AnnualCreditReport.com
AnnualCreditReport.com is the only federally authorized website for consumers to obtain free credit reports from the three major bureaus (Equifax, Experian, TransUnion). Created by the Fair and Accurate Credit Transactions Act (FACTA) of 2003, it is operated by Central Source LLC, a joint venture of the Big Three bureaus. Originally offering one free report per bureau per year, it expanded to free weekly reports during the COVID-19 pandemic and made that access permanent in October 2023. The site provides credit reports only — no credit scores — and has no ads, subscriptions, or monetization.
Score generated by AI agents based on publicly cited evidence and reviewed by the project maintainer. Not independently validated.
Score History
Timeline events are AI-curated from public reporting. Score trajectory is derived from documented events.
AnnualCreditReport.com launched as a congressional mandate, creating the first centralized free credit report access. The site itself was clean and ad-free, but the bureaus immediately undermined it by blocking third-party web links, omitting search engine meta tags, and allowing domain squatters to proliferate. Experian's FreeCreditReport.com was already running, deliberately confusing consumers about the official free source. The structural conflict of interest — bureaus operating a free competitor to their own paid products — was baked in from day one.
Experian's ConsumerInfo.com was fined by the FTC in 2005 ($950,000) and again in 2007 ($300,000) for deceptive FreeCreditReport.com marketing that violated consent decrees. Domain squatting exploded to 233 imposter sites routing consumers to paid services. The Florida AG opened an investigation into Experian's practices. While the ACR.com site itself remained simple and ad-free, the ecosystem of deception surrounding it — bureau-funded lookalike sites, domain squatting, and aggressive paid-product marketing — reached its peak.
The FTC and Congress pushed back against the deceptive ecosystem. The FTC amended its Free Credit Report Rule (April 2010) requiring all 'free credit report' ads to disclose AnnualCreditReport.com as the only authorized source. The Credit CARD Act of 2009 mandated similar disclosures on TV and radio. The FTC produced parody ads mocking FreeCreditReport.com. These regulatory actions reduced the most blatant consumer confusion, though Equifax continued placing ads before free report delivery until 2014 and the bureaus' underlying conflict of interest remained.
The 2017 Equifax breach exposed 147 million consumers' data and triggered the most intense regulatory scrutiny in credit bureau history. The CFPB had already fined TransUnion and Equifax $23 million in January 2017 for deceptive credit score marketing. CEO Richard Smith resigned; executives faced insider trading charges. The breach led to the 2018 free credit freeze law and a record $575 million settlement. Meanwhile, a 31-state AG settlement in 2015 and the FTC's credit report accuracy study highlighted systemic accuracy problems with the reports themselves.
Free weekly reports became permanent in October 2023, a genuine improvement over the original annual mandate. However, the bureaus' dark pattern ecosystem intensified — the CFPB sued TransUnion in 2022 for violating its 2017 consent order with deceptive enrollment during ACR.com report retrieval. A 47-day Experian security flaw exposed credit files through the site. In January 2025, the CFPB sued Experian and fined Equifax $15 million for systemic dispute-handling failures undermining report accuracy.
Alternatives
Free ongoing credit monitoring with VantageScore 3.0 from TransUnion and Equifax — updated regularly, not just on-demand pulls. Ad-supported with financial product recommendations throughout. Better for continuous monitoring than periodic report checks, but uses VantageScore (not FICO) and doesn't include Experian data.
myFICO.com provides the actual FICO scores that 90% of lenders use — the main thing ACR.com doesn't include for free. Paid service ($19.95-$39.95/month) but gives you the scores that actually matter for lending decisions, plus credit reports. Worth it if you're actively applying for credit and need accurate score data.
Dimensional Breakdown
Summaries below were written by AI agents based on the cited evidence. They are editorial interpretations, not independent research findings.
Dimension History
Timeline (46 events)
Big Three bureaus settle FTC charges over blocked consumer calls
Equifax, Experian, and TransUnion agreed to pay a combined $2.5 million to settle FTC charges they violated the Fair Credit Reporting Act by blocking millions of calls from consumers trying to discuss errors in their credit reports and keeping others on hold for unreasonably long periods. Equifax paid $500,000; Experian and TransUnion each paid $1 million. The settlement required maximum blocked-call rates of 10% and average hold times under 3 minutes 30 seconds.
Equifax pays $250,000 for violating FTC consent decree on call access
Equifax paid $250,000 to settle FTC charges that its blocked-call rate and hold times violated the 2000 consent decree during certain periods in 2001. The company had failed to meet specific performance standards for consumer telephone access to dispute credit report errors, demonstrating a pattern of minimal compliance with consumer access requirements.
