Removing hard inquiries you didn't authorize, the legitimate way

The most common mistake with inquiries is disputing all of them and hoping a few fall off. Some credit repair companies sell exactly that. It usually fails, because a bureau checks with the company that pulled your report, the company confirms you applied, and the inquiry stays. Now you’ve spent a month and gotten nothing.

The inquiries worth fighting are the ones you genuinely didn’t authorize. A company needs a legal reason to pull your file, and when it had none, the entry is inaccurate and the dispute process applies. Most of the work is sorting those few from the many that only look unfamiliar.

Start by ruling out the usual false alarms

Plenty of legitimate pulls show up under names you won’t recognize. Before you dispute anything, check each unfamiliar inquiry against this list.

Equifax says a hard inquiry you don’t recognize “could be a sign of identity theft,” so don’t skip the ones that survive this check. Pull all three reports and look for new accounts, new addresses or new names next to the inquiry. You can get them free every week at AnnualCreditReport.com.

The rule a company broke if it pulled without permission

A company can’t pull your report just because it wants to. The FCRA lists the purposes a report can be furnished for, including a credit transaction involving you, a business transaction you started, or your written instructions. Then it adds a rule for users: “A person shall not use or obtain a consumer report for any purpose unless” it’s for one of those purposes and the user has certified that purpose (15 U.S.C. 1681b(f)).

So an inquiry from a company you never applied with and never authorized has no legitimate basis. That’s an inaccuracy on your report, and the dispute process is built for inaccuracies.

Path one: a company pulled without your authorization

This covers a lender that ran your credit after you only asked for a rate quote, a dealer that pulled after you said no, or a company that pulled the wrong person’s file.

1. Contact the company first. Ask in writing what permissible purpose it had and for a copy of any authorization you supposedly gave. If it can’t produce one, ask it to notify the bureau to remove the inquiry.
2. Dispute with each bureau that shows it. Say the inquiry was made without your authorization or a permissible purpose, and include anything the company sent you. The bureau generally has 30 days to complete its reinvestigation, extendable to 45 if you send more information during that time, and must send results within 5 business days after it finishes (15 U.S.C. 1681i).
3. Keep a file. Dates, names, copies of letters. If the bureau verifies an inquiry you can show you never authorized, the steps in your dispute came back verified apply.

Our general walkthrough on disputing a credit report error covers how to write and send the dispute, and the free letter builder can draft it from your facts.

Path two: someone applied for credit in your name

If the inquiry came from a fraudulent application, the inquiry is the smaller problem. The applicant may have succeeded somewhere else. Move fast, in roughly this order:

1. Freeze your credit at all three bureaus so new applications in your name fail. Freeze vs. fraud alert vs. lock explains the difference.
2. Check for new accounts on all three reports, not only inquiries.
3. File an identity theft report with the FTC at IdentityTheft.gov.
4. Use the identity theft block. Under 15 U.S.C. 1681c-2, a bureau must block “any information” in your file that you identify as resulting from identity theft, within 4 business days of receiving proof of identity, a copy of an identity theft report, the specific items to block and your statement that they aren’t yours. Our guide to the 605B identity theft block walks through the package.

If new accounts did open, fraudulent accounts and inquiries covers closing them and clearing the debt from your name.

What not to do

Only claim identity theft when it happened. An identity theft report is a statement to the federal government, and filing a false one to clear accurate inquiries can create legal trouble far worse than a few points.

Don’t send a stack of form letters disputing every inquiry on the report. A dispute of an inquiry you did authorize is a dispute of accurate information, and the bureau will usually verify it after checking with the company that pulled.

If the inquiry is real and just annoying, the honest fix is time. FICO Scores stop counting inquiries after a year, and they leave the report after two. FICO also says that for most people, one additional inquiry takes fewer than five points off.

Your checklist

Pull all three reports. Match every hard inquiry to an application, a dealer visit, a service signup or a vendor. For any you can’t match, contact the company, then dispute with the bureau. For any that came from fraud, freeze first, report it, and request a block. Keep copies of everything, and check your reports again after 45 days to confirm the result.