Plaintiff-appellant Deborah Northrop appeals from a ruling of the United States District Court for the District of Connecticut (Alfred V. Covello, Judge), dismissing her complaint for failure to state a claim for relief under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (1994) (“FCRA” or the “Act”). For the reasons set forth below, we vacate the ruling of the district court and remand the ease for further proceedings.
I.
In reviewing the dismissal of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure for failure to state a claim upon which relief can be granted, we must accept as true the facts alleged in the complaint and draw all reasonable inferences in the plaintiff’s favor. See McEvoy v. Spencer, 124 F.3d 92, 95 (2d Cir.1997). The facts alleged in plaintiff-appellant Northrop’s Second Amended Complaint are as follows.
On or about September 25, 1995, Northrop was in the process of obtaining a mortgage to *44refinance her home through a company called Mortgage Master. As part of that process, Mortgage Master requested and received plaintiffs consumer credit report from United Data Services. That report indicated that on July 3,1995, defendant-appellee Hoffman of Simsbury, Inc., d/b/a Hoffman Honda of Avon (“Hoffman”), had made an inquiry and received Northrop’s consumer credit report. At the time that Hoffman requested plaintiff’s credit report, Northrop was conducting no business with Hoffman of any kind.1
As a result of Hoffman’s request for Northrop’s consumer credit report, Mortgage Master demanded that Northrop explain the basis for the inquiry by Hoffman. On or about October 3, 1995, Northrop contacted Hoffman to find out who had requested her consumer credit report and the reason for that request, but was given no answer. On or about October 5, 1995, Northrop was told by a Hoffman employee that Hoffman’s computerized records had been destroyed. Northrop’s subsequent telephone calls to Hoffman have not been returned.
Plaintiff claims that these actions interfered with her efforts to obtain a mortgage and inflicted emotional distress. She brings this action based on alleged violations of the FCRA and the Connecticut Unfair Trade Practices Act, Conn.Gen.Stat. § 42-110a et seq., seeking actual and punitive damages, costs, and attorney’s fees as well as equitable relief in the form of an injunction, enjoining all defendants from using or disclosing the contents of her credit report. The district court granted defendants’ motion to dismiss2 in a ruling dated February 8, 1997, holding that plaintiff had not stated a claim upon which relief could be granted under the FCRA, and declining to exercise jurisdiction over the remaining state law claim. Plaintiff now appeals.
II.
We review de novo the grant of a motion to dismiss under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. See Allen v. WestPoint-Pepperell, Inc., 945 F.2d 40, 44 (2d Cir.1991). The complaint may be dismissed only where “ ‘it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.’” Id. (quoting Conley v. Gibson, 355 U.S. 41, 45-46, 78 S.Ct. 99, 101-02, 2 L.Ed.2d 80 (1957)).
Plaintiff-appellant’s Second Amended Complaint claimed that defendants violated 15 U.S.C. §§ 1681b, c, and/or e,3 all of which are sections of the FCRA that impose obligations solely upon “consumer reporting agencies.” Based on the defendants’ alleged violations of the FCRA, appellant sought relief under § 1681n, which provides for a cause of action against “[a]ny consumer reporting agency or user of information which willfully fails to comply with any requirement *45imposed under [the FCRA].” (emphasis supplied).
The district court, in dismissing plaintiff-appellant’s complaint, found that the defendants were not “consumer reporting agencies.” Although the only sections specifically alleged in plaintiff-appellant’s Second Amended Complaint to have been violated were sections relating to “consumer reporting agencies,” the district court recognized that the FCRA also imposes liability upon “users of information.” It found, however, that the only obligations placed upon “users” by the FCRA, and therefore the only basis for liability against them under § 1681n, are the disclosure obligations imposed by § 1681m “[w]henever credit ... is denied or the charge for such credit ... is increased.” 15 U.S.C. § 1681m.4 Inasmuch as Northrop did not allege that defendants denied her credit or increased the charge for credit — the requirements necessary to trigger § 1681m — the court found that plaintiff failed to state a claim under the FCRA.
