FCRA violation penalties, and what a bad dispute really costs

FCRA violation penalties are smaller and later than most business cases assume. A willful failure exposes a furnisher to the consumer's actual damages or statutory damages of $100 to $1,000, plus whatever punitive damages a court allows and the consumer's legal costs; a negligent failure exposes it to actual damages and costs; and a regulator may act separately, with a civil money penalty set case by case rather than from a schedule. All of that sits at the end of a chain. The expensive part of a mishandled credit dispute comes first and arrives every month: an hour of an analyst's time spent answering without the document that would have ended it, a repeat dispute through a different door, a complaint that has to be answered in fifteen days, and a correction that finally has to be made at three bureaus instead of one. Botminds' Collections Dispute Management attacks the first link — the reading, the clock, the hold and the proof — because that is where a dispute stops being cheap.

This guide prices the chain, statute by statute and hour by hour. The legal bands are quoted from the statutes themselves and are not adjusted for inflation, because the FCRA writes them into the text. The lender figures are Collections Dispute Management's own demonstration data on a fictional sample lender, Ostrander Bank & Trust, and our estimates are labelled as estimates wherever they appear.

What are the penalties for an FCRA violation?

There are three answers, and confusing them is how business cases go wrong. The first is private liability: a consumer sues and recovers damages. The second is public enforcement: a regulator finds a pattern and imposes a civil money penalty, redress and an order to change the process. The third is not a penalty at all but is where most of the money goes — the cost of doing the work twice, which no court has to award and every lender pays.

Private liability turns entirely on one word. Section 1681n covers willful failures: "Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of— (1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000" (15 U.S.C. §1681n). The same section adds "such amount of punitive damages as the court may allow", and the costs of the action with reasonable attorney's fees. Section 1681o covers the rest: "Any person who is negligent in failing to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer" for actual damages and, on a successful action, costs and fees (15 U.S.C. §1681o).

The practical difference is the statutory band. A negligent furnisher owes what the consumer can prove it lost, which on a single wrong tradeline is often hard to quantify. A willful one owes $100 to $1,000 per consumer whether or not anything was proven lost — which is why the willfulness question, and the evidence of what the lender actually did when the dispute arrived, is the whole fight.

Statutory damages, actual damages and the fee award

Three heads of recovery sit behind one claim, and they scale differently. Actual damages are what the borrower lost: a denied application, a higher rate, a withdrawn offer, and in some courts the time and distress of trying to get it fixed. Statutory damages are the $100 to $1,000 band, available for a willful violation without proof of loss. Fees are the part that makes a $600 case worth bringing — the costs of the action with reasonable attorney's fees, as determined by the court, which is how a matter whose damages are small can produce a bill that is not.

Think about the arithmetic from the other side of the table, because that is the arithmetic that decides whether you receive a letter. A single wrong late mark, disputed once, answered with a form response and never corrected, produces a provable sequence: a dispute, a response that cites nothing, no change, and a borrower who can show the date they told you and the date you did nothing. A file that holds the claim, the six places searched and the comparison is a file where that sequence cannot be assembled.

Is there a private right of action for furnishing inaccurate information?

Not for the act of furnishing it — and this surprises people on both sides. The FCRA's duty to furnish accurate information sits in §1681s-2(a), and the statute then removes the private remedies for it: "Except as provided in section 1681s(c)(1)(B) of this title, sections 1681n and 1681o of this title do not apply to any violation of— (1) subsection (a) of this section, including any regulations issued thereunder" (15 U.S.C. §1681s-2(c)). Furnishing something wrong is enforced by regulators and state officials.

What a consumer can sue over is §1681s-2(b): the duty that attaches once a bureau has forwarded their dispute. So the sequence matters more than the error. An inaccurate line, by itself, is a supervisory matter. The same inaccurate line, disputed through a bureau and then verified without a reasonable investigation, is a private claim with statutory damages and a fee award attached. Every lender's exposure is therefore concentrated in the thirty days after a dispute arrives — which is exactly the window a dispute process either defends or squanders.

