Plaintiff-appellant Deborah Northrop appeals from a ruling of the United States District Court for the District of Connecticut (Alfred V. Covello, Judge ), dismissing her complaint for failure to state a claim for relief under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (1994) ("FCRA" or the "Act"). For the reasons set forth below, we vacate the ruling of the district court and remand the case for further proceedings.

In reviewing the dismissal of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure for failure to state a claim upon which relief can be granted, we must accept as true the facts alleged in the complaint and draw all reasonable inferences in the plaintiff's favor. See McEvoy v. Spencer, 124 F.3d 92, 95 (2d Cir.1997). The facts alleged in plaintiff-appellant Northrop's Second Amended Complaint are as follows.

On or about September 25, 1995, Northrop was in the process of obtaining a mortgage to refinance her home through a company called Mortgage Master. As part of that process, Mortgage Master requested and received plaintiff's consumer credit report from United Data Services. That report indicated that on July 3, 1995, defendant-appellee Hoffman of Simsbury, Inc., d/b/a Hoffman Honda of Avon ("Hoffman"), had made an inquiry and received Northrop's consumer credit report. At the time that Hoffman requested plaintiff's credit report, Northrop was conducting no business with Hoffman of any kind.1

As a result of Hoffman's request for Northrop's consumer credit report, Mortgage Master demanded that Northrop explain the basis for the inquiry by Hoffman. On or about October 3, 1995, Northrop contacted Hoffman to find out who had requested her consumer credit report and the reason for that request, but was given no answer. On or about October 5, 1995, Northrop was told by a Hoffman employee that Hoffman's computerized records had been destroyed. Northrop's subsequent telephone calls to Hoffman have not been returned.

Plaintiff claims that these actions interfered with her efforts to obtain a mortgage and inflicted emotional distress. She brings this action based on alleged violations of the FCRA and the Connecticut Unfair Trade Practices Act, Conn.Gen.Stat. § 42-110a et seq., seeking actual and punitive damages, costs, and attorney's fees as well as equitable relief in the form of an injunction, enjoining all defendants from using or disclosing the contents of her credit report. The district court granted defendants' motion to dismiss2 in a ruling dated February 3, 1997, holding that plaintiff had not stated a claim upon which relief could be granted under the FCRA, and declining to exercise jurisdiction over the remaining state law claim. Plaintiff now appeals.

We review de novo the grant of a motion to dismiss under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. See Allen v. WestPoint-Pepperell, Inc., 945 F.2d 40, 44 (2d Cir.1991). The complaint may be dismissed only where " 'it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.' " Id. (quoting Conley v. Gibson, 355 U.S. 41, 45-46, 78 S. Ct. 99, 101-02, 2 L. Ed. 2d 80 (1957)).

Plaintiff-appellant's Second Amended Complaint claimed that defendants violated 15 U.S.C. §§ 1681b, c, and/or e,3 all of which are sections of the FCRA that impose obligations solely upon "consumer reporting agencies." Based on the defendants' alleged violations of the FCRA, appellant sought relief under § 1681n, which provides for a cause of action against "[a]ny consumer reporting agency or user of information which willfully fails to comply with any requirement imposed under [the FCRA]." (emphasis supplied).

The district court, in dismissing plaintiff-appellant's complaint, found that the defendants were not "consumer reporting agencies." Although the only sections specifically alleged in plaintiff-appellant's Second Amended Complaint to have been violated were sections relating to "consumer reporting agencies," the district court recognized that the FCRA also imposes liability upon "users of information." It found, however, that the only obligations placed upon "users" by the FCRA, and therefore the only basis for liability against them under § 1681n, are the disclosure obligations imposed by § 1681m "[w]henever credit ... is denied or the charge for such credit ... is increased." 15 U.S.C. § 1681m.4 Inasmuch as Northrop did not allege that defendants denied her credit or increased the charge for credit--the requirements necessary to trigger § 1681m--the court found that plaintiff failed to state a claim under the FCRA.

