Checking Your Credit Score Without Selling Your Inbox (2026 US Guide)

The word 'free' does a lot of work in this market. There is exactly one site the federal government requires to give you free access to your actual credit reports at no cost: AnnualCreditReport.com, created under the Fair Credit Reporting Act as amended by the Fair and Accurate Credit Transactions Act (FACTA). Everything else calling itself a free credit score service is a private business, and private businesses need revenue.

The revenue model for most of these sites is affiliate marketing and lead generation: they show you a soft-pull score (often a VantageScore rather than the FICO score a mortgage lender will actually use), and in exchange they collect your email, income range, and general credit tier, then sell or license access to that profile to card issuers and personal-loan companies who market products back to you.

None of this is illegal — the FTC has not banned free-score marketing sites, and many disclose the arrangement in their terms of service. But it means your email address is the asset being monetized, not a side effect of the service. Once you understand that, the decision about which inbox to give them becomes much simpler.

Congress created the free-report mandate through FACTA in 2003, and the FTC and CFPB jointly oversee the arrangement. AnnualCreditReport.com is the only authorized source — any other site claiming to be 'the official free credit report site' is not.

Note the distinction between a credit report and a credit score. AnnualCreditReport.com gives you the underlying report — the accounts, balances, and history the bureaus hold on you — not necessarily a numeric score for free in every version. Some lenders and card issuers separately provide your FICO score for free as a cardholder benefit, which is often a more useful number than an estimator score from a marketing site.

Because this is the account where your actual financial history lives, it should be tied to an email address you check regularly and can recover for years — not a disposable one.

• Use AnnualCreditReport.com directly by typing the URL — don't follow a search ad or email link claiming to be it.
• You're entitled to a free report from each of the three bureaus weekly under current policy.
• Your card issuer may already give you a free FICO score as a statement or app feature.
• Freezing or disputing anything later requires this account to still be reachable — use your permanent email.

Score-estimator sites almost universally use soft inquiries, which is one reason they can offer instant, repeatable results without any credit-score cost to you. That part of the free-score pitch is genuinely true.

The confusion sets in when a 'check your rate' button on a lead-gen site quietly becomes a real loan application, converting a soft pull into a hard one. Read the button copy carefully — 'see if you're prequalified' is normally a soft pull; 'submit application' is not.

Prescreening is explicitly authorized under the FCRA: bureaus may share limited consumer data with lenders for firm offers of credit, without it counting as a full credit check against you. It's a legal, longstanding part of how card issuers find customers.

OptOutPrescreen.gov, jointly operated by the nationwide CRAs, is the official mechanism to stop these offers. A phone or online request pauses offers for five years; a mailed, signed request makes the opt-out permanent.

Opting out of prescreened offers reduces junk mail and marketing email tied to your credit profile, but it does not stop the score-estimator sites themselves from emailing you if you already handed them your address directly — that requires unsubscribing from each one or, better, never giving them a permanent address in the first place.

This is the mechanical reason score-check sites ask for an email before showing you anything: the address is the delivery mechanism for the monetization that funds the free product. Some sites are transparent about partner sharing in their privacy policy; the FTC has taken enforcement action against companies that were not adequately transparent about this kind of data use, underscoring that consumers are often not told plainly enough.

The practical effect for you is a long tail of 'you're prequalified' emails that persist long after you've forgotten checking your score. Because the underlying business model depends on repeat contact, a single quiz can generate years of marketing mail.

This is precisely the scenario a disposable inbox is built for: you get the number you wanted, the marketing goes to an address you're not attached to, and you never have to manage an unsubscribe campaign against your real inbox.

• The score is the hook; your email address tied to a credit profile is the product.
• Marketing emails from these sites can persist for years after a single visit.
• A disposable address lets you get the estimator number without adopting the lead relationship.
• Never reuse the same disposable address across multiple score sites if you want to track which one is the noisiest — vary them.

These three tools are often marketed as interchangeable, but they carry different legal weight. A security freeze, made free nationwide under a 2018 federal law, is the strongest protection: it stops most new credit accounts from being opened in your name until you lift it. Fraud alerts, free and available for one year (seven years for confirmed identity theft victims), require lenders to verify your identity before extending credit but don't block access outright.

Credit locks are a bureau product, not a legal status — the terms of what they promise you are set by TransUnion, Equifax or Experian's own contract with you, not by the FCRA. That distinction matters if something goes wrong: a freeze gives you statutory rights, a lock gives you whatever the bureau's user agreement says.

Whichever you choose, the PIN or credentials to lift a freeze must go to an email address you will still control years from now — this is one of the clearest cases where a disposable inbox is the wrong tool, because losing access to that address could lock you out of your own freeze.

