Deep Dive
Step-by-step breakdown
Step 1. What the Credit Repair Organizations Act Covers
The Credit Repair Organizations Act (CROA, 15 U.S.C. SS 1679 et seq.) was enacted in 1996 as part of the Consumer Credit Protection Act. Congress passed CROA after finding that consumers were routinely victimized by credit repair companies charging high upfront fees for services that were either never performed or could be done for free by the consumer directly.
CROA applies to any person or organization that sells, provides, or performs services for the purpose of improving a consumer's credit record, credit history, or credit rating, or that provides advice or assistance in exchange for payment. Nonprofit organizations and certain financial institutions (banks, credit unions) are exempt from CROA's requirements.
The statute is enforced by the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB), with concurrent enforcement authority given to state attorneys general. Private lawsuits are also permitted under Section 1679g, giving consumers a direct remedy against violators.
- Enacted 1996 as part of the Consumer Credit Protection Act (15 U.S.C. SS 1679)
- Covers any person/org that sells credit improvement services for payment
- Exempts nonprofits, banks, credit unions, and licensed attorneys performing legal services
- Enforced by FTC, CFPB, and state attorneys general
- Private right of action under Section 1679g
Step 2. Prohibited Practices Under CROA
Section 1679b sets out specific prohibitions. Credit repair organizations cannot: charge or receive any money or valuable consideration before the promised services are fully performed; make any statement or counsel consumers to make any statement that is untrue or misleading (including advising consumers to create a new identity using an Employer Identification Number instead of a Social Security Number); or make any guarantee or claim that they can remove accurate, non-obsolete information from a credit report.
The advance fee ban is CROA's most important consumer protection. No credit repair organization may collect payment before it has fully performed the service for which the consumer contracted. This means no enrollment fees, no setup fees, and no monthly fees charged before results are delivered. Violations of this provision are widespread and are the most commonly enforced CROA violation.
Advising consumers to create new credit files using EINs, Credit Privacy Numbers (CPNs), or other tactics to evade their credit history is a federal crime under CROA. Companies that promote these tactics can face criminal prosecution in addition to civil penalties.
- No advance fees: payment only after services are fully performed (SS 1679b(b))
- No false claims about removing accurate information from reports
- No advice to create new identities (EIN fraud, CPNs) to evade credit history
- No misleading statements about what the organization can accomplish
- Criminal penalties for identity fabrication schemes promoted as credit repair
Step 3. Required Disclosures and Consumer Rights
Section 1679c requires credit repair organizations to provide a written disclosure statement before any contract is signed. This statement must inform the consumer of their right to dispute inaccurate items directly with the credit bureaus for free, their right to obtain a free credit report, and a reminder that no one can remove accurate, non-obsolete information from a credit report.
Section 1679d mandates a written contract that includes: the terms and conditions of payment; a detailed description of the services to be performed; the estimated completion date; and the company's name and principal business address. The contract must also include a conspicuous statement of the consumer's right to cancel within 3 business days.
The 3-day right to cancel (Section 1679e) allows consumers to void any credit repair contract within 3 business days of signing. No reason needs to be given. Any money paid must be refunded within 5 business days of receiving the cancellation notice.
- SS 1679c: written disclosure of consumer rights before contract signing
- SS 1679d: written contract with payment terms, service description, and completion date
- SS 1679e: 3-day right to cancel without penalty; refund within 5 business days
- Consumer must be told they can dispute directly with bureaus for free
- Consumer must be told that accurate, non-obsolete information cannot be removed
Step 4. State Credit Repair Laws That Exceed CROA
Many states have enacted their own credit services organization or credit repair statutes that go beyond the federal minimum. California's Credit Services Act (Cal. Civ. Code SS 1789.10) requires a $100,000 surety bond, a 5-day cancellation period (vs. CROA's 3 days), and registration with the Department of Justice. Illinois requires a $100,000 bond and registration with the Secretary of State.
Colorado criminalizes fraudulent credit repair operations and requires a $25,000 surety bond. Tennessee mandates a $100,000 surety bond, one of the highest in the nation. Nevada requires registration with the Secretary of State and a detailed disclosure of consumer rights. Maryland requires registration with the Commissioner of Financial Regulation.
State laws can provide additional remedies that CROA does not. Many state credit repair statutes allow for treble damages, minimum statutory damages higher than CROA, and state AG enforcement with civil penalties per violation. Consumers should cite both CROA and their state statute when filing complaints or lawsuits.
- California: $100,000 surety bond, 5-day cancellation, DOJ registration
- Illinois: $100,000 bond, Secretary of State registration
- Colorado: criminal penalties for fraud, $25,000 bond
- Tennessee: $100,000 surety bond requirement
- Many states allow treble damages and per-violation civil penalties
Step 5. Enforcement Actions and Notable CROA Cases
The FTC and CFPB have brought numerous enforcement actions against credit repair companies violating CROA. In FTC v. Lexington Law (2019), the FTC alleged that one of the largest credit repair companies in the nation charged advance fees in violation of CROA's payment prohibition. The company had enrolled millions of consumers and generated hundreds of millions in revenue.
The CFPB's 2023 consent order against CreditRepair.com resulted in $2.7 million in redress and $500,000 in civil penalties for charging upfront fees and making misleading representations about the company's ability to remove accurate negative items. The order permanently banned the company's principals from the credit repair industry.
State AGs have also pursued CROA violations. The Illinois AG obtained a $1 million settlement against a credit repair operation charging $1,000+ upfront fees. The Florida AG permanently shut down a Tampa-based operation that used fake attorney letters to dispute accurate items.
- FTC v. Lexington Law (2019): major enforcement against advance fee violations
- CFPB v. CreditRepair.com (2023): $2.7M redress, $500K penalties, industry ban
- Illinois AG: $1M settlement against upfront fee violations
- Florida AG: permanent injunction against fraudulent dispute operation
- Pattern: advance fee violations are the most commonly enforced CROA provision
Step 6. How to Verify a Credit Repair Company's Legitimacy
Before hiring any credit repair company, verify that it complies with both federal CROA and your state's credit repair statute. Check whether your state requires registration or bonding, and confirm the company's status with the relevant regulatory agency. Search the CFPB complaint database and the BBB for complaint history.
Red flags that indicate a fraudulent operation: demanding payment before any work is done; guaranteeing a specific credit score increase; advising you to dispute accurate information; suggesting you create a new credit identity using a CPN or EIN; refusing to provide a written contract; and claiming they have special relationships with credit bureaus.
Remember that everything a credit repair company can do, you can do yourself for free. FCRA Section 611 gives you the right to dispute inaccurate items directly. Section 623 allows direct disputes with furnishers. AnnualCreditReport.com provides free reports. The value of a legitimate credit repair company is convenience and expertise, not access to special tools.
- Check state registration/bonding requirements before hiring
- Search CFPB complaint database and BBB for complaint history
- Red flags: upfront fees, score guarantees, CPN advice, no written contract
- Everything credit repair companies do can be done for free under FCRA
- Legitimate value is convenience and expertise, not special access
