If you’ve ever looked at your credit report and wondered, “Who is this company, and why did it access my credit?” you’re asking exactly the right question.
Every hard inquiry represents a company accessing your consumer credit report. But companies don’t have unlimited access to that information. The Fair Credit Reporting Act (FCRA) restricts when a consumer report can be obtained and requires the company accessing it to have a legally recognized reason for doing so.
That reason is known as permissible purpose.
When you don’t recognize a hard inquiry, permissible purpose gives you something specific to investigate. Instead of simply telling a credit bureau, “This isn’t mine,” you can go directly to the company that accessed your report and ask a more useful question: What permissible purpose did you rely upon to access my credit report?
This guide goes deeper than the basics. It covers what the law actually allows, why some credit checks never become hard inquiries, where a car dealer’s authority starts and stops, what a bureau means when it says an inquiry was “verified,” and when identity theft calls for a different approach altogether.
Key Takeaways
- Every hard inquiry must be supported by a permissible purpose under the FCRA.
- A credit application you started is a permissible purpose on its own. The law doesn’t require a separate signed authorization.
- Account reviews and prescreened offers generally don’t count as hard inquiries, so they usually aren’t worth disputing.
- A dealer can’t pull your credit just because you asked for a test drive.
- A bureau’s “verified” result often confirms only that the pull happened, not why. That’s why the dispute starts with the company.
- An inquiry caused by identity theft has its own, faster remedy: a block under Section 605B.
What Is Permissible Purpose Under the FCRA?
Permissible purpose is a legally recognized reason for obtaining a consumer credit report. Section 604 of the FCRA (15 U.S.C. § 1681b) lists the circumstances under which a consumer report may be furnished and obtained.
Your credit report isn’t public information. A company cannot access it because it is curious about your finances or believes the information might be useful. It needs one of the reasons the law recognizes.
The most common ones:
| Permissible purpose | What it covers | Section |
|---|---|---|
| A credit transaction | A lender considering credit you applied for, or reviewing or collecting an account you already have | § 604(a)(3)(A) |
| Your written instructions | You expressly tell a company, in writing, that it may obtain your report | § 604(a)(2) |
| Employment | Hiring, promotion, or retention decisions, with additional disclosure and consent requirements | § 604(a)(3)(B), (b) |
| Insurance underwriting | An insurer deciding whether to cover you and at what rate | § 604(a)(3)(C) |
| Legitimate business need | A business transaction you started, such as renting an apartment or opening a utility or phone account | § 604(a)(3)(F) |
| Prescreened offers | A firm offer of credit or insurance you didn’t ask for, subject to your right to opt out | § 604(c) |
These aren’t the only permissible purposes, but they account for nearly every inquiry consumers ask about. The central point is that the company accessing the report must be able to connect its access to one of them.
Is Authorization the Same as Permissible Purpose?
No. This is one of the most important—and most commonly misunderstood—parts of inquiry disputes.
A lot of credit repair advice tells consumers:
“Make them show you your signature. If they can’t, the inquiry has to come off.”
That oversimplifies the law.
Written authorization is one permissible purpose. It isn’t the only one, and it isn’t required for every lawful credit inquiry.
If you apply for credit, the lender has a permissible purpose under Section 604(a)(3)(A) because you started a credit transaction. Nothing in that section requires a separate signed authorization, and many applications today are completed online or over the phone with no signature at all.
So when investigating a questionable inquiry, don’t limit your request to:
“Show me my signature.”
Ask the broader—and more important—question: What application, transaction, authorization, account relationship, or other permissible purpose gave your company the right to obtain my consumer report?
Then ask for records supporting that explanation.
Inquiry Removal Is a Process, Not a Template
Successful inquiry disputes often require follow-up, documentation, and knowing when to escalate the issue. SmartDispute.ai guides you through each step instead of stopping after a single dispute letter.
Start My First Inquiry DisputeWhy Some Credit Checks Never Become Hard Inquiries
Not every company that looks at your credit report creates an inquiry that lenders can see or that affects your score. Two common types generally stay out of sight.
Account Reviews
A company you already have an account with can review your report to manage that account: to decide whether to raise or lower your limit, for example. According to the FTC’s staff report on the FCRA, this “review” purpose applies only where the creditor has an existing account relationship with you, and a creditor can’t use it to market other products or services. Bureaus generally show account reviews in the part of your report that only you can see.
Prescreened Offers
When you receive a “you’re pre-approved” offer in the mail, a company has used your credit information to select you for a firm offer of credit or insurance. Section 604(c)(3) prohibits bureaus from furnishing a record of those inquiries to anyone but you. Lenders don’t see them, and they don’t affect your score. You can stop most of them by opting out at OptOutPrescreen.com.
Why this matters for a dispute: if an entry appears only in the soft-inquiry or “account review” section of your report, it isn’t hurting your credit, and disputing it won’t help. Focus on the hard inquiries you can’t connect to anything.
There is one edge case worth noticing. If a company you already do business with shows up as a hard inquiry and you didn’t request anything new, such as a credit line increase or a new product, it’s fair to ask what transaction that pull was tied to.
Car Dealers: Where the Authority Starts and Stops
Auto financing creates some of the greatest confusion around permissible purpose. You may visit one dealership, complete one financing application, and later find several unfamiliar lenders listed as hard inquiries on your credit reports.
That doesn’t automatically mean those inquiries were improper. Dealerships commonly submit your financing application to several lenders to find one that will approve it. When you started the underlying credit transaction, those prospective lenders may also have a permissible purpose to review your report. For scoring purposes, a cluster of auto-loan inquiries within a short window is often treated as one, as we explain in How Hard Inquiries Affect Your Credit Score.