The CFPB supervises how Equifax, Experian and TransUnion handle consumer disputes and publishes guidance on the process. If a bureau doesn't resolve your dispute within the statutory window, or resolves it without a reasonable investigation, you can escalate a complaint directly to the CFPB.

Because dispute correspondence includes case numbers, investigation outcomes and sometimes requests for supporting documents, this is another category of mail you need a permanent, checked inbox for — missing a bureau's request for more information can result in the dispute being closed against you.

Keep dated copies of everything, including the dispute submission and any confirmation emails, in case you need to escalate to the CFPB or dispute the same error again later.

The 2017 Equifax breach, which exposed sensitive data for roughly 147 million Americans according to the FTC's own settlement announcement, created years of aftermath phishing that impersonated Equifax's own breach-notification and settlement-claim emails. That pattern — a real incident followed by a wave of copycat phishing — recurs after most major bureau or lender breaches.

The safest habit is to never click a link inside an unsolicited bureau email. Instead, open a browser, type the bureau's or AnnualCreditReport.com's known URL directly, and log in there to check for any real notice.

If you're testing a bureau's public tools, a marketing calculator, or comparing services before deciding which to trust, a disposable inbox limits your exposure to this kind of impersonation because you were never going to build a long-term relationship with that address anyway.

Most people use one inbox for everything, which is exactly what makes financial phishing effective — a bureau-impersonation email sits in the same inbox as your actual bureau correspondence, making them harder to tell apart. Separating the two tiers makes a fake email from 'Equifax' immediately suspicious the moment it lands somewhere it has no business being.

The permanent tier should include your AnnualCreditReport.com account, your login for each bureau's freeze/lock portal, and any lender or servicer relationship. The disposable tier is for anything that just wants an email address to show you a number or a rate.

• Permanent tier: AnnualCreditReport.com, bureau freeze/lock accounts, lenders, loan servicers.
• Disposable tier: score-estimator quizzes, rate-comparison tools, one-off calculators.
• Keep the two tiers in visually distinct inboxes so a phishing attempt in the wrong tier stands out immediately.
• Never let the disposable tier's address end up on a legal document, freeze PIN, or account recovery flow.

The dividing line is recoverability and consequence. If losing access to the inbox tomorrow would mean losing access to your money, your freeze status, or a legal dispute record, that mail belongs in your permanent inbox. If losing access would mean, at worst, missing a marketing email, a disposable address is fine — and often better, because it keeps that marketing contained.

Budgeting apps and financial-wellness trials sit in a gray zone: harmless for the free trial itself, but if you decide to actually link a bank account and keep using the service, migrate to your permanent email before you do, since account recovery and security notices for a linked financial app need a durable address.

IdentityTheft.gov, run by the FTC, generates a recovery plan tailored to what was exposed — Social Security number, card numbers, or account credentials — and provides prefilled letters for disputing fraudulent accounts. It is free and does not require creating a permanent account tied to the breached company.

Historically, large-scale breaches at credit bureaus and lenders are followed by a spike in phishing that mimics the breached company's own remediation emails, so treat any post-breach message urging you to 'verify your settlement claim' or 'confirm your free monitoring enrollment' with the same suspicion as an unsolicited offer.

If a breach notice offers free monitoring and you're only enrolling to claim the benefit rather than building a long-term relationship with the vendor, weigh whether a disposable address for the enrollment step (before any identity verification requiring document upload) reduces your exposure — but complete any identity-verification and claims process on your permanent address, since these often require correspondence months later.

The CFPB has noted that consumers frequently overestimate what paid monitoring adds beyond what's already free: AnnualCreditReport.com covers the reports, OptOutPrescreen.gov handles offer reduction, freezes and fraud alerts are free by law, and IdentityTheft.gov handles breach recovery. What paid services typically add is tri-bureau alert consolidation and a single dashboard.

If you do subscribe, that account belongs on your permanent-tier email, since alerts about new inquiries or accounts are exactly the kind of time-sensitive notice you can't afford to miss in a disposable inbox that may expire.

A simple staggered schedule — one bureau's report every four months, for instance — keeps you looking at fresh data year-round instead of pulling all three at once and then not looking again for a year. Combine this with a fixed calendar reminder rather than relying on breach news to prompt you.

• January: Pull your Equifax report via AnnualCreditReport.com and review for errors.
• Spring: Pull TransUnion; confirm your security freeze is still active if you use one.
• Summer: Renew or confirm your OptOutPrescreen.gov status if it's approaching five years.
• Fall: Pull Experian; review any new hard inquiries against loans or cards you actually opened.
• Anytime: File disputes the moment you spot an error rather than waiting for the next scheduled check.