CFPB Action Against TransUnion: What Consumers Need to Know

The Consumer Financial Protection Bureau (CFPB) issued an enforcement order against TransUnion, one of the three nationwide credit reporting companies, after finding years of violations involving credit report security freezes, locks, and prescreened solicitations. This guide explains what happened, why it matters, and what consumers can learn from the case.

Background: Who Is TransUnion and What Did the CFPB Do?

TransUnion is a major consumer reporting agency that collects and sells credit information used by lenders, insurers, landlords, and others to make decisions about consumers. Because of its role, TransUnion must comply with federal consumer protection laws, including the Fair Credit Reporting Act (FCRA) and the Consumer Financial Protection Act (CFPA).

In an order first issued in 2023, the CFPB found that TransUnion:

• Failed to timely place or remove security freezes on consumers’ credit reports when requested.
• Failed to timely place or remove credit locks for consumers who asked for those protections.
• Misled some consumers by telling them their requests were successfully processed when they were not.
• Did not properly exclude certain groups, including active-duty servicemembers and other potential identity theft victims, from prescreened solicitations as required by law.

The order required TransUnion to pay $3 million in redress to affected consumers and a $5 million civil money penalty, and to change its practices to prevent future violations.

In November 2025, the CFPB terminated the order after determining that TransUnion had met its obligations, including payment of penalties and taking steps to implement the required conduct changes.

Legal Framework: Key Laws at Issue

The CFPB’s action against TransUnion centered on violations of two main federal laws:

• Fair Credit Reporting Act (FCRA) – This law governs how consumer reporting agencies collect, use, and share consumer data, and establishes rights such as security freezes and rules for prescreened offers.
• Consumer Financial Protection Act (CFPA) – This law prohibits unfair, deceptive, or abusive acts or practices in the consumer financial marketplace and gives the CFPB enforcement authority.

TRENDING

Mass Deportation and the Erosion of Civil Liberties

A comprehensive look at the shift in U.S. immigration policy, highlighting executive overreach, civil rights concer...

Rethinking School Safety: The Impact of Police on Students

Explore the profound effects of police in schools, the criminalization of adolescent behavior, and the urgent push ...

The Erosion of the American Welcome: U.S. Refugee Caps

Explore the systemic dismantling of the U.S. Refugee Admissions Program, the humanitarian toll of historically low ...

Read More

The Future of AI: Preventing a Big Tech Monopoly >

Among other things, the FCRA requires consumer reporting agencies to implement reasonable procedures to protect consumer information and to honor consumer choices about how their data is used, including when they opt out of prescreened credit or insurance offers.

What Went Wrong With Security Freezes and Locks

One of the core issues in the enforcement case involved how TransUnion handled security freezes and credit locks on consumer credit reports.

Understanding Security Freezes vs. Credit Locks

CFPB Findings on TransUnion’s Handling of Freezes and Locks

According to the CFPB’s order, TransUnion:

• Did not consistently place security freezes within the required time frame after consumers submitted valid requests.
• Did not consistently remove or lift freezes when consumers requested changes, potentially impacting their ability to obtain credit when needed.
• Failed to timely implement credit locks and unlocks in some cases, despite representing to consumers that these tools would be promptly applied.
• In certain instances, told consumers their freeze or lock requests were completed even though they had not been successfully processed.

These failures undermined a critical layer of consumer protection against identity theft and unauthorized new account openings. Security freezes and locks are especially important for victims of identity theft, who rely on them to prevent further harm.

Issues With Prescreened Solicitations

The CFPB also found that TransUnion violated the FCRA in its handling of prescreened solicitation lists used for credit and insurance offers.

Under the FCRA, consumer reporting agencies can provide lists of consumers who meet certain criteria to lenders and insurers for firm offers of credit or insurance. However, the law requires:

• That consumers be given a clear opportunity to opt out of these prescreened offers.
• That certain groups, including some identity theft victims and active-duty servicemembers, be excluded from prescreened lists under specific circumstances.

The CFPB found that, between approximately 2016 and 2020, TransUnion failed to properly exclude some consumers from these lists, including active-duty military personnel and others at elevated risk of identity theft, in violation of the FCRA.

Deceptive Communications and Consumer Harm

The CFPA prohibits deceptive practices, including false or misleading statements that are likely to mislead reasonable consumers about important information. In its order, the CFPB concluded that TransUnion violated the CFPA by:

• Falsely telling certain consumers that their security freeze or lock requests were successfully completed when in fact they were not.
• Creating a reasonable impression that protections were in place, when the underlying systems had not applied them as promised.

Consumers who relied on these misrepresentations may have believed their reports were locked down while they remained vulnerable to new account fraud or unauthorized access.

Penalties, Redress, and Required Changes

The CFPB’s order imposed both financial consequences and forward-looking conduct requirements on TransUnion.