FACTA signed into law mandating free annual credit reports
President George W. Bush signed the Fair and Accurate Credit Transactions Act, amending the Fair Credit Reporting Act to require each of the three nationwide credit reporting agencies to provide one free credit report per year to every consumer upon request. The law mandated creation of a centralized access point and directed the FTC to implement rules for a phased rollout.
FTC issues final rule for free annual credit report implementation
The FTC published its final rule implementing FACTA's free credit report provision after receiving over 2,300 public comments. The rule established a phased geographic rollout from west to east beginning December 1, 2004, with nationwide access by September 1, 2005. Central Source LLC was created as a joint venture of the three bureaus to operate AnnualCreditReport.com.
AnnualCreditReport.com launches for Western states
AnnualCreditReport.com launched for consumers in 13 Western states (Alaska, Arizona, California, Colorado, Hawaii, Idaho, Montana, Nevada, New Mexico, Oregon, Utah, Washington, and Wyoming), beginning the phased national rollout of free credit report access. The site offered online, phone, and mail channels for requesting reports from all three bureaus through a single portal.
EPIC files FTC complaint over bureaus blocking web links to ACR.com
The Electronic Privacy Information Center filed a complaint with the FTC noting that the three credit bureaus were blocking web links from consumer advocacy sites and news organizations to AnnualCreditReport.com. Only the FTC and the three bureaus themselves could link to the site. The bureaus also omitted key HTML meta tags that would help search engines find the site, making paid bureau sites more discoverable.
World Privacy Forum documents 96 imposter domains targeting ACR.com
The World Privacy Forum published its 'Call Don't Click' report finding 96 known imposter domains mimicking AnnualCreditReport.com, with 50 actively routing consumers to unintended destinations including fee-based credit services, link farms, and pornographic sites. The report recommended consumers use the phone rather than the internet to request reports, citing the hostile domain environment.
Imposter domains targeting ACR.com more than double to 233
A World Privacy Forum follow-up report found imposter domains had more than doubled from 96 to 233, with 112 actively routing consumers away from the official free credit report site. Many directed consumers to credit bureaus' own paid services through pay-per-click and affiliate marketing programs, creating a hostile environment around the federally mandated free access point.
FTC sues Experian subsidiary over deceptive FreeCreditReport.com
The FTC sued ConsumerInfo.com, a wholly-owned Experian subsidiary, for deceptively marketing 'free credit reports' through FreeCreditReport.com. The site auto-enrolled consumers in a $79.95/year credit monitoring service without adequate disclosure. ConsumerInfo settled for $950,000 and agreed to cease deceptive marketing of 'free' offers. The site directly competed with and confused consumers about the official AnnualCreditReport.com.
AnnualCreditReport.com access completes nationwide rollout
Free credit report access became available to all U.S. consumers as Eastern states, Puerto Rico, and U.S. territories joined the program. The nine-month phased rollout from west to east was complete. Over the site's first two years (December 2004 through December 2006), 52 million credit reports were issued through the portal.
Florida AG investigates FreeCreditReport.com for deceptive advertising
The Florida state attorney general's office opened an investigation into potentially misleading advertising by FreeCreditReport.com to determine whether Experian violated Florida's Deceptive and Unfair Trade Practices Act. The investigation covered multiple Experian entities including ConsumerInfo.com, Experian Consumer Direct, Qspace, Inc., and Iplace, Inc., highlighting the multi-entity structure used to obscure the deceptive practices.
ConsumerInfo.com fined $300,000 for violating 2005 FTC consent decree
Experian's ConsumerInfo.com subsidiary paid $300,000 to settle charges it violated the 2005 FTC consent decree by continuing to run ads for 'free credit reports' that inadequately disclosed the automatic $79.95 enrollment in credit monitoring. The settlement also barred ConsumerInfo from misrepresenting any affiliation with the annual credit report available under the Fair Credit Reporting Act.
Equifax sells lists of delinquent mortgage holders to predatory marketers
Between January 2008 and early 2010, Equifax sold prescreened lists containing sensitive consumer information — including credit scores and whether consumers were 30, 60, or 90 days late on mortgage payments — to Direct Lending Source and affiliates, who resold the data to companies marketing loan modification and debt relief services. The FTC later found Equifax's inadequate procedures enabled the improper sales.
Credit CARD Act mandates disclosure of official free report site in all ads
The Credit Card Accountability Responsibility and Disclosure Act of 2009 required that any advertisement for 'free credit reports' in any medium include a prominent disclosure that free reports are available under federal law at AnnualCreditReport.com. Television and radio ads were required to state: 'This is not the free credit report provided for by Federal law.' This directly targeted FreeCreditReport.com's deceptive advertising.