But a dealer’s authority has limits. The FTC’s staff has advised that dealers may not obtain credit reports on consumers who are only taking a test drive or shopping. Asking to drive a car, or asking what a car costs, doesn’t show an intent to buy or finance it.
That gives you a sharper set of questions for any dealership inquiry:
- Did you actually ask for financing or a lease that day, or were you only looking?
- Did you tell the dealer you were paying cash or arranging your own loan?
- Is the inquiry dated a day you never visited the dealership?
- Does each lender’s inquiry connect to the application you completed?
An inquiry from a visit where you never asked for financing is exactly the kind worth questioning.
What “Verified” Means for an Inquiry
Consumers are often told that a disputed inquiry was “verified” and left wondering what was actually checked. The answer explains why inquiry disputes work best when they start with the company that pulled your report.
Under Section 607(a) of the FCRA, a business that wants to receive consumer reports must identify itself, certify the purposes for which it will use the information, and certify that it will use the information for no other purpose. The bureau must make a reasonable effort to verify the business’s identity and its certified uses.
That system is designed to screen businesses as subscribers. It doesn’t ask the business to document each individual pull to the bureau. So when a bureau reports that an inquiry was “verified,” it often means only that a known, certified subscriber accessed your report on that date. Whether that subscriber had a permissible purpose to pull your report is a separate question, and the company is the one holding the answer.
That’s why the inquiry dispute strategy starts with the company that made the inquiry and goes to the bureau second, with a record of what the company said, or didn’t say.
When the Inquiry Came From Identity Theft
A permissible-purpose dispute is the right tool when you don’t recognize an inquiry and want the company to explain it. When you know the inquiry came from someone using your identity, there’s a stronger and faster remedy.
Under Section 605B of the FCRA, a credit bureau must block information in your file that resulted from identity theft. To use it, you provide the bureau with:
- Proof of your identity
- A copy of an identity theft report
- Identification of the information that resulted from the theft
- A statement that the information doesn’t relate to any transaction you made
The bureau must block the information within four business days of receiving those documents. You can create an identity theft report and a recovery plan at IdentityTheft.gov, the FTC’s official site.
The same rule that makes this remedy powerful also makes it the wrong tool for an inquiry you simply don’t recognize. An identity theft report is a statement that someone else used your identity. Don’t make that claim unless it’s true. If you aren’t sure, start with a permissible-purpose request; the company’s answer may tell you which situation you’re in.
Other Edge Cases Worth Knowing
The Inquiry Isn’t From a Lender
It’s easy to assume only lenders can check your credit. But landlords, utilities, and cell phone carriers can have a legitimate business need to check your credit when you apply for their services, under Section 604(a)(3)(F). An inquiry from one of them isn’t improper just because it isn’t a lender.
The Same Company Pulled More Than Once
A lender may check more than one bureau for a single application, and each pull appears on that bureau’s report. That’s normal. Several pulls by the same company on the same bureau, on different days, deserve a question: which application was each one tied to?
The Inquiry May Belong to Someone Else
Credit files sometimes get mixed between people with similar names or other overlapping details. If a company can’t connect the inquiry to an application with your identifying information, ask what information it used to match the report to you.
The Name Means Nothing to You
Lenders often appear under their legal or corporate names. JPMCB Card Services, for example, is Chase. Look up the name before assuming the worst.
What Happens If a Company Can’t Establish a Permissible Purpose?
If the facts indicate that a company obtained your consumer report without a permissible purpose, you have grounds to challenge the inquiry and seek its removal.
Obtaining a consumer report without a permissible purpose can also violate the FCRA. The law provides different remedies depending on the company’s conduct: willful noncompliance can involve actual or statutory damages, punitive damages, and attorney’s fees, while negligent noncompliance generally requires actual damages. Whether liability exists depends on the facts of the particular case.
This doesn’t mean that a company’s failure to immediately send you a signed application proves the inquiry was illegal. Nor does every questionable inquiry create a right to damages.
For most consumers, the practical objective is simpler:
If the company cannot connect its inquiry to a legitimate permissible purpose, why should that inquiry remain on your credit report?
That is the question your correspondence should require the company—and, if necessary, the credit bureau—to address. We walk through the order of those steps in How to Remove Hard Inquiries From Your Credit Report, and the letters for each round are in Free Inquiry Dispute Letters That Work.
Stop Disputing Hard Inquiries the Old Way
Most websites tell you to dispute inquiries with the credit bureaus first. That’s rarely the most effective approach. SmartDispute.ai helps you challenge the companies that accessed your credit and build the documentation you may need before involving the bureaus.
Get Started!Permissible Purpose Turns an Inquiry Into a Factual Question
There is no magic phrase for removing hard inquiries.
Permissible purpose is useful because it gives consumers a structured way to investigate an inquiry they don’t understand.
You don’t have to begin by accusing a company of fraud. You don’t have to claim identity theft when identity theft didn’t occur. And you don’t have to rely on a generic letter telling a credit bureau that you don’t recognize an inquiry.
Start with the facts.
Who accessed your report? When did they access it? What transaction was involved? What permissible purpose did they rely upon? What records support their explanation?
SmartDispute.ai’s AI credit repair tools work from your actual credit-report information, helping you identify questionable inquiries, prepare customized correspondence, track responses, and organize the documentation you’ll need if the dispute moves to the credit bureaus.
The goal isn’t simply to send another dispute letter.
It’s to ask the right company the right question—and build a documented record of the answer.