Who may pull it
Lenders reviewing an application or an existing account, insurers underwriting a policy, landlords screening a tenant, some employers with your written permission, collections agencies working your account, and courts or child-support agencies.
Who may not
Curious neighbors, most employers without consent, and any business with no relationship or application from you. Pulling a report without permissible purpose is an FCRA violation.
If you see a pull you did not authorize
Dispute the inquiry with the bureau, write to the company that pulled it, and consider a fraud alert or freeze if you suspect identity theft.
