How to check and fix your credit report

A credit report is a document a credit reporting body produces using information supplied by credit providers and other sources. It carries your identifying details, the credit accounts you hold or have held, how you have paid them, applications you have made, and certain public record information such as court judgments relating to credit and personal insolvency. A credit score is personal information derived from what is in the report — a number generated by the reporting body to indicate your eligibility for consumer credit. It is an output, not an input.

That distinction matters because it tells you where to aim. There is no mechanism in Australian privacy law to correct a score, because a score is a calculation. There is a very specific mechanism to correct the information the calculation runs on, and it is free. Every conversation about improving a credit position should therefore begin with the underlying entries and end with the number, never the other way around.

Australia has more than one credit reporting body, and they do not hold identical files. Credit providers choose which bodies they report to and subscribe with, so an account, a default or an enquiry can appear with one body and not another. The OAIC's own guidance is explicit that because different bodies may hold different information about you, it is worth requesting a report from each. A file that looks clean at one bureau is not evidence of a clean file anywhere else.

The landscape shifted recently. Equifax and Experian are the two consumer credit reporting bodies the OAIC lists with contact details on its access page, while its fraud guidance still names Equifax, Experian and illion as the three you can apply to for a report or a credit ban. In practice, illion's consumer site now redirects to Experian, and Experian's consumer page states plainly that illion is now part of Experian and that you may have been redirected there from the illion website.

None of that removes your entitlement. A credit reporting body is defined by what it does — handling personal information in order to tell another organisation about your creditworthiness — rather than by its brand, and the access and correction rights attach to the body holding the file. If you have an older default or enquiry that was only ever reported to illion, the sensible course is to ask Experian's consumer service for it by name and see what comes back, rather than assuming the record has evaporated with the website.

Checking your own report does not damage it. Experian states directly that requesting your own credit report does not affect your credit score, and a request you make yourself is not recorded as a credit enquiry the way a lender's application check is. This is the single most common reason people avoid looking, and it is wrong.

The entitlement is statutory and it is not a trial. You may obtain your consumer credit report from a credit reporting body free of charge once every three months, and additionally at no charge if you have been refused credit in the last 90 days or if credit information about you has been corrected. Outside those triggers a body may charge a fee, but the OAIC's guidance is that the fee must not be excessive. If a page you are on is asking for card details up front, you are on the wrong page.

Equifax states the eligibility in almost the same words on its own consumer page: you qualify for a free report if you have been declined credit in the last 90 days, have had an item corrected on your Equifax report, or once every three months. Orders are placed online through its consumer portal, other request channels are available if you cannot order online, and you must be 18 or over. Its personal enquiries line is 13 8332, selecting option 2.

Experian offers a free report every three months, or sooner if you have been declined credit or have had incorrect information on your report updated. Requests go through its CreditConnect service, identity is verified with a short set of questions, and most people receive the report immediately after verification. Where somebody is requesting on your behalf, Experian asks for 100 points of identification and a signed authority to act.

Order all of them on the same day and read them side by side. The comparison is where errors surface: an account that appears with one body and not another, an enquiry logged twice, a default recorded at different amounts or different dates in different files. A single report tells you what one bureau believes. Two reports tell you where somebody has made a mistake.

You do not have to do this alone. The Privacy Act framework recognises an access seeker — a person who assists you in dealing with a credit provider or credit reporting body with your consent, and the OAIC gives community lawyers and financial counsellors as the examples. An access seeker can request a correction on your behalf where you have experienced domestic violence, fraud or identity theft, on your written authorisation. Free financial counsellors are available nationally through the National Debt Helpline on 1800 007 007.

Save the reports as files, with the date. A correction dispute is an evidentiary exercise, and the version of the report that showed the error is the document you will be asked for three months later when the body says it cannot see the problem. Keep the reference numbers too.

Identification information comes first: full name, date of birth, sex, current and previous addresses, employer, and driver licence number. This is the part people skim, and it is where a surprising share of the damage begins, because a wrong or outdated address is how someone else's account attaches itself to your file in the first place.

