No fee unless we win|Helping people nationwide|The company that broke the law pays our fees
Mon–Fri 8:30–6 CT · Online review 24/7

Regulatory update · FCRA

CFPB Orders Equifax to Pay $15M Over Dispute Handling

The CFPB issued a consent order against Equifax, Inc. and Equifax Information Services LLC finding FCRA violations in dispute reinvestigations, reinsertion of deleted information, identity theft blocking, and accuracy procedures, plus unfair practices. Equifax must pay a $15 million civil money penalty and come into compliance.

January 17, 2025 · Analysis by Shawn Jaffer

Source
Consumer Financial Protection Bureau
Decided
January 17, 2025
Bottom line
Federal regulators found that a major bureau relied too heavily on furnishers when investigating disputes, a pattern consumers raise in individual FCRA cases.

Background

When a consumer disputes an item on a credit report, § 1681i of the FCRA requires the credit bureau to conduct a reasonable reinvestigation, to consider all relevant information the consumer submits, to notify the furnisher, and to report the results. If disputed information is deleted, the bureau may not reinsert it without certifications from the furnisher and notice to the consumer. Section 1681c-2 requires bureaus to block information that results from identity theft when the consumer provides the required documentation, and § 1681e(b) requires reasonable procedures to assure maximum possible accuracy.

On January 17, 2025, days before the change in administration, the CFPB issued an administrative consent order against Equifax, Inc. and Equifax Information Services LLC.

What changed

According to the CFPB’s summary of the order, the Bureau found that Equifax violated the FCRA by:

  • failing to conduct proper reinvestigations of disputed information;
  • failing to prevent previously deleted information from being reinserted;
  • providing inadequate written notice of reinvestigation results;
  • failing to follow reasonable procedures to assure maximum possible accuracy; and
  • failing to block information consumers identified as resulting from identity theft, and failing to give proper notice when blocks were declined or rescinded.

The CFPB also found unfair practices under the Consumer Financial Protection Act, including using ineffective systems, flawed processes, and excessive deference to furnishers when resolving disputes, and selling inaccurate credit scores and attributes after “test code” was introduced into a production scoring environment.

The order requires Equifax to come into compliance with the law and to pay a $15 million civil money penalty. As of our review, the CFPB’s enforcement page does not reflect any termination or modification of the order.

Our take

We see the order as significant less for the dollar amount, which is modest relative to Equifax’s size, than for what it says about how disputes are handled at scale. The finding of “excessive deference to furnishers” describes a problem consumers encounter constantly: a bureau forwards a dispute through the automated system, the furnisher confirms its own data, and the bureau treats that as the end of the inquiry, even when the consumer submitted documents showing otherwise. Courts in individual FCRA cases have long held that a bureau may not simply parrot a furnisher in every circumstance, and the order reflects the regulator’s view that this was a systemic issue.

The order’s practical future is uncertain. In its May 2025 guidance withdrawal, the CFPB said it was reducing its enforcement activities to areas statutorily required. Even if the order is not actively enforced, its findings describe practices that consumers can investigate and raise in private litigation, where the remedy is actual, statutory, and punitive damages rather than a civil penalty.

What it means if your report is wrong

When you dispute with Equifax or any bureau, send copies of supporting documents, not just a description of the problem, and keep proof of what you sent. If the bureau’s response says the item was “verified” but ignores your documents, or if a deleted item later reappears without notice, write down the dates and save the letters. If an error results from identity theft, submit an identity theft report and request a block under § 1681c-2. Those records are the foundation of an FCRA claim.

A free case review can assess how this action affects a claim, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.

No fee unless we win

The company that broke the law pays our fees.

CallTextFree Review