On appeal, appellant does not contest the conclusion that defendants are not “consumer reporting agencies,” nor does she contest the fact that defendants did not deny her credit or increase the charge for credit. Rather, she argues that defendants can be held liable under § 1681n because they willfully violated the “requirement” imposed by § 1681q, a criminal provision of the FCRA that imposes penalties upon “[a]ny person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses.” (emphasis supplied). While the district court indicated that users of information can be held liable under § 1681n solely for violating the disclosure obligations of § 1681m, which apply only when “credit ... is denied or the charge for such credit ... is increased,” appellant argues that users of information may also be held civilly liable under § 1681n for violating § 1681q, which is incorporated into § 1681n. That is, appellant argues that § 1681q, prohibiting “any person” from procuring credit information under false pretenses, is among the FCRA “requirements” whose willful violation by users of information supports civil liability under § 1681n.5 We agree.
III.
As a preliminary matter, we must decide whether appellant is foreclosed from seeking relief under § 1681n pursuant to a violation of § 1681q by her failure to cite § 1681q in her Second Amended Complaint. We recognize that appellant’s failure to cite § 1681q as a potential basis for liability under § 1681n gave the district court little or no reason or opportunity to address this theory of liability. Nevertheless, appellant’s failure to cite the correct section of the *46FCRA does not require us to affirm the dismissal of her complaint so long as she has alleged facts sufficient to support a meritorious legal claim. Under the liberal pleading principles established by Rule 8 of the Federal Rules of Civil Procedure, in ruling on a 12(b)(6) motion “[t]he failure in a complaint to cite a statute, or to cite the correct one, in no way affects the merits of a claim. Factual allegations alone are what matters.” Albert v. Carovano, 851 F.2d 561, 571 n. 3 (2d Cir.1988) (in banc) (citing Newman v. Silver, 713 F.2d 14, 15 n. 1 (2d Cir.1983)); see also Flickinger v. Harold C. Brown & Co., 947 F.2d 595, 600 (2d Cir.1991) (“[Defendant] ... point[s] out that [plaintiff] failed to plead the third party beneficiary theory in his complaint. To this, we simply respond that federal pleading is by statement of claim, not by legal theory.”).
Northrop’s Second Amended Complaint did allege that defendants received her consumer credit report from a credit reporting agency while they were conducting no business with her of any kind, the natural implication of which is that they did so “under false pretenses.”6 Indeed, the memorandum of law offered in support of one of the defendants’ motions to dismiss evidences clear awareness of the substance of plaintiffs claim — even if the statutory basis of her complaint remained opaque — stating that “[t]he essence of Plaintiff’s Second Amended Complaint” is “that Hoffman and Mr. Katzke improperly requested [her] consumer credit report from a consumer credit reporting agency.” See Kelly v. Schmidberger, 806 F.2d 44, 46 (2d Cir.1986) (“The test of a complaint’s sufficiency is whether it is detailed and informative enough to enable defendant to respond....”) (internal quotation marks omitted). Accordingly, plaintiff’s See-ond Amended Complaint is sufficient to survive a motion to dismiss so long as (1) § 1681n can, as a matter of law, support liability against users of information who violate § 1681q by procuring credit reports under false pretenses, and (2) defendants are “users of information” under § 1681n.
IV.
Defendants rely on DiGianni v. Stern’s, 26 F.3d 346, 348 (2d Cir.1994) (per curiam), to argue that users of information may not be held liable merely for procuring credit reports under false pretenses, claiming that DiGianni prevents liability from being imposed upon users of information under § 1681n in situations other than where “credit ... is denied or the charge for such credit ... is increased,” 15 U.S.C. § 1681m. We disagree with this reading of DiGianni, a case that did not address, and does not foreclose, the imposition of liability upon users of information under § 1681n based on violations of § 1681q.
In DiGianni, we held that the defendants in that case (department stores that had provided information to consumer reporting agencies regarding accounts that had been opened under plaintiff’s social security number) were not “consumer reporting agencies,” and therefore could not, under the particular circumstances of that case, be held liable under the FCRA. 26 F.3d at 348-49. We noted in passing, however, that the FCRA
also imposes certain obligations on “users” of consumer reports that deny credit or increase the charge for credit to consumers based on information contained in consumer reports issued by consumer reporting agencies, [15 U.S.C.] § 1681m_
*47While [plaintiff] suggests on appeal that [defendants] are liable under the FCRA as users, she does not allege that either of them denied credit or increased the charge for credit to her on the basis of information supplied by reporting agencies. Accordingly, the only remaining issue is whether the appellees can be held liable under the provisions of the FCRA governing consumer reporting agencies.