FTC releases parody ads mocking FreeCreditReport.com deception
The FTC produced two video parodies of FreeCreditReport.com's popular television commercials, featuring a singer crooning 'Beware of others, there's always a catch' and 'They claim to be free but strings are attached.' The $100,000 production aimed to counter Experian's massive advertising budget for FreeCreditReport.com, which had become a cultural phenomenon while diverting consumers from the official free report site.
Class action filed against FreeCreditReport.com for bait-and-switch
Wisconsin college student Erica Possin filed a class-action complaint against Experian, alleging FreeCreditReport.com operated a 'bait and switch' scheme. Possin entered her credit card information to receive a 'free' report but was unknowingly enrolled in a $14.95/month monitoring service. The lawsuit claimed the terms contained one-sided conditions including a waiver of class action rights and agreement to let Experian sell personal data to third parties.
FTC amended Free Credit Reports Rule takes effect
The FTC's revised Free Credit Reports Rule became effective, requiring any company advertising 'free credit reports' to prominently disclose: 'THIS NOTICE IS REQUIRED BY LAW. You have the right to a free credit report at AnnualCreditReport.com or 877-322-8228, the ONLY authorized source under federal law.' Internet sites had to include a clickable button to the authorized source. The rule directly addressed years of consumer confusion from competing 'free' credit report offers.
Equifax settles charges over selling delinquent mortgage data
Equifax paid $393,000 to settle FTC charges that its inadequate procedures led to improper sales of prescreened consumer lists containing credit scores and mortgage delinquency data to firms that marketed predatory loan modification and debt relief services. Direct Lending Source, which purchased and resold the data, paid an additional $1.2 million. The total settlement was nearly $1.6 million.
FTC study finds one in five consumers have credit report errors
An FTC-mandated study found that 26% of consumers identified at least one potential material error on their credit reports, and 5% had errors that could result in less favorable loan terms. The study of 1,001 consumers and 2,968 reports demonstrated that the accuracy of reports available through AnnualCreditReport.com was a significant consumer protection issue, with widespread errors affecting lending decisions.
Equifax stops placing ads on free credit report pages
Until January 2014, Equifax placed advertisements on web pages that consumers had to view before accessing their free annual credit reports, violating the Fair Credit Reporting Act's prohibition on advertising before report delivery. The CFPB later cited this practice in its 2017 enforcement action, requiring Equifax to pay $3.8 million in restitution and $2.5 million in civil penalties.
31 state AGs reach settlement requiring bureau reforms
Attorneys general from 31 states reached a $6 million settlement with Equifax, Experian, and TransUnion requiring improved data accuracy practices and consumer protections. Key provisions included maintaining information about problematic data furnishers, implementing escalated dispute handling for identity theft and fraud cases, and providing consumers an additional free credit report within 12 months when disputes result in changes.
Experian data breach exposes 15 million T-Mobile applicants
Hackers breached Experian's systems and accessed records of approximately 15 million T-Mobile customers and applicants who required credit checks between September 2013 and September 2015. Exposed data included names, addresses, Social Security numbers, and driver's license numbers. The breach demonstrated the security risks of the concentrated credit bureau model, though the breach occurred on Experian's systems rather than AnnualCreditReport.com itself.
CFPB orders TransUnion and Equifax to pay $23 million for deceptive marketing
The CFPB ordered TransUnion to pay $13.9 million in restitution and $3 million in civil penalties, and Equifax to pay $3.8 million in restitution and $2.5 million in civil penalties, for falsely claiming the credit scores sold to consumers were the same scores lenders use, and for deceptively marketing 'free' trial subscriptions that auto-charged consumers. Equifax was additionally cited for placing ads before free credit report delivery.
TransUnion hit with record $60 million FCRA verdict for false terrorism flags
A California federal jury ordered TransUnion to pay $60 million — the largest FCRA verdict in history — for wrongly flagging over 8,000 consumers as potential terrorists by matching names against the Treasury Department's OFAC list. Each class member received $984 in statutory damages and $6,353 in punitive damages. The Supreme Court later narrowed standing in 2021, and the case settled for $9 million.
Equifax announces breach affecting 147 million consumers
Equifax disclosed that attackers had exploited an unpatched Apache Struts vulnerability to access personal data of 147.9 million Americans over 78 days between May and July 2017, including Social Security numbers, dates of birth, and payment card data. The breach went undetected partly because an expired SSL certificate disabled network monitoring. It was one of the largest data breaches in history and fundamentally undermined consumer trust in the credit reporting system.
