How to tell if a credit repair company is legitimate

You do not need to know the company. You need four checks that settle it, and seven tests that work on a page you have never seen.

Check four things. What they promise. A legitimate firm challenges items that are inaccurate, and says so in those words. When they charge. After the work, never before. What they hand you before you sign. A standalone disclosure, a contract with a specific list of terms, and a duplicate cancellation form. What they tell you to file. If the answer is an identity theft report and nothing was stolen, walk. Miss on any one and you can close the tab. Federal law is specific enough here that you do not have to guess.

Then there is the harder problem. A list of bad companies goes stale in a season, because the names change and the pitch does not. So the second half of this piece is a set of structural tests. They work on the site that launched last week.

Worth saying once: a decline is a fact about a file, not about you. The people marketing to you this week are betting you will not keep those two separate.

What can a credit repair company legally do?

Dispute information that is inaccurate, incomplete, or unverifiable. That is the toolkit. Congress wrote the sentence itself and requires every credit repair company to hand it to you before you sign anything, at 15 U.S.C. § 1679c(a):

The mechanism behind a real dispute is FCRA § 611, 15 U.S.C. § 1681i. The bureau must run a reasonable reinvestigation, free, generally within 30 days. It deletes what comes back inaccurate, incomplete, or unverifiable. Accurate items survive it. You can file that dispute yourself, at no cost, without hiring anyone.

Separately, the FCRA caps how long a bureau may keep reporting a negative, generally seven years for collections, charge-offs and other adverse items (15 U.S.C. § 1681c(a)). Two details that get quoted wrong. The statute sets ten years for all cases under title 11, with no Chapter 7 versus Chapter 13 distinction written into it; the familiar seven-year drop of a completed Chapter 13 is bureau policy, not law, and policy can change. And the limits are not absolute: § 1681c(b) suspends them entirely for a credit transaction of $150,000 or more. On a large facility, an old item can legally still be sitting there.

Either way, this is a ceiling on the bureau, not a right to get something off early.

When is a credit repair company allowed to charge you?

After the service is fully performed. 15 U.S.C. § 1679b(b): no credit repair organization may charge or receive any money "before such service is fully performed."

Monthly billing does not fix this. The CFPB addressed it directly, saying some companies structure monthly payment plans to avoid the requirement and that "no form of upfront payment is legal." A subscription billed before the work is done is the model, not an exception to it.

One caveat that cuts the other way, and it is the one most consumer articles miss. The advance-fee ban binds a "credit repair organization" as CROA defines it, and § 1679a(3) excludes 501(c)(3) nonprofits, creditors restructuring debt you already owe them, and depository institutions and their affiliates. So "anyone who charges before the work is done is breaking CROA" is too broad. A bank or a genuine nonprofit can be outside the federal definition entirely. What that does not buy is a free pass: § 1679b(a), which bans untrue or misleading statements and advising you to alter your identification, applies to any person, and a state credit-services statute may still reach the same outfit.

If the pitch reached you by phone, the bar is higher. The FTC's Telemarketing Sales Rule, 16 C.F.R. § 310.4(a)(2), blocks any fee until the promised timeframe has run and the seller has handed you a consumer report, issued more than six months after the results were achieved, proving them. That rule, not CROA, is the vehicle behind the largest number this industry has seen. The CFPB's case against Progrexion, CreditRepair.com and Lexington Law ended in a stipulated judgment of $2,660,926,481 in consumer redress, civil penalties of $45,817,452 and $18,408,726, and a ten-year telemarketing ban, entered August 2023.

What must they hand you before you sign?

Easiest test in the piece, and almost nobody runs it. Ask for the paperwork before you give a card number, then check it against this list:

• A separate, standalone disclosure, "Consumer Credit File Rights Under State and Federal Law." The statute requires it be a document separate from the contract and from any other material they give you (§ 1679c(b)).
• A written, dated contract containing all of: the total amount of all payments; a full and detailed description of the services, including all guarantees of performance and an estimate of the completion date; the organization's name and principal business address; and a bold-face cancellation notice in immediate proximity to your signature line (§ 1679d(b)).
• A duplicate "Notice of Cancellation" form (§ 1679e(b)–(c)), plus copies of everything they ask you to sign, at signing.

Then the timing, which is stronger than the "three-day right to cancel" everyone quotes. Under § 1679d(a), no services may be provided at all until the contract is signed and the three business days have run. That is a blackout on the work, not just a window to change your mind. A firm that starts disputing the day you sign is already outside the statute even if nothing was billed.

Regulators sue on exactly these gaps. In the FTC's case against Grand Teton Professionals and its owners, who the FTC says pitched under trade names including Deletion Experts, Inquiry Busters and Top Tradelines, the contracts allegedly "failed to include CROA-required terms" such as a detailed description of the services, an estimate of how long results would take, any guarantees, and the three-day cancellation statement. The defendants settled with the FTC in 2020 and were banned from the credit repair business.

How do you test a pitch you have never seen before?

Everything above assumes you already found the company. This is the part that scales. Seven tests. None of them requires you to know who is behind the page, and all seven take about ten minutes together.

1. Look for a number married to a date

A site that promises a specific number of points inside a specific number of months has told you it does not understand its own product, or that it is willing to lie. Nobody controls the result. The furnisher controls what it reports, the bureau controls the reinvestigation, and your own balances control most of the rest. Legitimate operators describe levers. Scams describe a result on a clock. The more exact the number, the louder the alarm, because false precision on an uncontrollable outcome is the whole tell. A hedge counts for something, and you will see them — the guaranteed-no-but-highly-probable construction — but a hedge does not turn a promise into a measurement.