The regulator's price list, read from one order

There is no schedule of fines for dispute failures, so the only honest way to show the public side is to read an order. In September 2024 the CFPB found that a national bank had not investigated disputes at the scale and quality the FCRA requires:

For over 22,000 Indirect Disputes, not only did Respondent fail to conduct reasonable investigations within the prescribed time period, Respondent failed to perform any investigation at all.

CFPB, Consent Order, In the Matter of TD Bank, N.A. (2024-CFPB-0009)

The order required the bank to pay "a civil money penalty of $20 million to the Bureau" and to set aside $7.76 million for redress to affected consumers (2024-CFPB-0009). Those two numbers are the ones that get quoted. The two that matter more to anyone designing a process are the findings underneath them: that for seven months direct dispute investigations were not conducted at all because resources had been moved to another regulatory matter, and that even where investigations happened on time, representatives failed to review everything the bureau had sent or failed to report the result to it accurately.

Read as a risk model rather than as news, the order says something specific: the failures were not exotic. They were a queue that nobody could see, a reallocation nobody tracked, and investigations that reached the wrong records. Each of those is visible in a monthly report if anyone keeps one, which is the cheapest control in this guide.

How often do credit disputes end in a correction?

Often enough that a desk which almost never corrects anything should examine itself. The FTC's credit report accuracy study found that "one in five consumers had an error on at least one of their three credit reports", that "four out of five consumers who filed disputes experienced some modification to their credit report", and that "slightly more than one in 10 consumers saw a change in their credit score after the CRAs modified errors on their credit report" (FTC, February 2013). The follow-up study two years later found the dissatisfaction that follows a dispute that does not go far enough: of the 121 consumers it re-surveyed who had at least one unresolved dispute from the earlier study, "84 of these consumers (nearly 70 percent) continue to believe that at least some of the disputed information is inaccurate" (FTC, January 2015).

The lender-side shape is similar. At the fictional sample lender, 2,684 bureau and direct disputes closed in a quarter resolved as 1,903 verified as reported, 591 modified and 190 deleted: 29% of disputes found something to change. That ratio is the single most useful number on a dispute desk, because it is a measure of the data, not of the desk — and when it collapses toward zero it usually means the answers stopped reaching outside the collections system rather than that the data got better.

The cost before the penalty: the hour, the repeat, the complaint

Now the part no order mentions. A dispute answered without the record that would end it does not disappear; it escalates, and each step up the ladder costs more staff time than the one below it.

Each rung has its own character. The repeat is the cheapest to prevent and the most common: a borrower who gets an answer that does not engage with what they claimed will claim it again, usually through a different door, and the clock starts over. The complaint is the most expensive per unit, because it carries a fifteen-day response, an approval, and an audience that reads the answer against the records a lender says it holds. And the remediation is the one that is never one account: a servicing rule that moved a first-delinquency date when a hardship plan started did it to every account on a plan.

What the FDCPA adds, and what it caps

Where a third-party collector is involved, a second statute attaches to the same facts. The FDCPA allows a consumer actual damages plus additional damages of up to $1,000 as the court allows, and in a class action an amount for all the other class members, with no minimum per person, capped at the lesser of $500,000 or 1% of the collector's net worth (15 U.S.C. §1692k).

Two things follow for a lender that places accounts. The class cap is a percentage of the collector's net worth, not of the creditor's, which means the agency's exposure on a systemic practice may be far smaller than the harm — and the reputational consequence still lands on the brand on the letter. And the practice most likely to produce a claim is the one hardest to see from inside: a collection contact after the account was supposed to be paused. A validation request stops collection on the disputed debt until the verification is mailed, and a hold that an agency did not honour is discoverable from the agency's own call log, which is why reading those logs daily is a control rather than a courtesy.

Sixty accounts paused, and why that number is a cost control

Where the money actually goes

Add the chain up and the distribution is lopsided. For most lenders, in most years, no consumer sues and no regulator calls. What happens instead is that thousands of disputes each consume an hour that could have been fifteen minutes, a fifth of them come back because the first answer did not engage with the claim, and a handful escalate into complaints answered under time pressure. The penalty line in a business case is the smallest and least likely term in it; the staff-hours line is the largest and the certain one.

