credit report illegally, it's as if they had broken into your house, jimmied open your desk and looked through all your manila folders. Here's your mortgage status, here's a collection letter you received. It's all in one place and organized."

The Federal Trade Commission received more than 279,000 complaints about identity theft in 2011, which topped the complaint list for the twelfth year running. Some portion of those are the result of credit report abuse, but the scale of the problem is difficult to determine, an agency spokesman said. It is rare that a victim can tell -- as Frank did through painstaking research -- that their credit report was misused. "People wouldn't know if someone is accessing their credit report who shouldn't access it," said Mitchell Katz, senior public affairs officer at the FTC.

Here are the most common scenarios in which your credit report might be viewed illegally.

Love gone wrong

If you're in the midst of a divorce or a child custody battle, your ex, his or her lawyer, or a private investigator working for that lawyer might pull your credit report to check on your activities and look for accounts or assets you may be keeping secret. Legally, they have no right to do this unless they've obtained a court order. If they haven't, "you absolutely have the right to sue them as this violates the Fair Credit Reporting Act," says personal finance author David Bakke.

There's another possible scenario even before lawyers and private investigators get involved: Your spouse or partner could decide to take a look at your credit report in search of secret accounts that may indicate infidelity (or at least financial infidelity). If he or she has access to your Social Security number, bank or credit card account numbers and is likely to know the answers to your security questions, it may be easy enough to request a credit report or view one online while pretending to be you.

What to do about it: Strictly speaking, a spouse or partner who does this has committed identity theft, says Rod Griffin, director of public education at credit bureau Experian. You'd be well within your rights to file a police report, he says, but depending on the situation, you may not want to go that far. "It's a difficult challenge," he says. "You'll have to have some very difficult discussions with that person."

A better option might be to freeze your credit report with each of the three bureaus, particularly if you know that separation or divorce is on the horizon. Freezing your report renders it inaccessible for most uses, although a company with which you already have debt will still have access, as will courts and governments and private investigators -- but only when performing government-sanctioned background checks. The cost to freeze a report is set by state law and is usually quite low.

In most cases, you can "thaw" a report temporarily, for instance, while shopping for a car loan, and then refreeze it when you're done. Freezing and thawing can be done online, by password.

In a divorce or child custody situation, another possible scenario is that your spouse or spouse's attorney will actually request that you obtain your own credit report and provide it voluntarily. In this situation, your smartest move may be to comply, assuming you have nothing to hide. The other side may well be able to get a court order demanding it anyway, and your refusal will likely arouse suspicion. "If there's hesitation in providing a credit report, that's smoke," says Lili A. Vasileff, a certified financial planner who specializes in divorce. "It means there may be something in there that's unknown to your spouse."

Unauthorized use scenarios, penalties

An entrepreneur -- and a client of Flitter's -- opened a business account at a local branch of a national bank. A month or two later, while routinely reviewing his credit report, he was surprised to see an inquiry from that bank. The bank would have been well within its rights if he'd applied for a loan or a line of credit, but he'd done neither.

"He inquired and didn't get a very satisfactory answer," says Flitter, who is representing the entrepreneur in a lawsuit against the bank. "When he pressed them, they told him they should have gotten his authorization, but had made an oversight."

The Fair Credit Reporting Act caps actual damages at $1,000 if the error was due to an oversight, but consumers can also sue for punitive damages, attorney's fees and court costs, Flitter says. In this instance where the bank admitted wrongdoing, he's confident it will have to pay for its mistake. The question is how much and depends in part on whether this truly was a one-time oversight as the bank claims, or part of a pattern of pulling reports illegally.

A more sinister unauthorized use is when an institution with access to your credit reports uses that information to take advantage of you. For instance, an insurance company is legally entitled to view your credit report when deciding whether to issue you insurance, but not because you filed a claim. It matters because they can use that information to unfair advantage in negotiations.

"Let's say you were in a car accident and couldn't work," Flitter says. "You have a lawyer who says your case is worth $200,000, but the insurance company offers you $40,000." If the insurance company views your credit report at that point, it may be able to determine how desperately you need cash by viewing debt amounts and any unpaid bills. As a result, the insurer may not raise its settlement offer..

