Credit inquiries · FloridaA hard inquiry is on your credit report, and you never applied for anything.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: A company may obtain your credit report only for a purpose the FCRA permits, such as an application you made, an account it holds, or collection of a debt you owe. If none existed, the company that pulled it may be liable. Dispute the inquiry with the bureau, and if accounts were opened, treat it as identity theft.

What is a hard inquiry, and why is there one I don't recognize?

A hard inquiry is a record that a company requested your credit report in connection with an application for credit or a similar transaction. Other people who view your report can see it. One you don't recognize usually means a mistaken pull, a lender using an unfamiliar name, an application sent to several lenders, or someone applying in your name.

Soft inquiries, like checking your own report, prescreened offers, and periodic reviews by companies you already have accounts with, are shown only to you and do not affect lending decisions. Hard inquiries are the ones tied to applications, and they are the ones to investigate when you don't recognize them. Bureaus generally keep hard inquiries on your report for about two years.

Before assuming the worst, rule out the innocent explanations. A single car loan application at a dealership can produce inquiries from several lenders the dealer sent it to. A store card is often issued by a bank whose name you never saw. A mortgage pre-approval, an apartment application, a new utility or phone account, and a request to raise a credit limit can all generate a hard pull you authorized without remembering the company's legal name. The Fair Credit Reporting Act (FCRA), the federal law that governs credit reports, entitles you to a list of everyone who procured your report in the past year (two years for employment purposes) as part of your file disclosure (15 U.S.C. § 1681g(a)(3)), which is how you pin down who pulled it and when.

Who is allowed to pull my credit report?

Only someone with a "permissible purpose" listed in the FCRA. The common ones are a credit transaction you initiated, review or collection of an account you have, employment with your written permission, insurance underwriting, a legitimate business need in a transaction you started, a court order, or your written instructions. Curiosity is not on the list.

The list is in 15 U.S.C. § 1681b(a), and the statute adds a direct command: no one may use or obtain a consumer report unless it is for a permissible purpose, and the user must certify that purpose to the bureau (§ 1681b(f)). Bureaus, for their part, must keep reasonable procedures to limit reports to permissible purposes and to verify the identity and purpose of new users (§ 1681e(a)). Employers must have your written authorization before pulling a report, on a stand-alone disclosure (§ 1681b(b)(2)). A landlord screening your application and a lender processing one you submitted both have a purpose. A debt collector pursuing an account you actually owe generally does too, which is why the collector inquiries that raise real questions are the ones on debts that were never yours.

Not knowing a company's name is not the same as not authorizing the pull. The question is whether you started a transaction, or have an account, that gave that company a reason to look.

Who is liable for an inquiry I didn't authorize: the bureau or the company that pulled it?

Usually the company that pulled it. The FCRA's damages provisions apply to any person who violates the Act, and obtaining a report without a permissible purpose is the user's violation. For a knowing pull without a permissible purpose, the statute sets actual damages or $1,000, whichever is greater. The bureau is liable if its own procedures were unreasonable.

The FCRA's remedy sections, 15 U.S.C. §§ 1681n and 1681o, reach "any person" who fails to comply, so the lender, dealer, collector, or other business that obtained your report can be a defendant on its own. Section 1681n(a)(1)(B) addresses the user that obtains a report under false pretenses or knowingly without a permissible purpose: actual damages or $1,000, whichever is greater, plus punitive damages as the court allows, plus attorney's fees and costs. A negligent violation allows actual damages plus fees and costs.

The bureau's exposure is different. It is not liable simply because a user misused its data; it is liable if its procedures for releasing reports and screening users were unreasonable (§ 1681e(a)). And one honest caution about identity theft: when a thief applied in your name, the lender believed it was processing your application, and courts have often treated that as a permissible purpose. In those cases the stronger claims are usually about the fraud accounts that followed and how the bureaus and furnishers handled your disputes, not about the inquiry itself. See identity theft accounts on your credit report.

How do I dispute a hard inquiry I didn't authorize?

In writing, with each bureau showing it, the same way you dispute any item in your file. Identify the inquiry by company name and date, state that you did not apply for credit with that company or authorize it to obtain your report, and ask the bureau to remove it. Also write to the company that pulled it.

The FCRA's dispute rules in § 1681i cover any item of information in your file, and an inquiry is an item. The bureau has 30 days (45 in some cases) to reinvestigate, must notify the company that made the inquiry within 5 business days, and must delete anything it cannot verify. Bureaus sometimes respond that an inquiry is "a factual record of a request" and leave it in place. That answer is where the company's permissible purpose becomes the question, so write to the company directly: ask what permissible purpose it had, and ask for a copy of the application it says it received. Its answer either explains the inquiry or becomes evidence.

If the inquiry looks like identity theft, add the identity theft tools at the same time. An initial fraud alert is free, lasts one year, and need only be placed with one nationwide bureau, which must pass it to the others; an extended alert lasts seven years with an identity theft report. A security freeze is free and stops most new creditors from seeing your report. And with an FTC identity theft report, proof of identity, and a list of the items, a bureau must block information that resulted from identity theft, inquiries included, within 4 business days (§ 1681c-2). You do not need a police report to dispute, and mail by certified letter with copies gives you the record. My dispute guide has a letter format.