On appeal, appellant does not contest the conclusion that defendants are not "consumer reporting agencies," nor does she contest the fact that defendants did not deny her credit or increase the charge for credit. Rather, she argues that defendants can be held liable under § 1681n because they willfully violated the "requirement" imposed by § 1681q, a criminal provision of the FCRA that imposes penalties upon "[a]ny person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses." (emphasis supplied). While the district court indicated that users of information can be held liable under § 1681n solely for violating the disclosure obligations of § 1681m, which apply only when "credit ... is denied or the charge for such credit ... is increased," appellant argues that users of information may also be held civilly liable under § 1681n for violating § 1681q, which is incorporated into § 1681n. That is, appellant argues that § 1681q, prohibiting "any person" from procuring credit information under false pretenses, is among the FCRA "requirements" whose willful violation by users of information supports civil liability under § 1681n.5 We agree.

As a preliminary matter, we must decide whether appellant is foreclosed from seeking relief under § 1681n pursuant to a violation of § 1681q by her failure to cite § 1681q in her Second Amended Complaint. We recognize that appellant's failure to cite § 1681q as a potential basis for liability under § 1681n gave the district court little or no reason or opportunity to address this theory of liability. Nevertheless, appellant's failure to cite the correct section of the FCRA does not require us to affirm the dismissal of her complaint so long as she has alleged facts sufficient to support a meritorious legal claim. Under the liberal pleading principles established by Rule 8 of the Federal Rules of Civil Procedure, in ruling on a 12(b)(6) motion "[t]he failure in a complaint to cite a statute, or to cite the correct one, in no way affects the merits of a claim. Factual allegations alone are what matters." Albert v. Carovano, 851 F.2d 561, 571 n. 3 (2d Cir.1988) (in banc) (citing Newman v. Silver, 713 F.2d 14, 15 n. 1 (2d Cir.1983)); see also Flickinger v. Harold C. Brown & Co., 947 F.2d 595, 600 (2d Cir.1991) ("[Defendant] ... point[s] out that [plaintiff] failed to plead the third party beneficiary theory in his complaint. To this, we simply respond that federal pleading is by statement of claim, not by legal theory.").

Northrop's Second Amended Complaint did allege that defendants received her consumer credit report from a credit reporting agency while they were conducting no business with her of any kind, the natural implication of which is that they did so "under false pretenses."6 Indeed, the memorandum of law offered in support of one of the defendants' motions to dismiss evidences clear awareness of the substance of plaintiff's claim--even if the statutory basis of her complaint remained opaque--stating that "[t]he essence of Plaintiff's Second Amended Complaint" is "that Hoffman and Mr. Katzke improperly requested [her] consumer credit report from a consumer credit reporting agency." See Kelly v. Schmidberger, 806 F.2d 44, 46 (2d Cir.1986) ("The test of a complaint's sufficiency is whether it is detailed and informative enough to enable defendant to respond....") (internal quotation marks omitted). Accordingly, plaintiff's Second Amended Complaint is sufficient to survive a motion to dismiss so long as (1) § 1681n can, as a matter of law, support liability against users of information who violate § 1681q by procuring credit reports under false pretenses, and (2) defendants are "users of information" under § 1681n.

Defendants rely on DiGianni v. Stern's, 26 F.3d 346, 348 (2d Cir.1994) (per curiam), to argue that users of information may not be held liable merely for procuring credit reports under false pretenses, claiming that DiGianni prevents liability from being imposed upon users of information under § 1681n in situations other than where "credit ... is denied or the charge for such credit ... is increased," 15 U.S.C. § 1681m. We disagree with this reading of DiGianni, a case that did not address, and does not foreclose, the imposition of liability upon users of information under § 1681n based on violations of § 1681q.

In DiGianni, we held that the defendants in that case (department stores that had provided information to consumer reporting agencies regarding accounts that had been opened under plaintiff's social security number) were not "consumer reporting agencies," and therefore could not, under the particular circumstances of that case, be held liable under the FCRA. 26 F.3d at 348-49. We noted in passing, however, that the FCRA

also imposes certain obligations on "users" of consumer reports that deny credit or increase the charge for credit to consumers based on information contained in consumer reports issued by consumer reporting agencies, [15 U.S.C.] § 1681m....