Consumer credit liability information records the accounts themselves — the names of your credit providers, the type of credit, the credit limit, and certain terms about repayment and interest. Repayment history information sits alongside it, recording whether each consumer credit payment was made on time or missed. Credit providers report repayment history on a numeric scale indicating how many months have passed since the oldest missed payment, and a payment counts as missed if it was made more than 14 days after the due date.

Defaults are the heavyweight entries. A default records that you were at least 60 days overdue on a payment of $150 or more, with a note added if you have since paid the amount recorded as in default. A serious credit infringement is a step beyond that — the recorded opinion of a credit provider that you have committed one — and it carries the longest retention period of anything on the file.

Credit enquiries record that a provider requested access to your report because you applied for credit, along with the type and amount sought. They are visible to the next lender, which is why a scatter of applications made in a short period reads badly even when every one of them was declined for an unrelated reason. Court judgments relating to credit and information from the National Personal Insolvency Index about bankruptcy and debt agreements also appear.

Financial hardship information is the newest category and the most misunderstood. It is reported against your repayment history to show that you received hardship assistance, and it has the shortest life of any entry on the file. It is not a default and does not say you failed to pay; it says an arrangement was in place.

Retention periods are fixed by law rather than negotiated, and the practical consequence is that most credit problems have an expiry date. Knowing the date matters, because it changes the answer to whether a correction fight is worth having. A default with four years left on it is worth every hour you can spend on it. One with four months left rarely is.

Identity mix-ups are the most common and the most damaging. Two people with the same or similar name, or an address you left years ago that a provider never updated, produce a file with somebody else's account on it. Read the identification block first and challenge anything that is not yours, including former addresses you have never lived at and employers you have never worked for, because those are the hooks a wrong account hangs on.

Duplicate listings are next. The same debt can appear twice when an account is sold to a debt buyer and both the original provider and the purchaser list it, or when a provider re-lists a default after a transfer. One debt is entitled to one default listing. Two listings for the same underlying obligation overstate your exposure to every lender who reads the file.

Paid defaults that still show as unpaid are a distinct and easily fixed error. A default that has been paid is not removed, but the report must show that the amount recorded as in default has since been paid. If you settled a debt and the entry still reads as outstanding, the correction you are asking for is a status change, not a deletion, and it is usually granted quickly because the provider's own ledger proves it.

Telco and utility defaults surprise people more than bank defaults do, because a mobile plan does not feel like credit. It is, and telecommunications and energy providers list defaults in the same way lenders do. A disputed final bill from a service you cancelled two years ago is one of the most frequent sources of a default nobody knew about until a mortgage broker mentioned it.

Hardship entries recorded as missed payments are a modern error worth checking specifically. Where you had an arrangement in place, the repayment history should reflect that hardship assistance was provided rather than a bare missed payment, and a credit provider is restricted in listing a default while a hardship request is being considered. If the file shows plain arrears across the exact months an arrangement was running, that is a correction request with a strong factual basis.

Finally, enquiries you did not make. Every credit enquiry on the file should correspond to an application you actually submitted. One that does not is either an administrative error or the first visible sign of identity fraud, and the response to the second possibility is a credit ban, not a correction request. Treat an unexplained enquiry as urgent until you have ruled fraud out.

Decide who to ask, then stop worrying about it. The OAIC's guidance is that contacting the credit provider that supplied the disputed information is usually the most efficient route, but that it does not ultimately matter which entity you approach first: if the one you contact cannot deal with the request itself, it is required to consult the other credit providers or credit reporting bodies needed to complete it. This is the no-wrong-door rule, and it is the reason you should never accept being told to go somewhere else and start again.

Put the request in writing and make it specific. Name the entry, the account number, the date, and the amount as it appears on the report. State what is wrong with it and what the correct position is. Attach the evidence — the statement showing the payment, the letter you never received, the final bill you disputed at the time, the police report if there is fraud involved. Attach the dated copy of the report showing the entry as it stands.

The clock is 30 days. Where the entity is satisfied the information is incorrect, it must take reasonable steps to correct it within 30 days of the request, or within a longer period you have agreed to. There is no charge for a correction, and none may be imposed for making the request. If a business tells you a correction takes months as a matter of course, that is not the standard the law sets.

