Capital One Conducted Credit Inquiries and Obtained Credit Reports without Permission

By The Kim Law Firm, LLC

Credit reports contain personal and sensitive information.  This fact is not only understood as a matter of common sense but also as a matter of law.  Courts throughout the country have repeatedly affirmed that obtaining a credit report without authorization under the Fair Credit Reporting Act (“FCRA”) constitutes a “concrete” harm conferring Article III standing.  In other words, the harm that occurs by obtaining a credit report (acquisition of sensitive and personal information) without authorization is a harm sufficient to allow an individual to proceed with a lawsuit in federal court.  This principle was recently confirmed in a case involving Capital One.

In Nayab v. Capital One Bank (USA), N.A., No. 17-55944 (9th Cir. Oct. 31, 2019), the plaintiff Freshta Nayab instituted a class action lawsuit under the FCRA for Capital One having allegedly obtained plaintiff’s credit report (and those of similarly situated consumers) without authorization.  The district court dismissed the plaintiff’s case because, among other things, it determined that Capital One having acquired plaintiff’s credit reports without authorization did not constitute a concrete harm allowing the plaintiff to maintain the lawsuit in federal court.  Nayab’s case was dismissed and it was appealed to the United States Court of Appeals for the Ninth Circuit.   On appeal, the Ninth Circuit (includes Alaska, Arizona, California, Hawaii and Idaho) held, among other things, that obtaining a credit report without authorization constituted a concrete harm, and on this basis the district court should not have dismissed the plaintiff’s complaint.  This holding was important in reaffirming the important privacy rights of consumers relating to credit reports in the Ninth Circuit.

An inquiry from a company you never dealt with

Nayab settled the threshold question: an unauthorized pull is itself an injury a court will hear, whether or not it moved your score. What I need from you is the inquiries section of all three reports and the name and date of any pull from a company you have no application or account with. I write to the company for the purpose it claims and the application it relies on, and to the bureau to remove the inquiry; a company that cannot name an authorized purpose is liable for actual damages, or statutory damages of $100 to $1,000 per violation plus punitive damages where the pull was willful. Someone pulled your credit and had no right to walks through the letters. An FCRA claim must be filed within two years of the day you discovered the violation, and never more than five years after it happened. I review the file at no cost and bring these cases on contingency: you pay nothing unless we win.

Sources: Nayab v. Capital One Bank (USA), N.A., 942 F.3d 480 (9th Cir. 2019) (opinion linked above); 15 U.S.C. §§ 1681b, 1681n, 1681o and 1681p.

Admitted in Pennsylvania and New Jersey; available to appear pro hac vice in other federal courts.

Permissible purpose applies to every company that pulls

A credit report may only be obtained for a purpose the statute authorizes, and the obligation sits on whoever pulls it. That is a much broader group than most people expect: card issuers reviewing existing accounts, lenders prescreening for offers, servicers evaluating a loan, and companies pulling a report for a reason unrelated to any credit transaction at all. An inquiry from a company you have no relationship with is not a clerical footnote on your file; it is a question about whether anyone had authority to look.

• Capital One — a large issuer conducting both account review and prescreen pulls.
• Chase — pulls reports across its card, auto and mortgage businesses.
• Synchrony Bank — runs inquiries tied to retail card applications.
• Credit One Bank — an issuer whose marketing generates substantial pull volume.
• Comenity Bank — issues store cards through in-store application flows.
• Discover — obtains reports for both origination and account management.

Read the inquiry section of all three reports, not just the tradelines, and note the date and the company name for anything you do not recognize. Write to the bureau asking that unauthorized inquiries be removed, and write separately to the company asking what purpose it claims and what application it relies on. If the company cannot identify an authorized purpose, the pull was improper, and a company that pulls repeatedly without one is doing something different from making a single mistake.