The FCRA Statute of Limitations: Two Years From Discovery, Five-Year Absolute Limit

The FCRA’s civil limitations period is set out in a single provision: 15 U.S.C. § 1681p. A consumer must file suit within the earlier of two years after discovering the violation or five years after the violation occurred. Both clocks begin running at the moment the violation takes place. Discovery triggers the two-year window; the five-year backstop runs independently, regardless of whether the consumer ever learns about the problem. Neither window can be stretched by waiting longer to consult a lawyer, and the remedies at stake—statutory damages up to $1,000 per willful violation, actual damages, and attorney fees under 15 U.S.C. §§ 1681n and 1681o—become unavailable once either deadline passes.

The Two-Clock Structure of § 1681p

Section 1681p reads that a lawsuit must be brought “not later than the earlier of” two enumerated dates: the two-year discovery date, or the five-year occurrence date.

Running both clocks simultaneously is what makes the provision distinctive. Most limitations statutes pick one trigger—the date of the act, or the date of discovery. The FCRA uses both, with a rule that whichever expires first wins.

A concrete example makes the mechanics clear.

• Violation date: January 1, 2021 (Equifax publishes a collection account you don’t owe)
• Discovery date: March 1, 2022 (you pull your report and see it)
• Clock 1 deadline: March 1, 2024 (two years from discovery)
• Clock 2 deadline: January 1, 2026 (five years from occurrence)
• Operative deadline: March 1, 2024 — the earlier date controls

Now shift the discovery date later. If you don’t pull your report until February 1, 2026 — almost five years after the violation — Clock 2 has already expired before Clock 1 even starts. The five-year backstop has foreclosed the claim entirely.

This structure was codified by the Fair and Accurate Credit Transactions Act of 2003, which added the discovery language that § 1681p lacked when the Supreme Court construed it in TRW Inc. v. Andrews, 534 U.S. 19 (2001). In TRW, the Court held the then-existing text provided no discovery exception. Congress responded directly: the current version of § 1681p is the result of that response.

What “Discovery” Means for FCRA Purposes

The statute uses the word “discovery” without defining it. Courts have generally applied an inquiry-notice standard: the clock starts when the plaintiff knew, or in the exercise of reasonable diligence should have known, of the facts constituting the violation.

Actual knowledge is not required. If a consumer receives an adverse action notice under § 1681m citing information on her credit report, courts have found that notice sufficient to start the limitations clock even if the consumer did not immediately obtain the full report. The adverse action notice is a red flag that a reasonable person would follow up on.

Similarly, a consumer who pulls his own credit report and sees an account he does not recognize has “discovered” the potential violation. The two-year window opens at that point — not when he later confirms the account is fraudulent or retains counsel.

Three points carry practical weight:

The violation must be discovered, not just any credit problem. Knowing you have bad credit is not the same as knowing a specific FCRA violation occurred. Discovery requires awareness of facts suggesting that a CRA or furnisher acted unlawfully — for example, that a debt was reported after a bankruptcy discharge, or that a disputed account was re-reported without the required investigation under § 1681s-2(b).

Willful concealment may toll the clock. A small number of courts have applied equitable tolling where a defendant actively concealed the violation. The doctrine is narrow: ordinary failure to know about a violation does not toll the period. But if a furnisher affirmatively misrepresented that it had corrected an error when it had not, equitable tolling arguments become available.

The clock runs from discovery of the violation, not discovery of all damages. A consumer who learns of an inaccurate entry in Year 1 but does not experience a loan denial until Year 3 cannot use the Year 3 harm to restart the limitations period. The two-year window opened at Year 1. Ongoing damages do not reopen it.

The Five-Year Backstop and What It Eliminates

The five-year outer limit is absolute in the sense that no discovery argument can overcome it. If more than five years have elapsed since the violation occurred, § 1681p bars the lawsuit — period.

This creates a structural problem for consumers whose credit files contain old errors they have no reason to know about. A fraudulent account opened in 2019 and never noticed until 2025 might generate violations by both the furnisher and the credit bureau. If the relevant violations under § 1681e(b) or § 1681s-2 occurred in 2019, the five-year clock may have already run by the time the consumer discovers the error.

The practical lesson: pulling your credit reports annually is not just good financial hygiene. Under the FCRA’s limitations structure, failing to check means you may lose the ability to sue even before you know a violation exists. Free annual reports are available through AnnualCreditReport.com under § 1681j.

The five-year window is also significant in cases involving identity theft or mixed-file errors, where the fraudulent or misattributed account may have been on the report for years before the consumer realizes what happened. In those situations, the outer limit can expire faster than the consumer expects.