Monetary Relief

• $3 million in consumer redress to compensate harmed consumers.
• $5 million civil money penalty paid to the CFPB, which can be used to compensate victims in other cases through the CFPB’s Civil Penalty Fund.

Conduct and Compliance Obligations

The order also required TransUnion to implement extensive compliance measures, including:

• Strengthening internal systems to ensure timely placement and removal of freezes and locks.
• Improving consumer communications so that confirmations accurately reflect the status of protections.
• Updating procedures to correctly exclude certain populations, including active-duty servicemembers and identity theft victims, from prescreened lists when required by law.
• Maintaining documentation and controls that allow the CFPB to verify compliance.

By November 2025, the CFPB determined that TransUnion had fulfilled these obligations and formally terminated the order, consistent with its statutory authority under 12 U.S.C. § 5563(b)(3).

How This Fits Into a Broader Pattern of Oversight

The action over freezes, locks, and prescreened lists is part of a broader regulatory pattern involving TransUnion and other credit reporting agencies. In a separate 2023 action, the CFPB and Federal Trade Commission required TransUnion and a rental screening subsidiary to pay $15 million over inaccurate tenant screening reports, including incomplete or misleading eviction records. Regulators found that those inaccuracies harmed consumers’ ability to obtain housing and failed to meet FCRA accuracy standards.

Earlier, the CFPB also sanctioned TransUnion over deceptive marketing of credit scores and related subscription products, concluding that consumers were misled about the usefulness and cost of the scores being sold. Together, these actions reflect increased scrutiny of how large data and reporting firms treat consumer information and communicate with the public.

Practical Takeaways for Consumers

Even though the CFPB’s particular order has been terminated, the underlying lessons for consumers remain important. Anyone who interacts with credit reporting agencies can take several steps to better protect their financial information.

1. Regularly Check Credit Reports

• Obtain free reports via the centralized system authorized by federal law (AnnualCreditReport.com is the official channel designated by the FTC and CFPB).
• Review for inaccurate accounts, inquiries, addresses, or public records.
• Dispute errors promptly with the reporting agency and, when appropriate, with the creditor or furnisher.

2. Use Security Freezes and Fraud Alerts When Appropriate

• Consider placing a security freeze if you are a victim of identity theft or want to reduce the risk of new account fraud.
• After requesting a freeze, confirm its status through the agency’s online portal or written confirmation rather than relying solely on an initial message.
• Use temporary lifts or PIN-based thawing when you apply for new credit.

3. Be Cautious With Credit Monitoring and Lock Products

• Read the terms and conditions before enrolling in any credit monitoring or lock service.
• Verify whether key protections, such as locks, take effect immediately or require additional steps.
• Monitor billing statements for unwanted recurring charges from credit product subscriptions.

4. Manage Prescreened Offers

• Use the official FCRA opt-out channels (such as the national prescreen opt-out system) if you do not want to receive prescreened credit or insurance offers.
• If you are on active duty or have experienced identity theft, consider additional safeguards, including fraud alerts and credit freezes.

Frequently Asked Questions (FAQs)

Q1: What did the CFPB say TransUnion did wrong?

The CFPB found that TransUnion failed to timely place and remove security freezes and credit locks when requested, misrepresented to some consumers that their requests had been completed when they were not, and failed to properly exclude certain consumers from prescreened solicitation lists, violating the FCRA and CFPA.

Q2: Did TransUnion pay money because of the violations?

Yes. The CFPB’s order required TransUnion to pay $3 million in redress to consumers and a $5 million civil money penalty, in addition to implementing compliance measures to prevent future violations.

Q3: Is the enforcement order still in effect?

No. In November 2025, the CFPB terminated the order after determining that TransUnion had fulfilled its obligations, including paying the civil money penalty, providing redress, and implementing the required conduct changes.

Q4: How can I tell if a security freeze or lock is really active?

After requesting a freeze or lock, log in to your credit bureau account or review written confirmations to verify the status. Do not rely solely on a single confirmation message; instead, confirm that your credit file is shown as frozen or locked in the bureau’s system.

Q5: Where can I report problems with a credit reporting agency?

Consumers can submit complaints about credit reporting problems directly to the CFPB through its official complaint portal, and may also contact the Federal Trade Commission or their state attorney general’s office for additional support and guidance.

Similar Articles

The Battle Over Banned Books in Military K-12 Schools

Mass Deportation and the Erosion of Civil Liberties

Rethinking School Safety: The Impact of Police on Students

The Erosion of the American Welcome: U.S. Refugee Caps

The Future of AI: Preventing a Big Tech Monopoly

The Shift to Probabilistic Computing: The End of Logic

Author

medha deb

 

Medha Deb is an editor with a master's degree in Applied Linguistics from the University of Hyderabad. She believes that her qualification has helped her develop a deep understanding of language and its application in various contexts.

Read full bio of medha deb