Equifax CEO Richard Smith resigns amid breach backlash
Equifax CEO Richard Smith resigned effective immediately, three weeks after the breach disclosure. Smith was subsequently required to testify before three congressional committees, where lawmakers criticized Equifax's information security practices, breach response, and the suspicious timing of stock sales by three top executives who sold shares before the breach was made public.
Former Equifax executive charged with insider trading from breach knowledge
The SEC and DOJ charged Jun Ying, Equifax's former U.S. CIO, with securities fraud for exercising stock options worth over $950,000 after learning about the data breach but before public disclosure. Ying had texted a co-worker 'Sounds bad. We may be the one breached,' then searched Experian's 2015 breach stock impact before selling. He was later sentenced to four months in prison.
Free credit freezes become federal law
Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act took effect, requiring all three bureaus to provide free credit freezes and year-long fraud alerts. Before this law, credit freezes cost consumers $5-$15 per bureau per action. The bureaus were required to place freezes within one business day and lift them within one hour of a phone or online request. The law was largely a response to the 2017 Equifax breach.
Equifax agrees to $575 million settlement over 2017 breach
Equifax agreed to pay up to $700 million (minimum $575 million) to settle with the FTC, CFPB, and 50 states over the 2017 data breach. The settlement included $300 million for a consumer compensation fund, $175 million to states, and $100 million in CFPB civil penalties. The FTC found Equifax failed to patch known vulnerabilities, segment database servers, or maintain robust intrusion detection for legacy databases.
House passes Comprehensive CREDIT Act for credit reporting reform
The House of Representatives passed H.R. 3621, the Comprehensive CREDIT Act, by a 221-189 vote. The bill would have reduced the reporting period for negative information from 7 to 4 years, imposed strict limits on medical debt reporting, required bureaus to provide credit score calculation details, and expanded consumer protections. The bill died in the Senate, but signaled growing Congressional appetite for structural credit reporting reform.
Bureaus announce free weekly credit reports during COVID-19
Equifax, Experian, and TransUnion announced free weekly credit report access through AnnualCreditReport.com during the COVID-19 pandemic, a major expansion from the original annual limit. The move was prompted by widespread financial disruption as millions of Americans lost jobs and faced payment challenges. The weekly access program was initially set to end in April 2021 but was extended twice before becoming permanent.
Bureaus announce removal of paid medical collection debt from reports
Equifax, Experian, and TransUnion announced that effective July 1, 2022, paid medical collection debt would no longer appear on consumer credit reports, and the waiting period before unpaid medical debt could be reported would increase from 6 months to 1 year. In a second phase effective in 2023, medical collection debt under $500 would also be removed, eliminating nearly 70% of medical debt tradelines from credit files.
CFPB sues TransUnion for dark patterns violating 2017 consent order
The CFPB filed suit against TransUnion, two subsidiaries, and executive John Danaher for violating the 2017 consent order by continuing to use deceptive dark patterns to trick consumers into paid subscriptions. During ACR.com report retrieval, TransUnion asked for credit card information disguised as identity verification, with enrollment terms in low-contrast fine print within a slow-loading image. Consumers who clicked 'not sure' about their credit score were enrolled in paid monitoring.
Supreme Court narrows standing in TransUnion terrorism flag case
In TransUnion LLC v. Ramirez, the Supreme Court ruled 5-4 that only 1,853 of the original 8,185 class members whose reports were actually shared with third parties had Article III standing to sue. The decision significantly narrowed the scope of FCRA class actions, making it harder for consumers with inaccurate reports to seek collective relief if their erroneous data was not disseminated to third parties.
CFPB reports bureaus provided relief in less than 2% of complaints
A CFPB analysis found that Equifax, Experian, and TransUnion together reported relief in less than 2% of consumer complaints in 2021, down from nearly 25% in 2019. Consumers had submitted over 700,000 complaints about the Big Three from January 2020 through September 2021, representing over 50% of all CFPB complaints. The bureaus frequently stated they would take no action, claiming complaints were submitted by third parties.
Experian IDOR vulnerability exposes credit files via ACR.com for 47 days
An insecure direct object reference vulnerability in Experian's website allowed identity thieves to bypass security questions and access any consumer's full credit report after requesting it through AnnualCreditReport.com. By simply changing the URL path from '/acr/oow/' to '/acr/report,' the site displayed complete credit files. The exploit was shared on Telegram channels used for identity theft. Experian confirmed the flaw persisted from November 9 to December 26, 2022.
