1. What counts as excess?

Hard inquiry vs Soft inquiry:

• Soft = you checking own report, or lender doing pre-approved offer - no score impact
• Hard = lender evaluating your application for credit - stays 24 months, impacts score for 12 months. Multiple hard pulls in 45 days for same product should be deduplicated, but lenders often don't deduplicate.

Excess happens in 3 forms:

1. No application at all - You never applied, but lender/DSA pulls to check eligibility or for cross-sell.
2. One application, many pulls - You apply once, dealer or aggregator sends your file to 8-10 banks, each does a hard pull. Auto-loan case is classic.
3. Post-closure pulls - Loan closed, foreclosed, settled, but lender keeps pulling monthly as account review.

All three damage score. Number of inquiries is a risk factor - 5-6 hard inquiries in 6 months can drop CIBIL by 20-30 points and trigger auto-decline.

2. Legal Framework

India - CICRA 2005 + RBI Directions:
Under Section 17 of Credit Information Companies (Regulation) Act, 2005, credit information can be collected/disclosed only for specified purposes. RBI Master Direction on CICs says:

• Credit institution must have consent for enquiry - explicit consent at application stage.
• Section 22: Specified user must have permissible purpose - consideration for granting credit, periodic review of existing credit, collection of dues.
• Unauthorized access is violation of Privacy Principle 4.8 of CICR Act - "Unauthorized access to Credit Information".
• CIC and credit institution must follow rules under CICRA 2005 and RBI directives.

In September 2026, RBI fined TransUnion CIBIL Rs 26.8 lakh, CRIF High Mark Rs 6.8 lakh, Equifax Rs 1.19 lakh for failing to credit compensation to eligible complainants - showing active enforcement.

US - FCRA 15 U.S.C. § 1681b:
Lender can obtain report only for permissible purpose listed in statute - e.g., with consumer's written instruction, or in connection with credit transaction involving consumer. Companies cannot simply pull your report without permission. Unauthorized access is violation, $100-$1000 per violation plus actual and punitive damages.

3. Case Laws

A. India:

Citi Financial Consumer Finance Ltd. vs Consumer Forum, Chandigarh: Finance company penalized by Consumer Forum for intimating CIBIL about loan as written off despite settlement. Forum held act amounts to deficiency in service. Company directed to pay Rs 30,000 compensation + Rs 10,000 litigation cost. Same principle applies to excess pulls - reporting without valid purpose = deficiency.

SBI Cards vs Chandigarh Consumer Commission - Wrongful CIBIL Reporting: District Commission held SBI Cards guilty of deficiency and unfair trade practice for reporting consumer as defaulter despite full settlement, directed removal from CIBIL and compensation.

Ernakulam Consumer Forum vs SBI Card (Retired Bank Officer case): Consumer enlisted as defaulter for no fault. Forum ordered Rs 1 lakh exemplary compensation.

Uttarakhand State Commission - Utkarsh Panwar vs Private Bank (2024-25): Incorrect default report via Flipkart Pay Later affected CIBIL. District forum dismissed, State Commission reversed, awarded Rs 50k compensation + 10k litigation.

Indian fora consistently hold that inaccurate or unauthorized reporting to CIC is deficiency under Consumer Protection Act, and compensation is payable.

B. US - Directly on Excess Pulls:

May v. Equifax Information Services, LLC, No. 5:24-cv-00089 (E.D. Ky. 2024): Plaintiffs alleged Rocket Mortgage violated 15 U.S.C. § 1681b by obtaining consumer report without permissible purpose. Complaint alleged 2018 foreclosure sale satisfied mortgage, but Rocket Mortgage nevertheless accessed credit reports between 2021-2022. Court held this was sufficient to support reasonable inference that reports were pulled without permissible purpose and denied motion to dismiss. Multiple pulls over Relevant Period Sept 2021-July 2022 alleged as several requests.

Long v. Bergstrom Victory Lane, Inc., No. 18-cv-688 (E.D. Wis. 2018): Auto financing application - consumer applied at dealer, dealer submitted credit to multiple lenders (shotgunning). Court examined interplay between different permissible purposes and limits of consumer control - heightened risk of lawsuits. Establishes that dealer's bulk submission beyond what consumer authorized can be challenged.

Marino v. Ocwen Servicing, LLC, 978 F.3d 669 (9th Cir. 2020): Divided panel held mortgage servicer had permissible purpose for pulling reports even after personal liability discharged in bankruptcy, to evaluate for loss mitigation. Shows exception - account review purpose survives if account relationship technically open.

CFPB Consent Order Dec 2023 - Credit Reporting Company: Company in business of compiling and reselling reports pulled 190,000 credit reports from third-party CRA for unauthorized purpose of compiling marketing presentations for lending institution clients. Company paid $8 Million for FCRA violations. CFPB held that pulling for marketing is NOT permissible.

4. How to Fight Excess Pulls

Step 1 - Proof: Get CIBIL/CIC report, highlight enquiry section with dates, count pulls per lender.

Step 2 - Dispute: File dispute under CICRA Section 21 with CIC - lender must certify correctness within 30 days. Unauthorized corrections without process not permitted.

Step 3 - Complaints: RBI Integrated Ombudsman Scheme 2021 - deficiency in service. If bank can't show signed application + consent + timestamp matching pull, it's unauthorized.

Damages you can claim:

• Deletion of unauthorized inquiry
• Compensation for credit score damage (Indian consumer fora awarding Rs 30k-1 lakh as seen above)
• In US, statutory damages $100-1000 per pull, actual damages, punitive, attorney fees.