How to File a CFPB Complaint in 2026

The Consumer Financial Protection Bureau changed its credit reporting complaint process on 24 June 2026. You must now complete an FCRA dispute directly with the credit bureau before the CFPB will take your complaint, and attest that at least 45 days have passed since you filed it or that the dispute is no longer pending.

Last reviewed: 12 September 2026.

Guides written before 24 June 2026, including an earlier page on this site, describe the old process. The form is roughly the same. The gate in front of it is new, the identity checks on the account you file from are new, and there is now a disclosure rule for anyone filing on another person’s behalf.

What changed on 24 June 2026

On 24 June 2026 the CFPB published an announcement titled “The CFPB is Correcting Flaws to Restore Integrity and Utility to the Consumer Complaint System.” It describes six workstreams. Five of them change what a consumer actually has to do.

The Bureau’s stated reason is volume. It received more than 150,000 credit or consumer reporting complaints in 2019. In 2025 that number grew to more than five million, which the announcement describes as an increase of more than 3,700 percent.

Change	Status in the 24 June 2026 announcement
FCRA dispute must be exhausted with the bureau first	Live. A notice was added to the complaint flow
Two-factor authentication on your CFPB account	Live. The Bureau states it “launched two-factor authentication”
Email address and mobile phone verification	Live. Both are required to create an online account
Third parties must disclose their involvement	Live. Clarifying text and new relationship categories added
Address validation at the submission step	Planned. The Bureau “plans to implement” it
Administrative response for apparent abuse	Exploratory. The Bureau is “exploring” the category

Exhaust the FCRA dispute with the credit bureau first

This is the change that breaks the old advice. The CFPB announcement states that it “added a notice, emphasizing that consumers must first exhaust their dispute rights directly with consumer reporting agencies before coming to the Bureau.”

The literal action: send your dispute to Equifax, Experian or TransUnion directly, then wait. The CFPB’s Submit a Complaint page now carries the line “You are required by law to first dispute the information directly with the credit or consumer reporting agency.”

The CFPB’s Credit and consumer reporting complaint notice sets the condition you have to attest to at submission. You may file once you have submitted your dispute to the credit reporting agency at least 45 days ago, or once that dispute is no longer pending. The same notice states that the CFPB will discontinue processing your complaint if the company alerts the Bureau that you did not first dispute the information with it directly.

The Bureau is also, in its own words, “exploring adding an additional administrative response option so NCRAs can efficiently return complaints where the consumer has not exhausted their FCRA dispute obligations.” A returned complaint is not a substantive answer. It burns the escalation without producing anything.

Here is every clock that now runs between the error and the complaint.

Clock	Length	Source
Bureau must notify the furnisher of your dispute	5 business days from receipt	FCRA 611(a)(2)(A), 15 U.S.C. 1681i
Bureau reinvestigation	30 days from receipt of the dispute	FCRA 611(a)(1)(A)
Extension if you send more information during those 30 days	15 additional days, 45 total	FCRA 611(a)(1)(B)
Written results of the reinvestigation to you	5 business days after it is completed	FCRA 611(a)(6)(A)
Before you may file with the CFPB	At least 45 days since your dispute, or dispute no longer pending	CFPB credit and consumer reporting complaint notice
Company response to the complaint	Generally 15 days	CFPB complaint process page
Final company response	Up to 60 days	CFPB complaint process page
Your window to give feedback on that response	60 days	CFPB complaint process page

If you have not filed the underlying dispute yet, start with how to dispute your credit report step by step. The complaint comes after.

Pass two-factor authentication on your CFPB account

The announcement states that “The Bureau launched two-factor authentication, requiring users who create online accounts to verify both their email address and mobile phone number.”

The literal action: create the account before you need it, not at the moment you are ready to file. Two-factor authentication means a code sent to a channel you control, so you need access to both the inbox and the handset at submission time.

Verify an email address and a mobile phone number

These are the two specific factors the CFPB named, and they are separate from each other. An email address alone will not complete account creation.

The literal action: use an email address you will still hold in six months, because the CFPB notifies you there when the company responds and when your 60 day feedback window opens. Use a mobile number that can receive text messages. A landline or a voice over IP number that cannot take an SMS code is a real failure point here.

