Credit Reporting Agencies and You

If you've ever signed up for a credit card or taken out a loan to buy a car, the credit card company or bank has probably checked your credit report to see if you qualify. But where does the information in your credit report come from?

In today’s WatchBlog, we look at consumer (or credit) reporting agencies (CRAs) and how they collect and use your data.

Credit reporting 101

There are more than 400 CRAs in the United States, but the 3 you’ve probably heard of—Equifax, Experian, and TransUnion—are the largest. These companies collect vast amounts of sensitive information (including addresses, birth dates, and credit card, driver’s license, and Social Security numbers), package it into consumer reports, and sell the reports to third parties.

Then, the third parties, such as banks and insurers, use the reports to determine consumers’ eligibility for products and services such as loans, credit cards, and insurance.

Where do the data come from?

There are three main players in the consumer reporting market:

1. Furnishers, such as banks and credit card companies, collect consumer information, like account openings, bill payments, and delinquency notices, and provide that information to CRAs.
2. CRAs then compile this and other information, including data from public records such as bankruptcies, to produce credit reports.
3. Users, including banks, credit card companies, employers, and other entities, purchase the reports to make eligibility decisions for individual consumers. Some institutions, such as banks, may act as both furnishers and users.

Image

What rights do you, the consumer, have?

During the reporting process, you as the consumer don’t necessarily interact with a CRA. However, if you discover inaccurate information on your report, you can file a dispute with the CRA or the furnisher. You also can request copies of your reports from CRAs directly, and CRAs may provide disclosures about how your information is shared.

You can also place some protections on your credit report which can help prevent fraudsters from opening a new account in your name. For instance, you can freeze your credit report free of charge, which restricts creditors from accessing your credit report. You can also place a free fraud alert on your credit report, which requires businesses to verify your identity before opening an account in your name.

However, unlike with many other products and services, you generally cannot prevent a CRA from maintaining information about you, such as if you have concerns about that CRA’s privacy or security practices. In addition, you as the consumer do not have a legal right to delete your records with CRAs.

What’s the risk?

CRAs may present heightened risks because (1) they possess a lot of sensitive consumer information, which may be breached, and (2) consumers have very limited control over what information CRAs hold and how they protect it. As such, effective federal oversight of CRAs is critical. Check out our report for our suggestions for how the government can improve oversight of CRAs and effectively act against data privacy and security violations.

Comments on the WatchBlog? Contact blog@gao.gov.