While [plaintiff] suggests on appeal that [defendants] are liable under the FCRA as users, she does not allege that either of them denied credit or increased the charge for credit to her on the basis of information supplied by reporting agencies. Accordingly, the only remaining issue is whether the appellees can be held liable under the provisions of the FCRA governing consumer reporting agencies.

Id. at 348.

In stating that the defendants in that case could not be held liable as "users" because they had not denied credit to plaintiff or increased the charge for credit, DiGianni cited § 1681m and clearly considered only that section. This is understandable, inasmuch as this is the only provision of the FCRA that explicitly imposes specific obligations upon "users." However, neither § 1681m nor DiGianni (nor any other section of the FCRA, for that matter), define the term "user of information" under the Act. DiGianni did not restrict the definition of the term "user" to those situations governed by § 1681m--and therefore did not delimit the imposition of liability against "users" under § 1681n--but merely concluded that the defendants in that case did not fall within § 1681m. Not at issue in DiGianni, however, was § 1681q, a provision that imposes criminal liability upon "any person" who willfully obtains credit information under false pretenses. Inasmuch as there was no issue of any party procuring credit information under false pretenses in DiGianni, we had no reason to consider whether a "user of information" who violates § 1681q might be held liable under § 1681n. If in fact the "requirements" of the FCRA, the willful violation of which supports civil liability under § 1681n, include the requirement under § 1681q not to obtain credit information using false pretenses, then willful violation of this requirement also provides a basis for liability against "users of information."

While we have not previously had occasion to rule on the question whether § 1681q states a "requirement" under the FCRA supporting liability under § 1681n, a number of other circuits have addressed the issue, and all have agreed that a civil cause of action is available. See Yohay v. City of Alexandria Employees Credit Union, Inc., 827 F.2d 967, 971-72 (4th Cir.1987); Zamora v. Valley Fed. Sav. & Loan Ass'n, 811 F.2d 1368, 1370 (10th Cir.1987) (per curiam); Kennedy v. Border City Sav. & Loan Ass'n, 747 F.2d 367, 369 (6th Cir.1984); Hansen v. Morgan, 582 F.2d 1214, 1219 (9th Cir.1978); see also Boothe v. TRW Credit Data, 557 F. Supp. 66, 71 (S.D.N.Y.1982); Rice v. Montgomery Ward & Co., 450 F. Supp. 668, 671 (M.D.N.C.1978).7

We join the other Courts of Appeals that have ruled on the question in holding that § 1681n incorporates § 1681q. The plain language of § 1681n, imposing liability upon "user[s] of information which willfully fail[ ] to comply with any requirement imposed under [the FCRA]," appears on its face to encompass the "requirement" imposed by § 1681q not to obtain credit information under false pretenses. "Phrasing the 'requirement' as a thing prohibited or required not to be done rather than as an affirmative obligation does not deprive Section 1681q of its status as a requirement. Nor does imposition of criminal penalties for violation of Section 1681q rob it of its enforceability through Section 1681n." Kennedy, 747 F.2d at 369.8

Accordingly, assuming that defendants are "users of information" under § 1681n, Northrop's Second Amended Complaint, which suggests that defendants obtained her consumer credit report under false pretenses, does allege facts sufficient to state a claim upon which relief can be granted--namely, a claim for relief under § 1681n based on an alleged violation of § 1681q.

Under the terms of § 1681n, defendants may only be held liable if they are "users of information,"9 a term that is not defined by the FCRA. Although, as discussed above, DiGianni did not purport to limit this term to those who deny credit or increase the charge for credit,10 Northrop must still be able to prove that defendants are "users of information" under the Act in order to state a claim for relief under § 1681n.

Courts have not ventured to offer any overarching definition or understanding of "users of information" for purposes of the FCRA. Indeed, some courts, apparently not troubled by the possibility that "users of information" might have any particularly restrictive meaning under § 1681n, have approved the imposition of liability under § 1681n pursuant to violations of § 1681q without even pausing to consider whether the defendants in those cases were "users of information." See, e.g., Zamora, 811 F.2d at 1370-71; Kennedy, 747 F.2d at 368-69; Hansen, 582 F.2d at 1219-21.11 Inasmuch as Congress included the term "users of information" in § 1681n, it may not be glossed over or ignored, thereby rendering any defendant who violates § 1681q automatically subject to liability under § 1681n. Nonetheless, we find it unnecessary to offer a categorical definition of "users of information" in order to decide this appeal because we are persuaded that Hoffman clearly qualifies as a "user of information" and that Northrop should be given an opportunity to prove that the individual defendants also qualify.

