CROA Explained: Credit Repair Rights

The Credit Repair Organizations Act is short, it has been in force since 1997, and most people who pay a credit repair company have never read it. That is a problem, because the Act is written as a list of things the company must do for you before it can take your money. This page goes section by section, in plain English, so you can hold a contract up against the law.

Key points

• § 1679b(b): no payment before the promised service is fully performed. A setup fee at signup is the most common violation.
• § 1679c: a separate written statement, "Consumer Credit File Rights Under State and Federal Law," must be given before any contract is signed.
• § 1679d: the contract must be written, dated, and signed. It must state the total cost, describe the services in detail, give an estimated completion date, and list the company's name and address.
• § 1679e: you may cancel for any reason by midnight of the third business day after signing, using a form the company must supply.
• § 1679f and § 1679g: waivers and noncompliant contracts are void. You can recover the greater of actual damages or everything you paid, plus punitive damages and attorney's fees. § 1679i: five years to sue.

Who does CROA cover?

The definition in § 1679a(3) is broad on purpose. A company does not escape it by calling itself a "consultant," a "credit education service," or a "dispute software provider." If it takes money to improve your credit, or to advise you on doing it, the Act applies. Courts have applied it to a wide range of business models. The three exclusions are the only ones in the statute.

What may a credit repair company never do? (§ 1679b)

Section	The rule	What it looks like in practice
§ 1679b(a)(1)	No untrue or misleading statements to a bureau or creditor, and no coaching you to make them	Disputing accurate items as "not mine," or filing false identity theft claims
§ 1679b(a)(2)	No altering your identification to conceal accurate, current negative history	Selling or recommending a CPN or new credit file
§ 1679b(a)(3)	No untrue or misleading representation of the company's services	"Guaranteed deletions," "we remove anything," promised score gains
§ 1679b(a)(4)	No fraud or deception in offering or selling the service	Posing as a debt collector or creditor to sell repair services
§ 1679b(b)	No money before the agreed service is fully performed	Setup fees, "first work" fees, and prepaid packages charged at signup

What must the company give you before you sign? (§ 1679c)

The statement's core points, paraphrased from the statute:

• You have a right to dispute inaccurate information directly with a bureau.
• Neither you nor any credit repair company has the right to have accurate, current, and verifiable information removed.
• A bureau must remove accurate negative information only when it is over seven years old. Bankruptcy information can be reported for ten.
• You have a right to a copy of your report.
• You have a right to sue a company that violates the Act.
• You have the right to cancel for any reason within three business days.

The disclosure must be a document separate from the contract and from any other material, under § 1679c(b). A paragraph inside the terms of service does not satisfy it.

What must the contract contain? (§ 1679d)

Use this as a checklist against a real contract:

A contract missing any of these is not merely defective. Under § 1679f(c), a contract that does not comply with the Act is void and cannot be enforced by any court or any person. The company cannot collect on it.

How does the three-day cancellation work? (§ 1679e)

Practical notes:

• Business days exclude weekends and federal holidays. Sign on a Friday and the window generally runs through the following Wednesday.
• Mail or deliver a signed, dated copy of the notice to the address on the form. Keep proof of the date sent.
• Cancellation is "without penalty or obligation." A cancellation fee is a violation. So is a bill for work done during the window, because no work is supposed to happen then.
• The right cannot be waived. Any waiver a company asks you to sign is void under § 1679f(a), and asking for one is a separate violation under § 1679f(b).

What happens when a company breaks the rules? (§ 1679f, § 1679g, § 1679i)

Remedy	Section	What it means
Void contract	§ 1679f(c)	A noncompliant contract cannot be enforced against you by anyone
Void waiver	§ 1679f(a)–(b)	Any waiver of your rights is void; seeking one is a violation
Actual damages	§ 1679g(a)(1)	The greater of your actual loss or every dollar you paid the company
Punitive damages	§ 1679g(a)(2)	An additional amount the court allows, weighing frequency, nature, and intent
Attorney's fees	§ 1679g(a)(3)	Costs and reasonable fees in any successful action
Time to sue	§ 1679i	Five years from the violation, or from discovery of a required-disclosure misrepresentation

Because the floor is "any amount paid," even a small case has a defined value. That is why consumer attorneys take CROA cases, and why class actions are common. The Act also preserves state law that is more protective, and many states add registration and bonding requirements; see the credit repair section in our state guides.

How does the FTC enforce CROA?

The most recent large action illustrates the pattern. On August 10, 2026, the FTC announced that a federal court in Arizona had temporarily halted a network of related credit repair companies. The FTC's complaint alleges that the operation ran since at least 2016. It allegedly used search ads to intercept people looking up their debt collectors. Telemarketers allegedly posed as collectors or creditors. The complaint describes a one-dollar "verification" charge and larger fees before any service, recurring charges without clear consent, disputes of legitimate debts, and in some cases false identity theft reports filed without consumers' knowledge. The FTC alleges violations of the FTC Act, CROA, the Telemarketing Sales Rule, and other statutes. It estimates consumer losses at nearly $200 million.

Those are allegations in a pending case, which the court will decide; the defendants are named in the linked press release and not repeated here. For readers, the complaint is the checklist in action. Advance fees, misrepresentation of services, and coached false statements are the three CROA violations the FTC pleads most often.

Common mistakes to avoid

• ✕Paying any fee at signup, including a “verification” or “report pull” charge — § 1679b(b) allows no payment before performance.
• ✕Signing a contract without the separate Consumer Credit File Rights statement; its absence makes the contract void.
• ✕Accepting a contract with no total price or no estimated completion date; both are required by § 1679d.
• ✕Letting the company start work inside the three-business-day window, which the statute prohibits.
• ✕Signing anything that waives your CROA rights — the waiver is void and asking for it is a violation.
• ✕Assuming a small loss is not worth pursuing; § 1679g sets the floor at every dollar you paid plus attorney's fees.

When to talk to a professional

Frequently asked questions

Can a credit repair company charge a setup fee?

Not before the service the fee pays for is fully performed. Section 1679b(b) allows no payment for any agreed service before it is completed. A fee charged at signup, before any report is pulled or letter sent, violates the Act regardless of the amount or the label.

What has to be in a credit repair contract under CROA?

A written, dated, signed contract. It must state the total of all payments, describe the services in full including any guarantees, and give an estimated completion date or time period. It must list the company's name and principal address. A bold cancellation notice must sit next to the signature line, with a Notice of Cancellation form attached.

How long do I have to cancel a credit repair contract?

Until midnight of the third business day after you sign, for any reason and without penalty. The company must give you a cancellation form, and any written notice sent to the company's address works. No services may begin during that window.

What is the CROA disclosure statement?

A separate written document, titled Consumer Credit File Rights Under State and Federal Law, that the company must give you before any contract is signed. It states that no company can have accurate, current, and verifiable information removed. It says you can dispute errors yourself for free, and that you can cancel within three business days.

Can I sue a credit repair company?

Yes. Under § 1679g you can recover the greater of your actual damages or everything you paid, plus punitive damages the court allows, plus costs and attorney's fees. Under § 1679i the deadline is five years from the violation, or from discovering a misrepresentation the company was required to disclose.

Does CROA apply to credit counselors and lawyers?

It excludes 501(c)(3) nonprofits, a creditor restructuring its own debt, and banks and credit unions. Anyone else who takes money to improve or advise on a consumer's credit is covered, whatever they call themselves. Whether a particular lawyer's work falls inside the Act depends on the service sold, and courts have applied the Act to some.