A 31-year-old software engineer in Hyderabad pulled her free credit report last month, a quarterly habit she'd recently started. The score looked fine. The accounts looked fine. But on page three, under the "Enquiries" section, an entry stopped her cold.
"NBFC XYZ Finance · Personal Loan · 18 May 2026 · ₹4,80,000"
She had never applied for a personal loan. She had never heard of that NBFC. The date was three weeks ago. She hadn't received any OTP, missed-call alert, or KYC verification request in that window.
This is the moment the report is doing its job. An unknown enquiry on your credit report is one of the earliest, clearest warning signs of identity theft or unauthorised use of your KYC documents. It is also one of the most fixable- if you act in the first 30 days.
Here is the playbook.
What a credit enquiry actually is?
Every time a lender pulls your credit report to evaluate a loan or card application, it generates an "enquiry" entry on your bureau record. There are two kinds:
Hard enquiry. Triggered when you apply for credit. Visible to all future lenders. Each one slightly lowers your score (5-10 points typically) and stays on the report for 24 months.
Soft enquiry. Triggered when you check your own report, or when a lender does a pre-approval check. Not visible to other lenders. No score impact.
A loan application you never made will show up as a hard enquiry in your name. That's the signal you're looking at.
Why an unknown enquiry matters?
Three possible explanations, ranked by likelihood:
1. Identity theft using your KYC documents. Someone obtained your PAN, Aadhaar, or other ID and applied for a loan or card in your name.
2. A loan you forgot. Less likely if the amount and lender are unfamiliar, but worth ruling out.
3. A bureau error. Rare but real, the bureau's data feed sometimes mis-attributes another person's enquiry to your PAN.
Treat it as Option 1 until ruled out. The cost of over-reacting is 30 minutes of paperwork. The cost of under-reacting could be a loan in your name going to default.
The first hour- three actions
1. Pull all four credit reports. Under the Credit Information Companies (Regulation) Act, 2005, you have a right to one free report per year from each of CIBIL TransUnion, Experian, Equifax, and CRIF Highmark.
2. Note the exact details. Lender name, type of enquiry, date, amount, your reference number on the report. Screenshot the entry.
3. Lock your Aadhaar biometrics. Visit the UIDAI portal and enable the Aadhaar Biometric Lock. Free, 30 seconds, prevents further loan or account opening using your Aadhaar biometric.
Disputing the enquiry - the formal route
Log in at the bureau's website and find the "Raise a Dispute" section.
Reason: "Enquiry not authorised by me." Attach a written statement.
Submit. You'll get a dispute reference number. Save it.
Under the CIC Act, 2005, the bureau is required to investigate within 30 days. They contact the lender that made the enquiry. The lender must produce the application records.
If the lender cannot prove you authorised the enquiry, it is removed from your report. The score adjusts upward accordingly.
If it turns out to be identity theft
1. File at cybercrime.gov.in under financial fraud.
2. Call the National Cybercrime Helpline: 1930. Used for high-priority cases where money has already moved.
3. File a written FIR at your local police station. Mention the bureau dispute reference, the cybercrime portal acknowledgement, and the lender's name.
Protecting yourself going forward
Pull your credit report quarterly. Rotate across the four bureaus — one free report every three months.
Keep Aadhaar biometric locked by default. Unlock only when needed; re-lock immediately.
Avoid sharing KYC document copies casually. Use Aadhaar masking via mAadhaar where possible.
Enable transaction SMS alerts on your primary bank account.
The bottom line. An unknown credit enquiry is one of the earliest legitimate fraud signals you'll ever see. The dispute process under the CIC Act, 2005 is well-defined and free. Acting in the first 30 days resolves the entry quietly. Waiting six months turns it into a multi-year recovery from a defaulted loan in your name. Pull the report. Spot the entry. Dispute it the same week.
This article is for educational purposes only and does not constitute financial, legal, tax or investment advice. For credit-bureau disputes, work directly with the bureau under the Credit Information Companies (Regulation) Act, 2005. For suspected identity theft, file at cybercrime.gov.in and your local police station. Statutes and processes referenced are accurate as of June 2026.