Is an unauthorized inquiry worth suing over?

Sometimes, and often not on its own. An inquiry that caused no denial, no account, and no other harm is a small case, and the law requires a concrete injury to sue. Privacy-type harms, like a stranger obtaining your report, fare better than paperwork harms, but the strongest cases are those where fraud accounts or a denial followed.

Two legal rules keep inquiry cases modest. First, statutory damages require a willful violation, and the $1,000 floor applies to a knowing pull without a permissible purpose; a company that pulled your report through a clerical mix-up may owe only the actual harm it caused, which can be close to nothing. Second, courts require a concrete injury, and a single inquiry with no consequences is the kind of bare violation that gets dismissed. Accuracy and privacy claims generally fare better than technical ones, and an unauthorized look at your financial life is a privacy harm, but I will not tell you a lone inquiry is a big case when it usually is not.

Where inquiry cases become real is when something followed: an account opened in your name, a denial that cited too many recent inquiries, or a pattern of pulls by a collector on a debt that was never yours. If accounts were opened, the identity theft page is the one to read, because the block, the furnisher duties, and the reinvestigation rules give you far more to work with than the inquiry does.

What do Florida's courts add?

Florida's federal courts apply Eleventh Circuit precedent, and Florida's state courts require the same concrete injury that federal courts do (Saleh, 2023), so a bare inquiry with no consequences is a hard case anywhere in the state. Where the inquiry is part of an identity theft, the Eleventh Circuit's dispute decisions (Hinkle, Milgram) govern the accounts that follow.

Hinkle (2016) means the furnisher that opened the fraud account must actually investigate your dispute and delete what it cannot verify. Milgram (2023) means each new dispute can start a new two-year clock. Both matter more than the inquiry rules once accounts exist. For the inquiry alone, the practical path in Florida is a documented dispute, a written demand to the company for its permissible purpose, and an honest look at what harm followed. My office is in Tampa, and I take these matters from across Florida.

What can an unauthorized inquiry case be worth?

For a knowing pull without a permissible purpose, the FCRA sets actual damages or $1,000, whichever is greater, plus punitive damages, attorney's fees, and costs. For other willful violations, actual damages or $100 to $1,000, plus punitive damages, fees, and costs. For negligent violations, actual damages plus fees and costs. Removal of the inquiry is often the result.

Actual damages can include a denial that cited the inquiry, time and money spent, and distress, but for a lone inquiry those are often small, and I would rather say so than oversell. Where the inquiry is one piece of an identity theft case, the damages picture changes, because the fraud accounts and the failed disputes carry their own statutory and actual damages. When a consumer wins any of these claims, the defendant pays the consumer's reasonable attorney's fees and costs, which is what makes a smaller claim possible at all. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign. The statute also allows fees against a party who files in bad faith.

What are the deadlines?

Two years from when you discover the violation, and no more than five years after it happened. For an inquiry, discovery is usually the day you saw it on your report, so the clock may already be running. Bureaus generally show hard inquiries for about two years, so pull your reports regularly to spot them.

The rule is 15 U.S.C. § 1681p. Identity theft has its own urgent clocks: a fraud alert starts protecting you the day it is placed, a bureau must honor a complete block request within 4 business days, and the sooner fraud accounts are disputed the less damage they do. If you are also seeing charges or transfers from a bank account, that is a separate claim with a one-year deadline; see bank denied your fraud claim.

What should I do today?

• Pull all three reports through AnnualCreditReport.com and list every hard inquiry you don't recognize, with the company name and date.
• Rule out your own applications: car dealer financing, store cards, apartment or utility applications, credit limit increases, and pre-approvals from around that date.
• Check for other signs of identity theft: new accounts, addresses, names, or employers on the report that are not yours. If you find any, place a fraud alert or freeze now and read the identity theft page.
• Dispute by certified mail with each bureau showing the inquiry, and write to the company asking what permissible purpose it had and for a copy of the application.
• Gather the documents: the report pages, your dispute letters and receipts, the bureau and company responses, any denial letter mentioning inquiries, and your FTC identity theft report if you filed one.
• Send it to me. Request a free case review and attach the report pages and any responses. I'll tell you whether the pull was permissible, whether anything followed from it, and what is realistically worth pursuing.

Sources: Fair Credit Reporting Act, 15 U.S.C. §§ 1681b(a), 1681b(b)(2), 1681b(f), 1681c-1, 1681c-2, 1681e(a), 1681g(a)(3), 1681i, 1681n(a)(1)(B), 1681n, 1681o, 1681p; TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Hinkle v. Midland Credit Management, Inc., 827 F.3d 1295 (11th Cir. 2016); Milgram v. Chase Bank USA, N.A., 72 F.4th 1212 (11th Cir. 2023); Saleh v. Miami Gardens Square One, Inc., 353 So. 3d 1253 (Fla. 3d DCA 2023). Last reviewed October 8, 2026.