FTC charges Experian with spamming consumers who created accounts
The FTC required Experian Consumer Services (ConsumerInfo.com) to pay $650,000 for spamming consumers with marketing emails they could not opt out of. Consumers who created 'Free Membership' accounts to manage their Experian credit report information received unsolicited pitches for credit cards, credit scores, and paid memberships. Experian disguised marketing emails as account-related communications to circumvent CAN-SPAM opt-out requirements.
Free weekly credit reports become permanent
Equifax, Experian, and TransUnion made free weekly credit report access through AnnualCreditReport.com permanent, formalizing what had been a temporary COVID-era expansion first offered in April 2020. The change meant consumers could check their credit reports from all three bureaus once per week instead of once per year, a significant improvement to the original FACTA mandate. The announcement came alongside the removal of medical collection debt under $500 from reports.
TransUnion pays $23 million over inaccurate tenant screening reports
The FTC and CFPB required TransUnion to pay $15 million for failing to ensure accuracy in tenant background screening reports through its subsidiary TURSS, plus $8 million separately for backlogging tens of thousands of security freeze and lock requests while telling consumers they were completed. TURSS had reported multiple entries for the same eviction case and included sealed eviction records, potentially denying consumers housing.
Krebs reports Experian account takeover vulnerability persists
Sixteen months after KrebsOnSecurity first documented Experian account hijacking in summer 2022, the vulnerability remained. Identity thieves could take over Experian accounts by simply re-registering with the victim's personal information and a different email address. Krebs' own account was hijacked, and the only recovery method was recreating the account — demonstrating that the bureau with the largest U.S. consumer presence had failed to implement basic account security.
CFPB reports credit bureau complaints rose 73% in 2023
The CFPB reported that credit reporting complaints surged 73% from 2022 to 2023, with 961,570 complaints filed against the Big Three in 2023 alone. The Big Three accounted for 92% of all consumer reporting complaints. By mid-2024, the monthly average exceeded 145,000 complaints — nearly 18 times the 2017 rate. The most common issues were incorrect information (30.8%), improper use of reports (27.6%), and problems with dispute investigations (21.9%).
CFPB sues Experian for sham investigations of credit report errors
The CFPB filed suit against Experian for conducting 'sham investigations' of consumer disputes. The complaint alleged Experian used faulty intake procedures, routinely accepted furnisher responses uncritically even when illogical, sent confusing or internally inconsistent investigation results, and illegally reinserted inaccurate information that consumers had previously gotten removed. The court denied Experian's motion to dismiss in October 2025.
CFPB fines Equifax $15 million for improper dispute handling
The CFPB ordered Equifax to pay a $15 million civil penalty for systematically failing to properly investigate consumer credit report disputes. The CFPB found Equifax's online dispute portal limited consumers' ability to describe their disputes, the company ignored consumer-submitted evidence, allowed previously deleted inaccuracies to be reinserted, sent confusing investigation result letters, and used flawed software that generated inaccurate credit scores.
CFPB dismisses dark patterns case against TransUnion under Trump administration
The CFPB voluntarily dismissed its 2022 enforcement action against TransUnion for dark patterns with prejudice, meaning the case can never be refiled. The dismissal was part of a broader enforcement retreat under Trump-appointed CFPB leadership, which dropped more than half of all pending litigation. Consumer advocates criticized the move as giving TransUnion a pass for repeated violations of consent orders and deceptive enrollment practices.
Central Source LLC files 16th cybersquatting lawsuit over imposter domains
Central Source LLC filed its 16th cybersquatting lawsuit targeting 12 domain names impersonating AnnualCreditReport.com, including variations using 'freeannualcreditreport' and 'myannualcreditreport' in cheap top-level domains like .site, .club, and .xyz. The company now controls over 600 similar domains recovered through litigation. One previous lawsuit alone covered 227 typosquatting domains, demonstrating the ongoing scale of consumer confusion around the official site.
ProPublica reports bureaus leaving more errors on reports under gutted CFPB
A ProPublica/CNN investigation found that TransUnion and Experian began dismissing a larger share of consumer complaints without providing relief after the Trump administration dismantled the CFPB. Experian's consumer-favorable resolution rate dropped from nearly 20% in 2024 to less than 1%. Since January 2025, over 2.7 million credit reporting complaints went without relief. A former Experian attorney was identified among the CFPB's new lawyers leading the enforcement pullback.
Evidence (40 citations)
D1: User Value Erosion
D2: Business Customer Exploitation
D3: Shareholder Extraction
D4: Lock-in & Switching Costs
D5: Twiddling & Algorithmic Opacity
D6: Dark Patterns
D7: Advertising & Monetization Pressure
D8: Competitive Conduct
D9: Labor & Governance
D10: Regulatory & Legal Posture
Scoring Log (4 entries)
Stripped for Phase 2 re-enrichment