A 31-year-old software engineer in Hyderabad pulled her free credit report last month, a quarterly habit she'd recently started. The score looked fine. The accounts looked fine. But on page three, under the "Enquiries" section, an entry stopped her cold.
"NBFC XYZ Finance · Personal Loan · 18 May 2026 · ₹4,80,000"
She had never applied for a personal loan. She had never heard of that NBFC. The date was three weeks ago. She hadn't received any OTP, missed-call alert, or KYC verification request in that window.
This is the moment the report is doing its job. An unknown enquiry on your credit report is one of the earliest, clearest warning signs of identity theft or unauthorised use of your KYC documents. It is also one of the most fixable- if you act in the first 30 days.
Here is the playbook.
What a credit enquiry actually is?
Every time a lender pulls your credit report to evaluate a loan or card application, it generates an "enquiry" entry on your bureau record. There are two kinds:
Hard enquiry. Triggered when you apply for credit. Visible to all future lenders. Each one slightly lowers your score (5-10 points typically) and stays on the report for 24 months.
Soft enquiry. Triggered when you check your own report, or when a lender does a pre-approval check. Not visible to other lenders. No score impact.
A loan application you never made will show up as a hard enquiry in your name. That's the signal you're looking at.
Why an unknown enquiry matters?
Three possible explanations, ranked by likelihood:
1. Identity theft using your KYC documents. Someone obtained your PAN, Aadhaar, or other ID and applied for a loan or card in your name.
2. A loan you forgot. Less likely if the amount and lender are unfamiliar, but worth ruling out.
3. A bureau error. Rare but real, the bureau's data feed sometimes mis-attributes another person's enquiry to your PAN.
Treat it as Option 1 until ruled out. The cost of over-reacting is 30 minutes of paperwork. The cost of under-reacting could be a loan in your name going to default.
The first hour- three actions
1. Pull all four credit reports. Under the Credit Information Companies (Regulation) Act, 2005, you have a right to one free report per year from each of CIBIL TransUnion, Experian, Equifax, and CRIF Highmark.
2. Note the exact details. Lender name, type of enquiry, date, amount, your reference number on the report. Screenshot the entry.
3. Lock your Aadhaar biometrics. Visit the UIDAI portal and enable the Aadhaar Biometric Lock. Free, 30 seconds, prevents further loan or account opening using your Aadhaar biometric.
Disputing the enquiry - the formal route
Log in at the bureau's website and find the "Raise a Dispute" section.
Reason: "Enquiry not authorised by me." Attach a written statement.
Submit. You'll get a dispute reference number. Save it.
Under the CIC Act, 2005, the bureau is required to investigate within 30 days. They contact the lender that made the enquiry. The lender must produce the application records.
If the lender cannot prove you authorised the enquiry, it is removed from your report. The score adjusts upward accordingly.
If it turns out to be identity theft
1. File at cybercrime.gov.in under financial fraud.
2. Call the National Cybercrime Helpline: 1930. Used for high-priority cases where money has already moved.
3. File a written FIR at your local police station. Mention the bureau dispute reference, the cybercrime portal acknowledgement, and the lender's name.
Protecting yourself going forward
Pull your credit report quarterly. Rotate across the four bureaus — one free report every three months.
Keep Aadhaar biometric locked by default. Unlock only when needed; re-lock immediately.
Avoid sharing KYC document copies casually. Use Aadhaar masking via mAadhaar where possible.
Enable transaction SMS alerts on your primary bank account.
The bottom line. An unknown credit enquiry is one of the earliest legitimate fraud signals you'll ever see. The dispute process under the CIC Act, 2005 is well-defined and free. Acting in the first 30 days resolves the entry quietly. Waiting six months turns it into a multi-year recovery from a defaulted loan in your name. Pull the report. Spot the entry. Dispute it the same week.
This article is for educational purposes only and does not constitute financial, legal, tax or investment advice. For credit-bureau disputes, work directly with the bureau under the Credit Information Companies (Regulation) Act, 2005. For suspected identity theft, file at cybercrime.gov.in and your local police station. Statutes and processes referenced are accurate as of June 2026.