2. Run the verb test

Two words tell you which business you are looking at. Accuracy or existence. "Fix inaccurate late payments" and "dispute errors in how the bankruptcy is reported" point at accuracy, which is the § 611 right used correctly, and a real lever, because files carry real errors. "Erase," "remove," "delete any negative" and "wipe your report" point at existence, which nobody can do to an item that is accurate. Watch for the split-level version, where the headline sells removal and a paragraph further down concedes that removing accurate information is not legal. The lead surface is what they are selling.

3. Read the same number three times on one page

Take the headline claim and find it again in the stat tiles, then again in the FAQ. Marketing pages are assembled by different people at different times, and a made-up number drifts between the three. When the hero says one milestone and the FAQ says a range that does not contain it, you have caught the page contradicting itself without needing any outside source. A number a company cannot keep straight is not a measurement.

The sibling of this test is subtler and it fools researchers, not just buyers. Two sites agreeing does not corroborate anything if both earn money the same way when you believe it. Two lead-generation marketplaces publishing the same qualification thresholds are two salesmen nodding. Before you count agreement as confirmation, ask whether the two sources have opposite incentives.

4. Open the page twice

Some sites run a live-agent counter, something like four experts available right now, or fifty-eight agents currently helping. Load the page in a second tab, or come back in an hour. If the numbers move in a way no staffing schedule explains, or reset to a similar-but-different pair every visit, the counter is a randomizer wearing a uniform. Same family of tell: cumulative, undated, self-reported scale boasts — N clients helped, $N billion facilitated. The structural giveaway is that the number can only ever grow and no outside party checks it. It is not a lie you can prove, and it is not evidence of anything either. Strip it before it affects your decision.

5. Vary the inputs

If the page has a calculator, a "find your match" tool, or a score-based recommender, feed it a different answer to every question and watch the output. If the recommendation does not move, the interactivity was theater and the tool exists to capture your contact details. Same for any black-box number with no published weights. The related version is the free "soft pull to review your report," offered mid-article. The pull may be real. The review is the funnel.

6. Strip the brand out of the step

When a how-to article says "Step 1: check your score at [Product]," delete the product name and ask whether the step survives. If it does not, it was never a step, it was an ad inside instructions. Every one of these has a free or statutory equivalent that goes unmentioned. Disputes are free to any bureau under § 611. Reports are free weekly at AnnualCreditReport.com, which the three nationwide bureaus have made permanent. A security freeze is free by federal law, though you place it at each of the three bureaus separately, since one does not cover the other two.

7. Check whether the statistic has a date

"The average American credit score is X." "N percent of reports contain an error." Flat, undated, no source named. The figure may even be directionally right. The manipulation is the missing vintage, which lets a stale number pose as this year's truth. Anything you plan to act on should carry an as-of year and a primary source you can open. Including anything on this page.

The one question behind all seven: who profits if you believe this, and do they control the outcome? When the source is the only witness and the source gets paid, it is a claim, not a fact.

Which pitches are illegal on their face?

Some things do not need a test. If any of these appear, the conversation is over, and in the first two the person exposed is you, not the seller.

• "File an identity theft report" when nothing was stolen. The FTC, in a January 2026 alert about influencers pushing exactly this, says filing a false identity theft report "may leave you worse off, and it's a crime that could get you a fine, imprisonment, or both."
• A CPN, a "new credit identity," or an EIN in place of your SSN. § 1679b(a)(2) bans advising you to alter your identification to conceal information that is accurate and not obsolete. FTC settlements in this area have required defendants to notify their victims that "using a false identification number to apply for credit is a felony."
• "Credit sweep." No bulk-delete mechanism exists. In practice a sweep means mass identity theft reports filed to trigger the FCRA § 605B block, which a bureau may decline or rescind when the block came from "a material misrepresentation of fact." The FTC shut down an operation in March 2022 that it alleged filed false identity theft reports "usually without customers' knowledge."
• "The 609 letter loophole." FCRA § 609 is a disclosure right. See your file, see who pulled it. It is not a deletion tool, and no letter template converts it into one.
• Pay-per-delete pricing on items that are accurate, which prices an outcome nobody can deliver and takes a fee for it.
• Inquiry deletion, or authorized-user "tradelines," sold as a score plan. The FTC has pleaded both.
• Being told not to contact the bureaus yourself, or to dispute items you know are accurate. Both sit on the FTC's own list of scam markers.

Is a credit repair company ever licensed?

Not federally. There is no federal licensure regime for credit repair organizations. Nothing to hold, nothing to check, no register to search. Which makes "federally licensed" or a bare "licensed and bonded" its own tell: a statement about services that § 1679b(a)(3) prohibits if it is untrue or misleading.

States are the real layer, and they vary. New York regulates credit services businesses under General Business Law article 28-BB, § 458-b, with registration and bonding obligations attached. So the useful question is not "are you licensed." It is: which state registers you, under what statute, and what is your number there? A real operator answers that in one sentence.

What does a legitimate one sound like?

Flatter than you want it to. Boring is the tell.

The verbs point at accuracy, not existence. Fees are described as billed only after services are performed, never upfront, per CROA. And somewhere on the page there is a refusal in writing: "no deletion or score outcome is guaranteed, results vary by file." A firm willing to write down what it cannot do has told you more than one that lists everything it can.

They will also tell you what is free, because most of it is. Dispute directly with any bureau at no cost. Pull all three reports weekly at AnnualCreditReport.com. Freeze free at each bureau. A firm that hides the free path is selling you access to it.

One last thing, since most people land on a page like this the week after a decline. What a lender owes you after a "no" depends on which application you filed. Consumer and business applications sit under different rules, and business applications are split into tiers that differ on timing, on whether reasons come automatically or only on a written request, and on how long the file is kept. If yours was a business decline, ask before you assume you are owed a written list of reasons. It is worth getting right, because the reasons are the map.