Hoffman--an automobile dealership--is clearly a party that in the ordinary course of business would have occasion to request and receive credit reports from consumer reporting agencies for the permissible purposes described in § 1681b. It is therefore precisely the sort of party that would be expected to "use" credit reports under the Act. Presumably, it was by virtue of Hoffman's being in this position that the individual defendants were able to obtain plaintiff's credit report from a consumer reporting agency. Whatever other types of parties Congress had in mind when it included the term "users of information" in § 1681n, we are convinced that Hoffman--a prototypical "user" of credit reports--qualifies.

The situation of the individual defendants in this case is somewhat more complicated. Whether an employee may be held liable as a "user of information" under § 1681n for violating § 1681q depends on whether the employee impermissibly obtained credit information for personal purposes, or merely in the ordinary course of employment. See Austin v. BankAmerica Service Corp., 419 F. Supp. 730, 734 (N.D.Ga.1974) ("[T]he Fair Credit Reporting Act is inapplicable to these defendants who are merely employees of a 'user' of consumer credit reports...."); Yohay, 827 F.2d at 973 (distinguishing Austin, where the employees sued "had no independent interest in the reports they had obtained on behalf of their employer," and stating that "[t]o hold that an employee is shielded from liability under the FCRA when he uses the facilities of his employer to obtain a credit report for his own purposes would create a loophole in the statute which does not comport with the aims of the Congress in enacting the FCRA"); Wiggins v. Hitchens, 853 F. Supp. 505, 509 (D.D.C.1994) (comparing Austin and Yohay and finding that defendants "could only be considered 'users' under the Act if they were acting outside the scope of their employment."). In situations where one person obtains a credit report for the use of another, moreover, "the term 'user' includes 'the ultimate destination of a credit report' as well as 'the person who acquires [a credit report] for another.' " Yohay, 827 F.2d at 973 (quoting Boothe, 557 F. Supp. at 71); accord Rylewicz v. Beaton Services, Ltd., 698 F. Supp. 1391, 1400 (N.D.Ill.1988).

Accordingly, it may be possible for Northrop to prove that the individual defendants in this case qualify as "users," either because they had personal, non-employment-related reasons for obtaining her report, or because they requested others to obtain the report on their behalf.12 Although Northrop's complaint does not allege the purpose for which defendants obtained her report, we believe it would be premature, in light of the liberal pleading principles of Rule 8 of the Federal Rules of Civil Procedure, to dismiss the complaint prior to discovery, particularly inasmuch as the absence of any clear explanation why the defendants would have requested Northrop's report is the very basis for her claim that they obtained it under false pretenses.

With regard to defendants John Doe # 1 and John Doe # 2, we are aware that they are alleged in plaintiff's Second Amended Complaint to have requested plaintiff's credit report "in the performance of his or their duties as employees of Hoffman"--a fact that, if proven, will shield these defendants from liability. Nonetheless, the fact that a complaint alleges facts that constitute a defense to plaintiff's claim does not in all cases require dismissal of the complaint. See 5 Charles Alan Wright & Arthur R. Miller, Federal Practice & Procedure § 1226, at 209-10 (1990) ("The court, in its discretion, may allow the pleader to amend his complaint if it believes that the defense can be avoided.... Even if the defense is absolute on the face of the complaint, the court may decide that a motion for summary judgment, which provides an opportunity for an investigation of the facts surrounding the bare allegations in the pleading, is more appropriate and more productive in terms of reaching the merits than a motion to dismiss under Rule 12(b)(6)."). Accordingly, we leave it to the discretion of the district court on remand to determine what actions are appropriate regarding the claims against defendants John Doe # 1 and # 2.

For the reasons stated above, we vacate the district court's dismissal of Northrop's complaint, and remand the case to the district court for further proceedings consistent with this opinion.