FCRA Section 623: Data Furnisher Obligations Explained
A plain-English guide to FCRA Section 623 — the federal law that governs what data furnishers must and cannot do when reporting consumer credit information to the credit bureaus.
Section 623 of the Fair Credit Reporting Act (FCRA) is the primary federal law governing the obligations of data furnishers — organizations that provide consumer credit information to the credit bureaus. If your organization reports consumer accounts to Equifax, Experian, TransUnion, or Innovis, Section 623 applies to you regardless of your industry, account volume, or how long you have been reporting.
The CFPB (Consumer Financial Protection Bureau) and FTC (Federal Trade Commission) both have enforcement authority over FCRA Section 623. Violations can result in civil penalties of up to $1,000 per violation per consumer, plus actual damages, punitive damages, and attorney's fees.
Who Is a Data Furnisher?
A data furnisher is any person or organization that regularly and in the ordinary course of business furnishes information to one or more consumer reporting agencies (credit bureaus) about transactions or experiences with consumers. This includes:
- Auto lenders and Buy Here Pay Here (BHPH) dealers
- Mortgage lenders and servicers
- Credit card issuers
- Personal loan companies and fintech lenders
- Student loan servicers
- Debt collectors and debt buyers
- Property managers and rent reporters
- Utility companies (in some states)
- Medical debt collectors
Section 623(a) — Accuracy Obligations
Section 623(a) requires data furnishers to report accurate and complete information. This is the foundation of all data furnisher compliance.
623(a)(1) — Prohibition on Reporting Inaccurate Information
A data furnisher may not furnish information relating to a consumer to any consumer reporting agency if the furnisher knows or has reasonable cause to believe that the information is inaccurate.
What this means in practice:
- You must verify that your Metro 2® data accurately reflects the account history before each submission
- If you discover an error after submission, you must correct it in the next monthly file
- "Reasonable cause to believe" is a low threshold — if your system flags an inconsistency, you cannot ignore it
623(a)(2) — Duty to Correct and Update Information
If a data furnisher determines that information previously furnished is not complete or accurate, the furnisher must promptly notify the consumer reporting agency of that determination and provide correct and complete information.
"Promptly" is not defined in the statute, but the CFPB and courts have interpreted it to mean within the next monthly reporting cycle at the latest. Waiting multiple months to correct a known error is a violation.
623(a)(3) — Duty to Report Dates of Delinquency
When a data furnisher reports a delinquent account to a consumer reporting agency, the furnisher must provide the date of delinquency — the month and year of the commencement of the delinquency that immediately preceded the action that caused the account to be reported.
This is the Date of First Delinquency (DOFD) in Metro 2® terminology. It is one of the most critical fields in the entire Metro 2® file because it determines when the 7-year reporting clock starts.
Key rules for DOFD:
- Must be reported within 90 days of furnishing the delinquent account
- Must never be changed after initial reporting (re-aging is a violation)
- Must reflect the actual first date of delinquency, not the charge-off date or collection date
- For accounts sold to debt collectors: the original furnisher must provide the DOFD to the debt collector, and the debt collector must use the same DOFD
623(a)(5) — Duty to Provide Notice of Dispute
If a consumer disputes the accuracy of information with a data furnisher directly (not through a bureau), and the furnisher determines the information is inaccurate, the furnisher must notify the consumer reporting agency and provide corrected information.
623(a)(6) — Duty to Provide Notice to Consumers
Before furnishing negative information to a consumer reporting agency, a data furnisher must provide written notice to the consumer that negative information may be furnished. This is typically done through the original credit agreement or a separate notice.
Section 623(b) — Dispute Investigation Obligations
Section 623(b) governs how data furnishers must respond when a consumer disputes information through a credit bureau (via e-OSCAR).
The 30-Day Investigation Requirement
When a data furnisher receives notice of a dispute from a consumer reporting agency (through e-OSCAR), the furnisher must:
- Conduct a reasonable investigation of the disputed information
- Review all relevant information provided by the consumer reporting agency
- Report the results of the investigation to the consumer reporting agency
- Complete the investigation within 30 days of receiving the dispute notice
If you fail to complete the investigation and report results within 30 days, the consumer reporting agency must delete the disputed information from the consumer's credit file — regardless of whether the consumer's dispute is accurate. There is no extension available.
