Hard Inquiries: How Long They Stay, and When One Is Illegal

You pulled your credit report to check on something else, and there it is: an inquiry from a company you do not recognize. Maybe several. The first question everyone asks is how long the thing is going to sit there.

Here is the short answer, and then the question that matters more.

How long do hard inquiries stay on your credit report?

Up to two years. That is how long a hard inquiry remains visible on the report itself.

The effect on your score is much shorter and much smaller than the two-year figure suggests. FICO scoring models generally consider inquiries from only the most recent twelve months, and FICO reports that for most people a single additional inquiry takes fewer than five points off the score. Inquiries sit inside new credit, which at 10 percent is one of the two lowest weighted of the five factors FICO uses. If you were rate-shopping for a mortgage or an auto loan, multiple pulls inside a short window are usually treated as one event rather than several.

So if you applied for the credit, the honest answer is that this is a small, temporary mark and you can stop worrying about it.

If you did not apply, stop reading the score advice. The problem is not the handful of points. The problem is that somebody accessed your credit file, and federal law is specific about who is allowed to do that.

The question behind the question: did you authorize it?

Every article you will find on this topic is written by a lender, and they all answer the duration question and stop. None of them tells you the part that actually matters when the inquiry is one you do not recognize.

Your credit file is not public. Under the federal Fair Credit Reporting Act, a company may obtain your consumer report only for a reason the statute allows, and 15 U.S.C. 1681b(f) makes it unlawful to use or obtain a report without one.

That is not a technicality. It is the whole architecture of the law: your file is available for specific purposes, to specific people, and nobody else.

What "permissible purpose" actually means

15 U.S.C. 1681b lists the circumstances in which someone may pull your report. In plain terms, the common lawful ones are:

• You applied for credit, and the lender is evaluating that application.

• You applied for insurance, or for a job where you gave written permission.

• You applied to rent, and the landlord or screening company is reviewing you as a tenant.

• A creditor is reviewing or collecting on an account you already have with them.

• A court order or a federal grand jury subpoena requires it.

• You gave written instructions authorizing it.

Notice what is not on that list. Curiosity is not a permissible purpose. Neither is checking up on someone, nor running a report on the wrong person because a name matched.

When an inquiry is a violation rather than an annoyance

These are the fact patterns worth a second look:

1. A lender you never applied to. The clearest case. If you have no relationship with the company and never submitted anything, there is no obvious purpose that permits the pull.

2. A dealership that pulled repeatedly. Shopping for a car often means one application shopped to several lenders, which is lawful. A dozen inquiries from dealers you never visited is a different situation.

3. A pull after you withdrew. You started an application, changed your mind, and the report was obtained anyway.

4. A debt collector with no account of yours. Collecting on an existing account is permitted, and so is a buyer valuing a real debt it is considering purchasing. What neither covers is pulling the file of someone who owes nothing to anyone in that chain, and that often signals the collector has the wrong person entirely, which raises a separate set of problems.

5. An employer without written permission. Employment screening requires your written authorization, separately disclosed.

6. Inquiries clustered around identity theft. If unfamiliar inquiries appear alongside accounts you did not open, the inquiries are evidence in a larger problem. Our guide to identity theft on your credit report covers the blocking rights that apply.

Why disputing with the bureau often fails

The standard advice, including from the lender-written pages ranking for this question, is to dispute the inquiry with the credit bureau. You should know before you spend two months on it that this frequently does not work, and why.

A dispute asks the bureau to verify information with whoever furnished it. When the furnisher is the company that pulled your file, it confirms that yes, it pulled the report. The inquiry is accurately recorded, because it did happen. The bureau closes the dispute and the entry stays.

The dispute process is built to correct inaccurate information. An unauthorized inquiry is usually not inaccurate. It is accurate and unlawful, which is a different problem with a different remedy.

Your claim runs primarily against the company that pulled the report, rather than against the bureau that recorded it. Bureaus carry their own duty to limit who receives your file, but the party that obtained the report without a permissible purpose is the usual defendant. That is the step nobody tells you, and it is the reason people give up at exactly the point they should be talking to someone. If you have already been through a dispute cycle that went nowhere, our note on when a dispute is not enough covers the wider pattern.

What you can recover

The FCRA separates violations by state of mind, and the difference matters to what is available.

• Willful violations, 15 U.S.C. 1681n. You may recover either your actual damages or statutory damages of $100 to $1,000, whichever you elect, plus punitive damages the court allows, plus costs and reasonable attorney's fees.

• Negligent violations, 15 U.S.C. 1681o. Actual damages, plus costs and reasonable attorney's fees. There is no statutory minimum here, so this route depends on demonstrable harm.

Actual damages are not limited to money lost. Denied credit, a worse rate, time spent untangling it, and emotional distress can all count, though every element has to be shown rather than assumed.

The fee-shifting is what makes these cases practical. Because a successful consumer recovers attorney's fees from the violator, a claim does not need to be worth a fortune to be worth bringing, and consumer-protection firms typically work these on contingency.

How long you have to act

Do not confuse the two clocks in this article. They are unrelated and one of them is a deadline.

The two-year figure at the top is how long the inquiry is displayed. The deadline to sue is set separately by 15 U.S.C. 1681p: an action must be brought within two years after you discover the violation, or within five years after the violation occurred, whichever comes first.

The practical consequence is that waiting for an inquiry to age off the report is the worst possible strategy. The display period and the limitations period can expire together, and the entry disappearing does not restore the claim.

What to do next

1. Pull all three reports, not one. Equifax, Experian and TransUnion each keep their own inquiry list, and a pull may appear on one and not the others. Free reports are available at annualcreditreport.com.

2. Save the report itself, not a screenshot of the score. You need the page showing the inquiry, the company name and the date.

3. Write down what you were doing around that date. Whether you applied for anything, visited a dealership, or gave anyone permission is the single most important fact, and memory fades.

4. Do not assume an unfamiliar name means fraud. Lenders often appear under a parent company or a servicing name you would not recognize. Identify the company before concluding anything.

5. Dispute if you want to, but do not wait on the outcome. The limitations clock is running whether the dispute resolves or not.

When to talk to a Florida consumer-protection attorney

Most hard inquiries are routine and need nothing from anyone. It is worth a conversation when the facts look like these: an inquiry from a company you have no relationship with, repeated pulls you did not authorize, a report obtained after you withdrew an application, a collector accessing your file over a debt that is not yours, or unfamiliar inquiries sitting alongside accounts you never opened.

Because the FCRA shifts attorney's fees to a successful consumer, these claims are typically handled on contingency, meaning no fee unless there is a recovery. The practical question is rarely whether a case is large enough. It is whether the pull had a permissible purpose and whether the evidence still exists, which is why the preservation steps above come before anything else.

If a company you do not recognize has pulled your credit, you can have the inquiry reviewed at no cost through a free case review. Bring the report page showing the inquiry and the date.