Expect address validation at the submission step

The CFPB states that it “plans to implement address validation at the complaint submission step to ensure companies can act on high-quality information.” As of this review the announcement frames address validation as planned rather than launched, so treat it as arriving rather than active.

The literal action: use the mailing address exactly as it appears on the credit report you are complaining about. If your report shows an old address and you enter a new one, a validation step has a reason to reject the pairing, and the company has a reason to say it cannot match you to a file.

Disclose it when a third party is involved

The CFPB added, in its words, “clarifying text and new relationship categories to emphasize that third parties must disclose their involvement in the complaint process.” The Submit a Complaint page states that companies only respond to complaints submitted directly by a consumer or by their authorized representative, and that a company may require signed written proof of permission.

This is not a new posture, it is an enforced one. The CFPB’s December 2025 report on FCRA Section 611(e) notes that the Bureau maintains procedures “to detect and discontinue the processing of complaints where the CFPB has reason to believe that third parties are not disclosing their involvement in the complaint process.”

Now the part most guides will leave out. The 24 June 2026 announcement names who the Bureau thinks drove the volume: “credit repair organizations and credit clinics misusing the Bureau’s complaint process as a tool of their business, social media influencers with questionable expertise encouraging followers to submit complaints, adoption of new technologies (e.g., ‘AI tools’) that may act as an individual’s agent, and the emergence of new businesses that seek to boost credit scores by disputing accurate information on consumers’ reports.”

Credit Booster AI is an AI tool in consumer credit. That list includes Credit Booster AI by description, and pretending otherwise would be dishonest. So here is the distinction the rule actually draws, which is not tool versus no tool.

• You write and submit the complaint from your own verified CFPB account. There is no third party in the transaction, so there is nothing to disclose. Software that helped you assemble dates, letters and delivery receipts is not a submitter.
• Someone or something else submits on your behalf. That is a third party acting as your agent, it must be disclosed in the relationship field, and the company may demand signed written permission before it responds at all.
• A complaint is filed in your name without disclosure. That is the pattern the CFPB is detecting and discontinuing, and it is the pattern the new administrative response categories are aimed at.

The same announcement is blunt about the claims that go with the abuse. It says some credit repair companies “make claims that are too good to be true, such as guaranteeing a specific increase in credit scores or removing negative (but accurate) information.” Both of those are already illegal to promise under the Credit Repair Organizations Act, and neither is something any tool can deliver. See can you remove accurate information for what is actually removable.

How long the credit bureaus actually take to respond

Set your expectations from the CFPB’s own measurement, not from the 15 day figure on the process page. The CFPB’s December 2025 report “Annual report of credit and consumer reporting complaints” analyses complaint data from January 2024 through June 2025.

Bureau	Typical average response time in the study period	Most recent months	Outer limit
TransUnion	About 40 days, consistently, dating back to 2022	More than 50 days	60 days
Equifax	Vacillated around a similar length to TransUnion	More than 50 days	60 days
Experian	Nearly the full 60 days, consistently, since early 2023	More than 50 days	60 days

The report states plainly that “In the most recent months, all three NCRAs have average response times that exceed 50 days.” Plan on two months, not two weeks.

The same report shows a second gap worth knowing before you write. The share of consumers reporting a previous dispute has hovered around 90 percent since 2020 across all three bureaus. What the bureaus confirm is different. Equifax’s confirmation rate hovered around 37 percent from 2024 through mid 2025. TransUnion’s sat near 30 percent from 2022 through mid 2025. Experian’s climbed until it met the consumer rate in 2024 and exceeded it nearly every month after.

That disagreement is now your problem, because under the 2026 rules the company can get your complaint discontinued by telling the CFPB you never disputed. Documentary proof of your dispute is the single most valuable thing in the file. Our breakdown of Experian’s CFPB relief rate covers what the bureaus do with complaints once they accept them.

How to file a CFPB complaint about a credit bureau, step by step

1. Pull the report that contains the error

Get the actual report from the bureau that is reporting the item, not a third party score app. You need the exact account name, account number fragment, and the way the item is worded on that bureau’s file.

