Credit Bureaus Have Paid Billions in FCRA Damages — Here's the Evidence

Following Equifax's 2017 data breach affecting 147 million Americans, Equifax agreed to pay $575 million to the FTC (later raised to $700M by the settlement class) including up to $425 million in consumer restitution, free credit monitoring, and a $300 million consumer fund. This remains the largest consumer data breach settlement in history.

The Consumer Financial Protection Bureau fined Equifax $3.7 million and ordered it to pay $2 million into a consumer redress fund — plus a comprehensive overhaul of its dispute investigation process. The CFPB found that Equifax was using automated processes to reject millions of legitimate consumer disputes without meaningful investigation.

An Oregon federal jury awarded Julie Miller $18.6 million — including $18.4 million in punitive damages — after Equifax repeatedly confused her credit file with another person's and failed to fix the problem over 17 months of disputes. Her score was damaged by debts that were never hers. The verdict stood on appeal.

Judy Thomas of Georgia won $1.62 million after Equifax persistently mixed her credit file with a convicted felon who had the same name and a similar Social Security number. Despite repeated written disputes, Equifax continued reporting the felon's criminal record on Thomas's file, causing her to be denied employment and credit.

Sergio Ramirez went to buy a car and was denied because TransUnion's "OFAC Advisor" product had labeled him a potential terrorist based on a name match with the OFAC watchlist — without checking his date of birth. A federal jury awarded $60 million (later reduced to $40M by the Ninth Circuit). TransUnion v. Ramirez went to the Supreme Court in 2021, which ruled on standing but not the underlying FCRA violations.

The Federal Trade Commission sued TransUnion and its subsidiaries for repeatedly violating the FCRA by failing to follow proper dispute procedures, reinserting disputed information without notice, and failing to maintain reasonable accuracy procedures. TransUnion paid $17.6 million to settle, one of the larger FTC FCRA enforcement actions against a major bureau.

The CFPB filed suit against Experian in 2023 alleging that it conducted "sham" investigations of consumer disputes — using automated matching to confirm inaccurate tradeline data furnished by creditors rather than actually investigating the consumer's dispute. The CFPB called Experian's system a "rubber stamp" for furnishers. The case remains active.

The FTC has brought multiple enforcement actions against Experian over the years, including actions related to its dispute processing, the accuracy of information sold to third parties, and its obligations under the FCRA's free annual report requirements. Total FTC settlements against Experian exceed $3 million across these actions.

A class action against HireRight (operating as First Student) settled for $14.5 million after class members alleged that HireRight failed to provide proper pre-adverse action notices before employers denied jobs based on background check results. Class members received payments based on the severity of their individual claims.

Experian settled a class action involving consumers whose credit files were mixed with those of others — often people with similar names or Social Security numbers. The settlement included a $15 million common fund for class members plus agreements by Experian to improve its identity-matching procedures to prevent future mixed files.

As part of the broader Equifax breach settlement, the class action component allocated $75 million for class members who could document out-of-pocket losses from the 2017 breach, plus $125 million in additional consumer restitution if the initial fund was insufficient. Consumers could also claim extended credit monitoring and identity theft insurance.

The Supreme Court's 2016 ruling in Spokeo v. Robins did not eliminate FCRA claims but clarified that technical violations without concrete harm may not satisfy Article III standing in federal court. The case was remanded and eventually settled. FCRA claims with concrete harm — like denied credit or employment — are unaffected by Spokeo.