Published July 18, 2026 · Educational information — not legal, tax, lending, or financial advice.
Quick answer
Hard inquiries generally require your authorization, so one from an application you never made can be removed: verify it’s truly unauthorized (many unfamiliar pulls have innocent explanations), contact the company that made it to ask what application it’s tied to, dispute it free with each bureau reporting it (investigations generally run about thirty days), and contain if it points to identity theft — freeze, fraud alert, and an identity theft report, which also unlocks a stronger blocking mechanism with the bureaus. The honest flip side: accurate inquiries from applications you did make can’t be removed early by you or by anyone you could pay — they age off on their own around two years.
What makes an inquiry “unauthorized”
Companies can’t pull your credit file on a whim — federal law limits access to permissible purposes, and for a hard inquiry tied to new credit, the trigger is an application you submitted. That’s the whole test: an inquiry is unauthorized when there’s no application of yours behind it. The distinction matters because it separates the two inquiry populations completely — entries backed by your authorization are accurate and stay; entries backed by nothing are errors or fraud and can go. (Soft inquiries — self-checks, monitoring scans, prequalification screening — live under different rules, don’t need your application, and never affect scores; the full split is in soft inquiry vs. hard inquiry.) Everything below is about hard inquiries that fail the authorization test.
Step 1: Verify it’s truly unauthorized
Most “mystery” inquiries dissolve under twenty minutes of investigation, and verifying first keeps you from disputing your own legitimate application. The usual suspects: companies often pull credit under corporate or parent-company names that don’t match their storefront brand (the store card that appears as the issuing bank); dealer- or retailer-arranged financing can generate pulls from lenders you never spoke to, all traceable to the day you sat in the finance office; and a joint application a spouse or co-applicant submitted includes you by design. Match each entry’s date and company name against your own activity — the inquiry section walkthrough in how to read your credit report shows exactly where these entries live and what the fields mean. What survives that check is what you escalate.
Step 2: Contact the company that pulled it
Before or alongside the bureau dispute, contact the company listed on the inquiry and ask one question: what application is this tied to? This step does double duty. If there’s an innocent explanation the name disguised, you’ll hear it now and save yourself a dispute. If there isn’t — if the company confirms an application was submitted in your name that you never made — you’ve just learned something urgent: ask them to close or cancel the application, flag it as fraudulent, and send written confirmation. Keep notes of the date, the representative, and what was said; that record strengthens the bureau dispute and, if things escalate, the identity theft report. Some companies will proactively ask the bureaus to delete an inquiry they confirm was fraudulent — welcome when it happens, but don’t rely on it; file your own dispute regardless.
Step 3: Dispute with each bureau reporting it
The removal mechanism itself is the standard federal dispute process — free, and no intermediary required. File with each bureau reporting the inquiry, not just one: the bureaus keep separate files and don’t share dispute outcomes, and an unauthorized pull may appear on one report, two, or all three. Identify the specific entry (company name and date), state that you never applied for credit with that company, and attach anything supporting — your notes from the source-company call, written confirmation if you have it. The bureau generally investigates within about thirty days and sends you the result. The mechanics mirror any other report correction — the broader playbook, including what to include and how to write a dispute that sticks, is in how to dispute an error on your credit report — and the Consumer Financial Protection Bureau’s credit reporting resources cover your dispute rights in plain language. If you need fresh copies of your reports to work from, AnnualCreditReport.com is the federally authorized source.
Step 4: If it points to fraud, contain and report
An unauthorized inquiry isn’t just a stray line — it means someone submitted a credit application in your name, and people who do that rarely stop at one attempt. So treat a confirmed unauthorized inquiry as a containment prompt. Review all three reports closely for accounts, addresses, or other entries you can’t explain — the field guide is in how to spot identity theft. Consider a credit freeze at all three bureaus, which blocks new accounts from being opened entirely (how to freeze your credit walks through it), and a fraud alert, which asks lenders to verify identity before extending credit — the differences and when to stack both are in fraud alert vs. credit freeze. If the trail points to identity theft, file a report at IdentityTheft.gov — it generates a recovery plan, and a qualifying identity theft report supports a stronger blocking request with the bureaus that covers fraudulent information, including inquiries tied to the fraud. And if an account was actually opened, the full recovery sequence is in what to do if someone opens an account in your name.
What happens after the dispute
Two outcomes. Removed: the bureau deletes the entry and sends updated results — confirm on fresh copies of all three reports that it’s actually gone everywhere it appeared, since a deletion at one bureau doesn’t touch the others. Expect the score effect of removal to be modest at most; inquiries are small factors, and the real win is an accurate file and the early warning you acted on. Verified: the bureau says the source confirmed the inquiry. That’s not the end of the road — go back to the source company for specifics on the application they claim exists, re-dispute with any new documentation, and if the evidence points to identity theft, the identity-theft-report route above carries more force than a repeat ordinary dispute. Throughout, keep the paper trail: dated copies of disputes, results, letters, and call notes are what make outcomes stick.
What can’t be removed (and the sweep-scam warning)
Now the honest boundary. Accurate hard inquiries — from applications you actually made — generally cannot be removed early, by you or by anyone else. Services advertising inquiry “sweeps” that promise to strip legitimate inquiries for a fee deserve real skepticism: disputing accurate information as fraudulent isn’t a loophole, and there’s rarely anything worth fixing anyway, because accurate inquiries age off on their own after about two years and typically stop influencing scores well before that — the two-clock mechanics are laid out in how long hard inquiries stay on your credit report. And if what’s really worrying you is the quantity of legitimate inquiries rather than a rogue one, that’s a different question with a calmer answer — covered in how many hard inquiries is too many.
Two real-world examples
The name that didn’t match. Tasha finds an inquiry from a finance company she’s never heard of and drafts a dispute on the spot. Step 1 saves her: the date matches the afternoon she opened a store card, and a two-minute search shows the finance company issues that retailer’s cards. The inquiry was hers all along, wearing a corporate name. No dispute filed — and no legitimate application flagged as fraud on her own file.
The application that wasn’t. Miguel’s monitoring alert flags a hard inquiry from an online lender he’s never used. The lender’s fraud line confirms an application in his name with an address he’s never lived at — they cancel it and flag it internally. He disputes the inquiry with the two bureaus showing it, freezes all three files the same day, and files at IdentityTheft.gov. The disputes come back deleted inside three weeks; a month of watching his reports turns up no further attempts. The freeze stays on — the inquiry was the early warning, and the containment is why it stayed the only warning.
Key takeaways
- Authorization is the test: no application of yours behind an inquiry means it can be disputed and removed.
- Verify first — corporate names, dealer networks, and joint applications explain most mystery entries.
- Dispute free with each bureau reporting it — separate files, separate disputes, roughly thirty days each.
- A confirmed unauthorized inquiry is a containment prompt: sweep all three reports, consider a freeze and fraud alert, report identity theft.
- Accurate inquiries can’t be swept away for a fee — they age off on their own and fade sooner.