The complaint data makes the same point from outside. In 2025 companies closed 51% of credit or consumer reporting complaints with an explanation, 40% with non-monetary relief and 0.02% with monetary relief (CFPB Consumer Response Annual Report). Almost nothing is paid out. Almost everything is answered — which is to say, almost all of the cost of a complaint is the cost of answering it well, inside fifteen days, with the documents attached.

There is one asymmetry worth naming for the risk committee. The cost of a mishandled dispute is paid in small, invisible instalments and the cost of an enforcement action arrives once, in public, with an order attached. Budgets respond to the second and are consumed by the first.

Building a case a board will sign

A credible case for a dispute investment has four lines and no heroics. First, volume and mix: how many disputes arrive by each door, how many are answered inside the clock, and what share end in a correction. Second, the time: minutes per dispute, and the share of those minutes spent gathering records rather than deciding anything — on the sample lender's estimated split, 30 of 70 minutes are retrieval. Third, the escalation rate: repeats, complaints and the proportion of corrections that had to be made at more than one bureau. Fourth, the causes: the five or six upstream defects that produce most corrections, each with an owner and a fix.

The fourth line is the one that converts a cost case into a saving, because it is the only one that reduces the number of disputes rather than the cost of each. At the sample lender, settlements an agency did not report back, phone payments keyed to a closed loan and first-delinquency dates reset after a hardship plan accounted for 60% of a quarter's corrections between them, and all three are fixable upstream.

Why the disputes happened, with an owner against each cause

Two guides take the argument further in each direction: for what the law expects of the investigation itself, see what a reasonable investigation requires under the FCRA; for how the work divides between people and software, what automated dispute verification may decide. To see the clocks, the proof and the approvals on one desk, start from Collections Dispute Management.

Questions people ask

What are statutory damages under the FCRA?

They are damages a consumer may recover for a willful violation without having to prove a loss: not less than $100 and not more than $1,000 per consumer, in place of actual damages. A court may add punitive damages, and a successful consumer recovers costs and reasonable attorney's fees. Negligent violations carry no statutory band — only actual damages, costs and fees.

Can a consumer sue a furnisher for inaccurate reporting?

Only through the dispute. The FCRA switches off the private remedies for the duty to furnish accurate information, leaving that to regulators and state officials; the duty that a consumer can enforce is the duty to investigate after a credit bureau forwards their dispute. In practice this means a lender's private-claim exposure is created in the thirty days after a dispute arrives, not on the day the wrong value was first reported.

How much did the CFPB fine TD Bank over credit reporting?

The September 2024 consent order required a civil money penalty of $20 million and $7.76 million set aside for consumer redress. The findings behind the figures are the instructive part: over 22,000 indirect disputes with no investigation at all, seven months in which direct dispute investigations were not conducted, and investigations that did happen without reviewing everything the bureau had sent.

What are FDCPA statutory damages?

For an individual action, actual damages plus additional damages the court may allow up to $1,000, with costs and reasonable fees. For a class action, each named plaintiff can recover as an individual and the rest of the class shares an amount capped at the lesser of $500,000 or 1% of the collector's net worth. The cap is measured against the collector, which is why a lender's agency oversight matters more than the agency's balance sheet.

What does a mishandled dispute cost a lender in practice?

Mostly time. On our estimate from the sample lender's split, answering a direct dispute by hand takes about 70 minutes, of which 30 are spent retrieving records; a repeat doubles it, and a complaint adds another hour or more plus an approval. Set against that, penalties are rare and redress rarer still — in 2025, 0.02% of credit or consumer reporting complaints closed with monetary relief. The business case is built on repeat work and upstream causes, not on fines.

How often do disputes end in a correction?

The FTC's study found four out of five consumers who disputed saw some modification to their report, and about one in ten saw a score change. On the lender side of the same question, the sample lender corrected 781 of 2,684 disputes in a quarter, or 29%. A desk whose correction rate is far below that should check whether its investigations are reaching any system other than the one that produced the disputed line.