What credit repair companies can and can't legally do (CROA explained)

CROA defines a credit repair organization broadly: a person or company that, for payment, sells or performs (or claims it can perform) services to improve a consumer's credit record, credit history, or credit rating, or advises consumers on doing so. Certain nonprofits, creditors restructuring their own debts, and some others are excluded, but a typical paid dispute service is covered.

The FTC enforces CROA, and states often have their own credit services laws on top of it, some requiring registration or a bond. The full federal text is on the FTC's site.

Under 15 U.S.C. § 1679b, no person may:

• Make, or advise you to make, a statement that is untrue or misleading (or that should be known to be) to a credit bureau or creditor about your creditworthiness, credit standing, or credit capacity.
• Make or advise a statement intended to alter your identification to hide your credit record, such as a so-called new credit identity.
• Make or use any untrue or misleading representation of the services the company will perform.
• Engage in any act or practice that constitutes or results in fraud or deception in connection with the offer or sale of credit repair services.
• Charge or receive any money or other valuable consideration for performing services before those services are fully performed.

That last rule is why legitimate companies structure billing around services already delivered, and why a demand for a large upfront payment is a warning sign.

Before you sign anything, the company must give you a separate written statement titled "Consumer Credit File Rights Under State and Federal Law" (§ 1679c). It explains, among other things, that:

• You have the right to dispute inaccurate information in your credit report by contacting the credit bureau directly.
• Neither you nor any credit repair company has the right to have accurate, current, and verifiable information removed from your report.
• You can sue a credit repair organization that violates CROA.
• You have the right to cancel the contract for any reason within 3 business days from the date you signed it.

You can read CreditGod's version on our Disclosures page.

CROA requires a written, signed contract before any services are performed. It must include the terms and conditions of payment including the total amount, a full and detailed description of the services and any promised results, an estimate of how long the services will take, the company's name and principal business address, and a conspicuous statement of your right to cancel within 3 business days. A separate Notice of Cancellation form must be attached (§ 1679e).

If a company won't put its promises in writing, treat its verbal promises as worthless.

If credit repair is sold over the phone, the FTC's Telemarketing Sales Rule adds another layer: the seller can't request or receive payment until the promised results have been achieved and you've received a consumer report, issued more than six months after the results were achieved, showing them.

• Review your reports with you and identify items that appear inaccurate, incomplete, outdated, or unverifiable.
• Draft and send disputes to bureaus and furnishers based on the facts you confirm.
• Organize your documents and track investigation deadlines.
• Explain your options for accurate items, like goodwill requests or paying down balances.
• Help you build positive history over time.

None of that requires special access. The FCRA gives these rights to you, and disputing directly with the bureaus is free.

• Did they give you the CROA rights disclosure before the contract?
• Does the contract state the total cost, the services, a time estimate, and your 3-day cancel right?
• Do they avoid promising deletions, specific score increases, or timelines?
• Do they refuse to dispute items you tell them are accurate?
• Do they tell you that you can dispute for free yourself?
• Are they registered in your state if your state requires it?

If any answer is no, walk away. If you've been harmed, you can report it to the FTC, the CFPB, or your state attorney general.

CROA is a floor, not a ceiling. Many states have their own credit services laws that can require registration, a surety bond, extra contract terms, or longer cancellation windows. If you're comparing companies, check your state attorney general's or consumer protection office's website for local rules and complaint history.

CROA also doesn't cover everyone. The law excludes certain nonprofit organizations, creditors helping to restructure a debt they're owed, and some depository institutions (15 U.S.C. § 1679a). Being excluded from CROA doesn't make an organization better or worse; it just means different rules apply, so read any agreement carefully.

• Your copies. Keep the signed contract, the Consumer Credit File Rights disclosure, and the Notice of Cancellation form.
• A log of what's sent in your name. You should be able to see every dispute and letter. If you can't, ask.
• Billing against work. Compare each charge with the services the contract says were fully performed.
• Your own reports. Pull them yourself at AnnualCreditReport.com so you can confirm what actually changed.

We show the CROA disclosure and 3-business-day cancellation notice before checkout, delay capturing payment until the cancellation window closes, dispute only items that may be inaccurate, incomplete, or unverifiable, and decline to dispute anything you confirm is accurate. We don't promise deletions, point gains, or timelines, and we're not a law firm. Read our Disclosures and Cancellation & Refunds pages.