Can Someone Check Your CIBIL Score Without Permission?

A CIBIL score sounds like it should be private by default — and mostly, it is. But "mostly" is doing some work in that sentence, and understanding exactly where the line sits matters if you're worried about who can see your financial standing, or if you're trying to figure out whether someone has misused your identity.

What it actually takes to check someone's CIBIL score

A standard consumer CIBIL check requires your full name, date of birth, PAN number, registered mobile number, and an OTP sent to that phone — meaning a stranger with just your name or number can't pull your score directly. The OTP step is the real gatekeeper: without access to your phone, most legitimate check flows stop there.

Where this breaks down is when someone already has more than one piece of your identity — your PAN plus your date of birth is enough to attempt registration on some lending platforms, and a few smaller apps have historically been looser about OTP verification than the major bureaus.

The other side: lenders checking you without a full "consent" moment

Separately from the consumer-facing score check, banks and lenders can and do check your credit report when you apply for any loan, credit card, or even some utility connections — this is a hard inquiry, and it's baked into the terms you agree to when you submit that application, even if it doesn't feel like an explicit "check my CIBIL" moment. Multiple hard inquiries in a short window from lenders you don't recognize is itself a signal worth investigating — see the PAN misuse guide for what that pattern usually means.

How to see who's actually checked you

Your own credit report includes an inquiry history — a list of every hard inquiry made against your file, with the date and the requesting institution's name. This is the most direct way to answer "has anyone actually checked my score" for real: pull your report from CIBIL, Experian, Equifax, or CRIF High Mark and scan the inquiry section for anything you don't recognize.

• Inquiries from banks or NBFCs you have an account with: normal, usually tied to a renewal, top-up offer, or existing loan review.
• A single inquiry from an unfamiliar lender: could be a legitimate offer you don't remember engaging with — worth a quick call to confirm, not necessarily alarming on its own.
• Multiple inquiries from unfamiliar lenders in a short window: the pattern most consistent with someone attempting to use your identity for credit fraud.

If you find something you didn't authorize

Dispute it directly with the credit bureau showing the entry — this opens a formal investigation with the reporting institution, and incorrect entries can be corrected or removed. If the inquiry is tied to an actual loan or card that was issued, that's a stronger case and worth a written complaint to the lender plus a cybercrime report, since it indicates your PAN was actively used for fraud, not just checked.

Protecting your score from unauthorized checks

• Never share your PAN and date of birth together on unverified forms — that combination is most of what's needed to attempt many check flows.
• Keep your registered mobile number current with your bank and credit bureau, since OTPs are the main real-time barrier protecting your score.
• Review your credit report's inquiry section every few months as a habit, not just when something feels wrong.
• If you've had a documented case of PAN misuse elsewhere, treat your credit report as an ongoing thing to monitor, not a one-time check.

A credit report only shows the financial slice of your exposure — it won't tell you if your phone number or email is sitting in a breach dump or a data broker listing, which is often how PAN misuse starts in the first place. Scan My Shadow checks your phone number and email across 1,500+ sources for the fuller picture.

Related Reading

• PAN Card Misuse: How to Check and Protect Against Fraud in India — the identity-document side of this same risk.
• Identity Theft in India: Warning Signs and What to Do Next — the wider pattern this fits into.
• Re-Securing Your Identity After a Scam — includes credit-freeze guidance if things go further.
• How Do Data Brokers Actually Get Your Phone Number in India? — one of the common sources feeding this kind of fraud.