A credit report should not be pulled before the customer applies for credit. You should be able to document the application. Following are a few pertinent comments from the FTC Commentary. If your lenders are going to pull a report before an application has been submitted, they should obtain written consent from the customer. (See the final comment below.)
An application by a consumer for credit gives rise to a permissible purpose to obtain a consumer report, regardless of form. When a consumer applies for credit, whether in person, by phone, by mail, or by electronic means, the creditor has a permissible purpose to obtain a consumer report on the applicant, and thus does not need specific authorization from the applicant.
In order for a creditor to have a permissible purpose to obtain a consumer report to review an account, it must have an existing credit account with the consumer and must use the consumer report solely to consider taking action with respect to the account (e.g., modifying the terms of an open end account).
A consumer’s written consent qualifies as an “instruction” that provides a permissible purpose under this section if it clearly authorizes the issuance of a consumer report on that consumer.109 For example, a consumer’s clear and specific written statement that “I authorize you to procure a consumer report on me” provides a permissible purpose under this section.