"That's absolutely illegal -- it gives them an impermissible view into your finances," Flitter says. But sometimes they do it anyway. In fact, this happened to another client of Flitter's who was hit by a drunken driver. "The insurance company pulled both his and his wife's credit reports," he says. When the couple sued, the insurance company claimed it had never done this before. "We found out they had done it four times in the previous year alone," Flitter says.

What to do about it: If a company has looked at your credit report without a legitimate reason or permission, you should consider contacting a consumer law attorney. Even if you aren't harmed by illicit access of your credit report, "privacy loss always has value," Flitter says. Beyond that, illegal access may lead to very real harm. Years ago, Flitter says a client of his took a test drive at a car dealership and while he was on the drive, a sales rep pulled his credit report. This in itself was illegal: Dealerships are not allowed to view a customer's credit reports until that customer specifically asks for credit terms. Three weeks later, Flitter's client began seeing suspicious credit activity. It turned out the sales rep was on parole for theft, and had apparently sold the credit report.

Employers who don't know the law

Depending on the laws in your state, a prospective employer may be able to view your credit report before making a job offer. But did you know that a current employer can also access your report while you're an employee? Some employers make a practice of period spot checks for employees in sensitive positions. "We have a client that's an armored car company, and they check employees' credit reports once a year," says Marc Bourne, vice president, Know It All Intelligence Group, a Philadelphia-area firm that offers employment screening.

A growing number of states, including California, Connecticut and Illinois, enacted laws severely restricting in what circumstances employers can view credit reports. Because new laws are being introduced all the time, affected employers may not be current on the rules. "We have a legal staff that keeps up to date and issues alerts," Bourne says. "It's pretty much a full-time job." For companies that don't have staff devoted to these issues, it would be easy to mistakenly break the law, he says.

What to do about it: It's illegal for an employer to obtain your credit report without providing written notification first. And that notification must be presented on its own page (not buried in the fine print on a lengthy application form, for instance). So carefully read any documents a prospective or current employer gives you. Be aware that granting authorization for a "background check" includes permission to view your credit report.

Make sure you know the law in your state, so that if an employer does plan to see a credit report, you'll know whether it has that right. Of course, refusing permission could cost you the job, so that can be a tough decision to make. On the other hand, if you don't get or don't want the job and an employer has checked your credit report illegally, there's plenty you can do.

"Dispute it with the credit bureau," Bourne says. "Most people think they can dispute only credit information, but you can dispute anything including an inquiry." Next, he advises, file a complaint with the Federal Trade Commission, which you can do online. "We have to investigate any time an applicant calls and makes any kind of FTC complaint," he says. "You can also go to your state's attorney general's office and county bureaus of consumer protection and make complaints there."

Garden-variety identity theft

Then there is the scenario that Mari Frank lived through. Credit reports are like manna from heaven for identity thieves. Your credit report contains current and former addresses and accounts that can be used to impersonate you. In 2005, this happened on a grand scale: Ambitious identity thieves set up fake businesses specifically to obtain credit reports from consumer data broker ChoicePoint, and ultimately gained access to up to 160,000 records. That event spurred most states to enact laws requiring that consumers be notified of any security breach that could put their personal data at risk of theft. Another result of this breach is that credit reports now only show partial Social Security and account numbers as an added layer of protection, but a criminal who obtains your credit report illegally can still use it to do plenty of damage.

What to do about it: If a miscreant is indeed trying to steal your identity, the first sign may be a credit report inquiry from a company you don't recognize, so it's important to investigate any unfamiliar inquiry. If your investigation turns up anything suspicious -- for instance, someone trying to obtain credit in your name -- contact all three credit bureaus to alert them about the fraud and ask them to put a temporary security alert on your information that will tell creditors to take extra steps to verify your identity if credit is requested.

"By law, lenders cannot ignore security alerts," Griffin says. "So if a fraudster applies for credit, they should ask for extra documentation." In addition, he says, contact lenders or other companies where you appear to have accounts you didn't open and alert them to the fraud.

Your next step should be to file a fraud report with local law enforcement, he says. "Once you have that, you can add a victim statement to your credit report." That allows the credit bureau to remove fraudulent accounts from your report, he says. And you can ask to have creditors contact you before granting any credit in your name.

Additional reporting by Fred O. Williams.