CFPB Orders Equifax $15M Penalty for FCRA Violations

CFPB Enforcement Actions

Filed January 17th, 2025

Detected February 7th, 2026

Summary

The Consumer Financial Protection Bureau (CFPB) has ordered Equifax, Inc. and Equifax Information Services LLC to pay a $15 million civil money penalty for violations of the Fair Credit Reporting Act (FCRA). The order addresses failures in reinvestigating consumer disputes, preventing improper reinsertion of deleted information, and ensuring data accuracy.

View original document View source feed page

What changed

The Consumer Financial Protection Bureau (CFPB) has issued a final order against Equifax, Inc. and Equifax Information Services LLC, imposing a $15 million civil money penalty. The order stems from violations of the Fair Credit Reporting Act (FCRA), including failures in reinvestigating consumer disputes, preventing the reinsertion of previously deleted information, providing adequate notice of reinvestigation results, and maintaining reasonable procedures for data accuracy. The CFPB also found Equifax engaged in unfair practices by using ineffective dispute resolution systems and selling inaccurate credit scores. The docket number for this administrative proceeding is 2025-CFPB-0002.

This enforcement action requires Equifax to comply with FCRA and pay the significant penalty. Regulated entities, particularly consumer reporting agencies and furnishers of information, should review their dispute resolution processes and data accuracy procedures to ensure compliance with FCRA and avoid similar violations. Failure to comply with such orders can result in further penalties and reputational damage.

Source document (simplified)

Equifax, Inc. and Equifax Information Services LLC

On January 17, 2025, the Bureau issued an order against Equifax, Inc. and Equifax Information Services LLC (collectively, Equifax), one of the largest consumer reporting agencies in the country. Equifax collects and organizes data on most adult Americans to generate consumer reports, which it sells to creditors and other businesses that evaluate whether to offer consumers loans, jobs, housing, and certain other products. To promote the accuracy and fairness of information in consumer reports, the federal Fair Credit Reporting Act (FCRA) gives consumers the right to dispute incomplete or inaccurate information in their credit file and requires consumer reporting agencies, like Equifax, to forward notice of the dispute to the company that originally provided the information (called the “furnisher”). FCRA also requires consumer reporting agencies to reinvestigate such disputes and remove or correct any inaccurate, incomplete, or unverifiable information. The Bureau found that Equifax violated FCRA, including by failing to properly conduct reinvestigations of disputed information in consumer files; failing to prevent the improper reinsertion of previously deleted information from consumer files; failing to provide adequate written notice to consumers of the results of its reinvestigations; failing to follow reasonable procedures to assure maximum possible accuracy of information Equifax reports on consumers; and failing to block reporting of information consumers identified as resulting from identity theft and to provide appropriate notice when such blocks were declined or rescinded. The Bureau also found that Equifax engaged in unfair acts or practices in violation of the Consumer Financial Protection Act of 2010 by: (1) using ineffective systems, flawed processes, and excessive deference to furnishers to resolve consumer disputes and failing to adequately inform consumers of the results of reinvestigations; and (2) selling inaccurate consumer credit scores and credit attributes after it introduced “test code” into a production environment in a scoring model server. The order requires Equifax to come into compliance with the law and pay a $15 million civil money penalty.