Continuing Violations — Does Each New Report Reset the Clock?

One of the most contested issues in FCRA litigation is whether each subsequent furnishing of inaccurate information constitutes a new, independent violation — or whether the original erroneous entry is the only actionable event, with each re-reporting being merely a consequence of it.

The answer matters because if each reporting is a fresh violation, a consumer who discovers an old error today may have a live two-year window running from today’s credit report — even if the original reporting occurred more than five years ago.

The argument for the continuing-violation theory rests on § 1681s-2(b). That section imposes duties on furnishers after they receive notice of a dispute. If a consumer disputes an account and the furnisher continues to report the same inaccurate information without conducting a proper investigation, each subsequent report after the disputed investigation period may constitute a separate, new violation of § 1681s-2(b). The violation is not the original reporting — it is the failure to correct after notice.

Courts have not reached consensus. Some have accepted the continuing-violation theory in the § 1681s-2(b) context, finding that re-verification of inaccurate data after a dispute is a discrete act giving rise to its own limitations period. Others have rejected it, holding that the duty to investigate arises once and the clock runs from the completion of the deficient investigation.

Separately, § 1681e(b) imposes on consumer reporting agencies a duty to follow reasonable procedures to assure maximum possible accuracy. Each time a CRA generates a consumer report containing a known inaccuracy, there is an argument that it commits a new § 1681e(b) violation. Again, courts are divided on this theory.

The unsettled state of this doctrine means the answer depends heavily on which circuit the lawsuit is filed in, and on the specific facts — particularly whether a formal dispute preceded the re-reporting. This is not a question to resolve based on general research. It is a fact-specific legal judgment.

Willful vs. Negligent Violations: Same Deadline, Different Stakes at Trial

Section 1681p imposes one limitations period covering all civil claims under the FCRA. It does not distinguish between willful violations (§ 1681n) and negligent violations (§ 1681o). The same two-year/five-year structure applies to both.

But the distinction between willful and negligent violations matters enormously for what a consumer can recover if she files in time.

Under § 1681n, a willful violation allows recovery of:

• Actual damages (no cap), or
• Statutory damages of $100 to $1,000 per violation (without proving actual harm), plus
• Punitive damages, plus
• Attorney fees and costs

Under § 1681o, a negligent violation allows recovery of:

• Actual damages only, plus
• Attorney fees and costs

Statutory damages under § 1681n are significant because they do not require the consumer to prove that the credit error caused measurable economic harm. A consumer who was denied nothing, lost no job, and paid no higher interest rate can still recover per-violation damages if the CRA or furnisher acted willfully — meaning it either knew its conduct violated the FCRA or acted in reckless disregard of the statute.

The Supreme Court defined “reckless disregard” in Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007): a company acts recklessly if it takes an action that runs “a risk of violating the law substantially greater than the risk associated with a reading that was merely careless.” A CRA that continues to report a disputed, demonstrably inaccurate account without re-investigating may cross the line from negligence into reckless disregard — converting a § 1681o claim into the more valuable § 1681n claim.

The limitations deadline does not change based on which theory applies. What changes is the recovery if the case proceeds on the merits.

The Dispute Process Is a Separate Track — It Does Not Pause the Clock

Filing a dispute with a consumer reporting agency under § 1681i does not toll or pause the statute of limitations. The two-year and five-year windows continue running while a dispute is pending.

This is a critical point many consumers misunderstand. The dispute process and the litigation process are parallel rights under different sections of the statute. Exercising one does not automatically preserve the other.

A consumer who spends eighteen months exchanging dispute letters with Equifax, waiting for the CRA to correct a clearly wrong entry, may inadvertently consume most of the two-year window. If the dispute fails and the consumer then wants to sue, she may have only six months remaining — or less, depending on when she first discovered the violation.

The better practice, explored in your rights under the FCRA, is to document the dispute and simultaneously evaluate the litigation timeline. Disputing is often a legal prerequisite to suing a furnisher under § 1681s-2(b) — direct-to-furnisher claims require prior notice through the CRA dispute system — but satisfying that prerequisite takes time that counts against the limitations clock.

There is no mechanism under the FCRA to toll the statute of limitations by agreement with the defendant. Any representation by a CRA or furnisher that “we are working on it” or “we will correct this” does not extend the filing deadline. Only a court order can do that, and courts grant such relief only in the narrowest circumstances.

The bottom line on timing: once you know an FCRA violation has occurred, measure your deadline from that date — not from the date the defendant finishes its internal review, not from the date you send a final demand letter, and not from the date you find a lawyer.