To begin, best practice for pulling credit is a written authorization from the consumer prior to the inquiry, especially due to more restrictive state statues (i.e. Vermont) but we know this isn't always conducive or possible in every transaction.
With that said, our interpretation (and that of the credit reporting industry as a whole) is that Federal law (FCRA) does not mandate you obtain the consumers written permission prior to access. It is but one of several permissible purpose methods - relevant excerpts below…
§ 604 - 15 U.S.C. § 1681b
Permissible purposes of consumer reports [15 U.S.C. § 1681b]
(a) In general. Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:
(1) In response to the order of a court having jurisdiction to issue such an order, or a subpoena issued in connection with proceedings before a Federal grand jury.
(2) In accordance with the written instructions of the consumer to whom it relates.
(3) To a person which it has reason to believe
(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; or
(B) intends to use the information for employment purposes; or
(C) intends to use the information in connection with the underwriting of insurance involving the consumer; or
(D) intends to use the information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; or
(E) intends to use the information, as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; or
(F) otherwise has a legitimate business need for the information
(i) in connection with a business transaction that is initiated by the consumer; or (ii) to review an account to determine whether the consumer continues to meet the terms of the account.
The obvious problem with obtaining only a verbal authorization is documenting you met the minimum permissible purpose standards defined in the FCRA. In the case of regulatory inquiry, repository audit or litigation, it is often difficult to prove permissible purpose if otherwise is alleged (i.e. consumer complaint.)
For reference, we built Mortgage Preflight to require not only the written authorization, but to also authenticate the identity of the consumer (FACTA) and maintain a complete and reproducible audit trail of all components of the transaction. Instead of relying solely on the industry standard extension of credit (§ 604 - 15 U.S.C. § 1681b 11 3A), the PF consumer authorization also specifically includes a direct consumer written instruction authorization (§ 604 - 15 U.S.C. § 1681b 11 (2)) as shown below…
I hereby authorize Sample Mortgage Company Inc., and other persons or entities working with Sample Mortgage Company Inc. including but not limited to; real estate brokers, agents, or any other entity that may process, underwrite or fund the real estate loan(s) I/we am/are seeking, to access my/our credit reports for mortgage/credit purposes through Credit Technologies, Inc.® (CT) in compliance with 15 U.S.C. §1681b(a)(3)(A). This authorization includes any subsequent inquires required including but not limited to updating credit history, credit rescoring, GSE Loan Quality Initiatives (LQI) and/or quality control. I further provide authorization, to the same extent as above, to verify my current and previous employment, earnings and credit records including bank accounts, stockholdings, current and past mortgages, landlord references and any other assets, liabilities and public record information needed to process my mortgage loan application Sample Mortgage Company Inc. and any other entities outlined above may utilize this data exclusively for real estate transaction lending purposes. I understand and agree this authorization qualifies as a written authorization and is enforceable under the Electronic Signatures in Global and National Commerce Act ("ESIGN") Pub. L. No. 106-229, 114 Stat. 464 (2000) (codified at 15 U.S.C. § 7001 et seq.). It is understood that a copy of the data associated with this authorization shall serve as an original authorization. This authorization expires 180 days from the date of execution. I understand and agree that CT has no control over the content of the information provided to it, and it is not responsible for inaccurate results, including those due to incorrect, missing, or outdated credit report information. I understand that the use of Mortgage PreFlight does not constitute an application for a mortgage loan, and that I am not bound in any way to Sample Mortgage Company Inc. Privacy Act Notice: This information is to be used by the agency collecting it or its assignees in determining whether you qualify as a prospective mortgagor under its program. It will not be disclosed outside the agency except as required and permitted by law. You do not have to provide this information, but if you do not your application for approval as a prospective mortgagor or borrower may be delayed or rejected. The information requested in this form is authorized by Title 38, USC, Chapter 37 (if VA); by 12 USC, Section 1701 et. seq. (if HUD/FHA); by 42 USC, Section 1452b (if HUD/CPD); and Title 42 USC, 1471 et. seq., or 7 USC, 1921 et. seq. (if USDA/FmHA). I certify that I am eighteen years of age or older and that I am the person identified herein. I agree to abide by the terms and conditions contained in the cardholder agreement with the credit card issuer or bank. I understand that under 15 U.S.C. §1681 any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be subject to a fine, imprisonment, or both.
You must scroll through and read the entire above agreement to continue.
You understand that by clicking on the I AGREE button immediately following this notice, you are providing "written instructions" and permission for Sample Mortgage Company Inc. to access your credit report(s) through Credit Technologies, Inc.
I/We Agree and accept the above listed Terms and Conditions