A correction is not just an internal edit. The entity must give you written notice that the correction has been made, and must also notify the parties it previously disclosed the information to, within a reasonable period. That downstream notification is the part that matters commercially, because it is what stops a lender who pulled your file last month from continuing to act on the old version.

If they disagree with you, they must say so in writing with reasons, and must tell you that you can access an external dispute resolution scheme or make a complaint. A refusal that arrives as a phone call and nothing else is itself a departure from the process, and asking for the written reasons is the correct next move rather than escalating immediately.

Verify the outcome yourself. Request a fresh copy of the report and confirm the entry has actually changed — and remember that a correction is one of the triggers for an additional free copy, so checking your own work costs nothing. Corrections have been known to be recorded at one credit reporting body and not the others, which is exactly why you ordered all of the reports at the start.

A default is not a free-form entry. Before a credit provider may disclose one to a credit reporting body, all of the following must be true: the overdue amount is $150 or more; the payment has been overdue for at least 60 days; a written notice was sent to your last known address about the overdue payment; a second written notice was sent at least 30 days after the first, stating an intention to disclose the information to a credit reporting body; and at least 14 days have passed since that second notice. The provider also cannot list the default more than three months after the second notice.

That sequence is a checklist, and each line in it is a potential ground. The most productive question you can put to a credit provider is not whether you owed the money but whether it can produce both notices, dated, and sent to the address it held for you. Providers frequently cannot, particularly where the account was old, the address had changed, or the debt was transferred between systems midway through the process.

The other grounds are factual rather than procedural. Wrong amount: the default was listed for a figure that includes fees or interest that were never validly charged, or the balance had already been reduced. Wrong person: the account is not yours at all. Listed too early: the 60-day and 14-day conditions were not met when the listing was made. Listed below threshold: the overdue amount was under $150. Any one of these makes the listing invalid rather than merely unfair.

Hardship gives you a further protection that is often overlooked. Where you have asked a credit provider for hardship assistance, it must not list a default while it is considering the request, or until 14 days after it has told you it refused the request — although it may proceed if it believes you are repeating a request made in the previous four months. A default listed in the window between a hardship request and a decision is a listing made in breach of that restriction.

Repayment history is a different animal and needs to be argued differently. A credit provider is not required to send you any written notice before recording a missed payment, so there is no notice-based ground available. The workable arguments are that the payment was in fact made within 14 days of the due date, that the due date itself is wrong, or that a hardship arrangement was in place and should have been reported as financial hardship information rather than as bare arrears.

What will not work is asking for a correct default to be deleted because you have since paid it, because it is embarrassing, or because it is blocking a loan. Paying a default changes its status on the report to show the amount has been paid; it does not remove it, and the five-year period runs regardless. Anyone promising otherwise for a fee is selling something the law does not permit.

The first escalation is a formal complaint to the credit provider or credit reporting body itself, and it comes with its own timetable. The entity must acknowledge your complaint within seven days and give you a decision within 30 days. If it needs longer, it must tell you before the 30 days are up and ask you to agree to an extension for a reasonable period. An extension you were not asked about is not an extension.

If that produces nothing useful, the next door is external dispute resolution, and it is free. A credit provider that accesses the credit reporting system must be a member of an external dispute resolution scheme recognised by the OAIC. For banks, lenders, finance companies and debt buyers that scheme is the Australian Financial Complaints Authority. For a phone or internet provider it is the Telecommunications Industry Ombudsman, on 1800 062 058. Check the entity's website or ask it directly which scheme it belongs to, because taking the complaint to the wrong ombudsman costs weeks.

This split matters more than it sounds. Telco and utility defaults are among the most common on Australian credit files and they do not go to AFCA. A great many people spend a month lodging with the financial ombudsman for a mobile account default before being redirected, and the deadline for the OAIC route keeps running while they do it.

The regulator itself is the third door. You can complain to the OAIC if you are unhappy with the outcome of external dispute resolution, or if you would rather deal with the regulator directly. The complaint must be in writing — the OAIC states plainly that it cannot take a credit reporting complaint over the phone — and you are expected to have raised the matter with the organisation first.