2. File the FCRA dispute directly with that bureau

Online, by mail, or by phone. Keep the confirmation number, the date, and a copy of everything you sent. If you mail it, send it certified with return receipt. The delivery date is what every later deadline runs from.

3. Wait out the clock

Either the bureau closes the dispute and sends you results, or 45 days pass since you filed. One of those two conditions must be true before you submit. Do not file while the dispute is still pending.

4. Create the CFPB account and clear two-factor authentication

Go to consumerfinance.gov/complaint, create the account, verify the email address and the mobile phone number. Do this step first so that authentication trouble does not happen while you are mid submission.

5. Name the right company and the right issue

Select the credit reporting agency by name. Choose the issue that matches what failed: incorrect information on your report, or a problem with a credit reporting company’s investigation into an existing problem. Those two categories are what the CFPB transmits to the bureaus under FCRA Section 611(e).

6. Write the complaint as a dated timeline

Dates, actions, outcomes, no adjectives. State the date you filed the dispute, the method, the confirmation or tracking number, what the bureau sent back or that it sent nothing, and the date on which the 45 day condition was met. Cite one statute per failure, not a legal argument.

7. Attach the dispute record

Upload the dispute confirmation, the certified mail receipt or online confirmation, the bureau’s results letter if you got one, and the page of the credit report showing the item. This is what defeats a company response claiming you never disputed.

8. Answer the attestation truthfully

You will confirm that the information you provided is true to the best of your knowledge and belief, and that the 45 day or closed dispute condition is met. If a third party is involved in the submission, select the relationship category that says so.

9. Read the response and use your 60 days

The company generally responds within 15 days, with up to 60 days for a final response. Read it against your own timeline. If it misstates a date or claims a document was never received, say so in your feedback and attach the receipt again. That feedback becomes part of the record.

What a CFPB complaint cannot do

• It cannot remove accurate negative information. Nothing can.
• It has no effect on your credit score and does not appear on your credit report. It is a regulatory record about the company.
• It is not a substitute for the FCRA dispute. As of 24 June 2026 it is explicitly downstream of one.
• It does not force an outcome. It forces a written response that a federal regulator sees.

How this page relates to our identity theft complaint guide

Two pages on this site cover CFPB complaints and they do different jobs.

This page is the general process authority for any credit reporting complaint under the rules in force since 24 June 2026.

CFPB complaint against a credit bureau stays scoped to identity theft, where the underlying obligation is a Section 605B block rather than a Section 611 reinvestigation. Read that page for the 605B package, the 4 business day deadline, and what to do when a bureau ignores an FCRA 605B block request. Read this page for the filing procedure itself.

The short version

• The CFPB changed the credit reporting complaint process on 24 June 2026
• You must finish an FCRA dispute with the bureau first, then attest that at least 45 days have passed or the dispute is closed
• The CFPB discontinues processing if the company reports you never disputed directly
• Your account now needs two-factor authentication with a verified email address and mobile phone number
• Address validation at submission is announced as planned, so match the address on the report
• Third parties must disclose involvement, and companies only respond to the consumer or an authorized representative
• Expect roughly two months, not two weeks. All three bureaus averaged more than 50 days in the CFPB’s most recent measurement
• A complaint does not remove accurate information and does not affect your score

Credit Booster AI keeps your report data, your dispute dates and your delivery receipts in one place, so the timeline and the proof you need at step 7 are already assembled when you file it yourself.

Sources

All sources pulled and verified 12 September 2026.

1. Consumer Financial Protection Bureau, “The CFPB is Correcting Flaws to Restore Integrity and Utility to the Consumer Complaint System”, 24 June 2026.
2. Consumer Financial Protection Bureau, “Credit and consumer reporting complaint notice”.
3. Consumer Financial Protection Bureau, “Submit a complaint”.
4. Consumer Financial Protection Bureau, “Complaint process”.
5. Consumer Financial Protection Bureau, “Annual report of credit and consumer reporting complaints: An analysis of complaint responses by Equifax, Experian, and TransUnion”, December 2025.
6. Legal Information Institute, Cornell Law School, 15 U.S.C. 1681i, Procedure in case of disputed accuracy.