http://socalcreditdamage.com/articles/unauthorized_access_of/ said:
Examples of Permissible Purposes for Pulling Your Credit Report
There are very few: in response to a court order, in connection with an employment application and when a consumer actually applies for credit or insurance.
If you do not initiate the transaction, then a credit card company may only pull your credit report if they are making you a “firm offer of credit,” which is definitely quite a bit more than those endless letters from credit card companies telling us that we’ve been “Pre-Approved”, but we have to fill out an application anyway.
Persons or companies who pull your credit report must certify that they are pulling it for a permissible purpose. If a company pulls your credit report for a permissible purpose and then uses it for an impermissible purpose, then that company has violated your rights and the law. Companies may only pull and use your report for a permissible purpose.
In general, you need to pull your credit report and inquire into any credit entry for a credit card company, a finance company or an insurance company you do not recognize. It may well turn out that some company has pulled your credit report without your permission and without a permissible purpose.