There is a hard time limit and it is the reason otherwise sound complaints fail. The OAIC may decide not to investigate a complaint made more than 12 months after you became aware of the act or practice you are complaining about. Twelve months is not long once you account for a 30-day internal process and an ombudsman queue, so the safe approach is to lodge on time and refine the detail afterwards.

Keep the two systems straight in your head. The ombudsman schemes are there to resolve your individual dispute and can direct a firm to fix a listing and compensate you for loss. The OAIC regulates compliance with the Privacy Act and the credit reporting rules across the system. Both are free, neither needs a lawyer, and using one does not stop you from using the other in sequence.

If you believe you have been or may be a victim of fraud, ask for a ban. During a ban period a credit reporting body must not use or disclose your consumer credit report, which in practice means a lender cannot run the check that would let an application in your name proceed. It costs nothing, and it is available whether or not you can yet prove the fraud happened.

The initial ban runs for 21 days from the day you make the request. Before it expires the credit reporting body must tell you, at least five business days beforehand, about your options for extending it. If you still have concerns, ask for an extension before the ban ends: the body must extend it where it believes you have been or are likely to be a victim of fraud, and there is no limit on the number of extensions you can request.

You do not have to make three separate calls. You can apply online with Equifax, Experian or illion, or ask one body to forward your application to the others. Understand the trade-off before you place one, though: during a ban, providers that request your report are notified that a ban is in place, which alerts them to possible fraud but can also complicate a legitimate application, because the provider may come back to you for additional identity information directly.

Be clear about who can see the file at all. A credit reporting body may only give your consumer credit report to another credit reporting body, a credit provider, a mortgage insurer, a trade insurer, or a debt collector acting as an agent for a credit provider, and only for permitted purposes such as assessing a credit application, collecting overdue payments, assessing a guarantee with your consent, or investigating a suspected serious credit infringement. Real estate agents, landlords, employers and ordinary insurers are not entitled to it — so a property manager who says your rental application failed on your credit report has told you something they were not entitled to obtain. Tenancy databases are a separate system under state and territory residential tenancies law, not the same file.

Business and sole-trader credit sits outside these rules as well. Commercial credit is credit applied for other than for personal, household or family purposes, and the specialised credit reporting protections in Part IIIA do not extend to it. Commercial credit information is instead governed by the Australian Privacy Principles where the organisation handling it is bound by them, which still gives you a right to ask for access and to have inaccurate, out-of-date, incomplete or misleading information corrected — but not the 30-day credit reporting correction machinery.

Every right described on this page is free. The report is free, the correction is free, the internal complaint is free, the ombudsman is free and the regulator is free. A credit repair or debt management firm charging a fee is charging you to write letters you could write yourself, using the same statutory process and with no additional powers of any kind. CreditSmart, run by the Australian Retail Credit Association, carries an explicit warning to beware of credit repair companies, and it is an industry body rather than a consumer advocate saying it. Because a share of files contain a genuine error, a firm can charge every client, obtain a handful of corrections that would have happened anyway, and present that as a service.

Watch for the specific claims that cannot be true. Nobody can remove a correctly listed default, shorten a statutory retention period, delete a credit enquiry you actually made, or negotiate a credit score directly, because a score is a calculation over the underlying data rather than an entry that can be edited. A promise phrased as clearing your name or wiping your file is a promise about the wrong object, and the fee is often payable in instalments that themselves risk becoming a debt.

The free alternative is not a lesser version. Financial counsellors are free, independent and not-for-profit, and the National Debt Helpline reaches them nationally on 1800 007 007 — its own site carries sections on getting and fixing a credit report. Community lawyers do the same work with the added ability to advise on the underlying debt, and both qualify as access seekers who can deal with providers and reporting bodies on your behalf with your consent. Where identity theft is involved, IDCARE provides free case management for the wider clean-up alongside the ban. Then build the habit that prevents a repeat: order a report from each body every few months, read the identification block as carefully as the accounts, and ask for hardship assistance in writing before a payment goes past 60 days.