What Constitutes a "Reasonable Investigation"?
Courts and the CFPB have interpreted "reasonable investigation" to require more than simply confirming that your internal records match what you reported. A reasonable investigation must:
- Review the original account documents (application, agreement, payment history)
- Consider all information provided by the consumer reporting agency with the dispute notice
- Evaluate whether the consumer's claim has merit based on the actual account history
- Not simply "parrot back" the same information that was disputed without actually investigating
Dispute Response Codes
When responding to a dispute through e-OSCAR, data furnishers must use the correct response code:
Section 623(c) — Safe Harbor for Accurate Reporting
A data furnisher is not liable under the FCRA for reporting information to a consumer reporting agency if the furnisher clearly and conspicuously specifies an address for consumers to send notices of inaccurate information, and the furnisher follows the procedures required by Section 623(a)(8) for direct disputes.
Common FCRA Section 623 Violations
These are the most frequently cited Section 623 violations in CFPB enforcement actions and consumer lawsuits:
Changing the Date of First Delinquency (DOFD) to a later date to artificially extend the reporting period. A CFPB enforcement priority — any change to DOFD after initial reporting is a red flag.
Not conducting a reasonable investigation within 30 days of receiving an e-OSCAR dispute notice. Results in mandatory deletion of the disputed information regardless of its accuracy.
Continuing to report disputed information that was found to be inaccurate during the investigation. Once an error is confirmed, it must be corrected in the next submission.
Reporting a DOFD that doesn't reflect the actual first delinquency. Affects the 7-year reporting clock and can result in premature or extended negative reporting.
Not updating the bureaus after discovering an inaccuracy in previously reported data. "Promptly" is interpreted as within the next monthly reporting cycle at the latest.
Continuing to report an outstanding balance on debt that was discharged in bankruptcy. Discharged debt must be reported with a $0 balance and the appropriate bankruptcy special comment code.
Original creditor not providing the Date of First Delinquency when selling or transferring an account. Debt collectors must use the same DOFD as the original creditor.
Not notifying consumers in writing before furnishing negative information to a credit bureau. Required by FCRA Section 623(a)(7) — typically included in the original credit agreement.
The CFPB's Supervisory Authority
The CFPB has supervisory and enforcement authority over data furnishers with more than $10 million in annual receipts. For smaller furnishers, the FTC has enforcement authority. Both agencies can:
- Conduct examinations of data furnisher compliance programs
- Issue civil investigative demands (CIDs)
- Bring enforcement actions with civil money penalties
- Require remediation for affected consumers
Even if your organization is below the CFPB's supervisory threshold, consumers can bring private lawsuits under the FCRA. Section 623 violations that are willful can result in statutory damages of $100–$1,000 per violation, plus punitive damages and attorney's fees — making class actions particularly costly.
Building a Section 623 Compliance Program
A robust Section 623 compliance program includes the following components:
Accuracy controls:
- Monthly Metro 2® file validation before submission (see our Metro 2 Compliance Audit Checklist)
- Written procedures for correcting errors discovered after submission
- Staff training on Metro 2® field requirements and FCRA obligations
Dispute management:
- e-OSCAR registration and active monitoring (see our e-OSCAR Guide)
- Written dispute investigation procedures
- Tracking system for open disputes and 30-day deadlines
- Documentation of all dispute investigations and responses
Direct dispute procedures:
- Designated address for consumers to send direct disputes
- Written procedures for investigating and responding to direct disputes
- 30-day response deadline for direct disputes as well
Record retention:
- Retain dispute investigation records for at least 5 years
- Retain Metro 2® files and validation reports for at least 5 years
- Document all corrections made to previously reported information
This guide is for informational purposes only and does not constitute legal advice. Data furnishers should consult qualified legal counsel for advice specific to their compliance obligations under the FCRA.
More in Compliance
Our compliance team has helped 1,200+ organizations with Metro 2® reporting. Book a free call.