Id. at 348.
In stating that the defendants in that case could not be held liable as “users” because they had not denied credit to plaintiff or increased the charge for credit, DiGianni cited § 1681m and clearly considered only that section. This is understandable, inasmuch as this is the only provision of the FCRA that explicitly imposes specific obligations upon “users.” However, neither § 1681m nor DiGianni (nor any other section of the FCRA, for that matter), define the term “user of information” under the Act. DiGianni did not restrict the definition of the term “user” to those situations governed by § 1681m — and therefore did not delimit the imposition of liability against “users” under § 1681n — but merely concluded that the defendants in that case did not fall within § 1681m. Not at issue in DiGianni, however, was § 1681q, a provision that imposes criminal liability upon “any person” who willfully obtains credit information under false pretenses. Inasmuch as there was no issue of any party procuring credit information under false pretenses in DiGianni, we had no reason to consider whether a “user of information” who violates § 1681q might be held liable under § 1681n. If in fact the “requirements” of the FCRA, the willful violation of which supports civil liability under § 1681n, include the requirement under § 1681q not to obtain credit information using false pretenses, then willful violation of this requirement also provides a basis for liability against “users of information.”
While we have not previously had occasion to rule on the question whether § 1681q states a “requirement” under the FCRA supporting liability under § 1681n, a number of other circuits have addressed the issue, and all have agreed that a civil cause of action is available. See Yohay v. City of Alexandria Employees Credit Union, Inc., 827 F.2d 967, 971-72 (4th Cir.1987); Zamora v. Valley Fed. Sav. & Loan Ass’n, 811 F.2d 1368, 1370 (10th Cir.1987) (per curiam); Kennedy v. Border City Sav. & Loan Ass’n, 747 F.2d 367, 369 (6th Cir.1984); Hansen v. Morgan, 582 F.2d 1214, 1219 (9th Cir.1978); see also Boothe v. TRW Credit Data, 557 F.Supp. 66, 71 (S.D.N.Y.1982); Rice v. Montgomery Ward & Co., 450 F.Supp. 668, 671 (M.D.N.C.1978).7
We join the other Courts of Appeals that have ruled on the question in holding that § 1681n incorporates § 1681q. The plain language of § 1681n, imposing liability upon “user[s] of information which willfully fail[] to comply with any requirement imposed under [the FCRA],” appears on its face to encompass the “requirement” imposed by § 1681q not to obtain credit information under false pretenses. “Phrasing the ‘requirement’ as a thing prohibited or required not to be done rather than as an affirmative obligation does not deprive Section 1681q of its status as a requirement. Nor does imposition of criminal penalties for violation of Section 1681q rob it of its enforceability through Section 1681n.” Kennedy, 747 F.2d at 369.8
*48Accordingly, assuming that defendants are “users of information” under § 1681n, Northrop’s Second Amended Complaint, which suggests that defendants obtained her consumer credit report under false pretenses, does allege facts sufficient to state a claim upon which relief can be granted — namely, a claim for relief under § 1681n based on an alleged violation of § 1681q.
y.
Under the terms of § 1681n, defendants may only be held liable if they are “users of information,”9 a term that is not defined by the FCRA. Although, as discussed above, DiGianni did not purport to limit this term to those who deny credit or increase the charge for credit,10 Northrop must still be able to prove that defendants are “users of information” under the Act in order to state a claim for relief under § 1681n.
Courts have not ventured to offer any overarching definition or understanding of “users of information” for purposes of the FCRA. Indeed, some courts, apparently not troubled by the possibility that “users of information” might have any particularly restrictive meaning under § 1681n, have approved the imposition of liability under § 1681n pursuant to violations of § 1681q without even pausing to consider whether the defendants in those cases were “users of information.” See, e.g., Zamora, 811 F.2d at 1370-71; Kennedy, 747 F.2d at 368-69; Hansen, 582 F.2d at 1219-21.11 Inasmuch as Congress included the term “users of information” in § 1681n, it may not be glossed over or ignored, thereby rendering any defendant who violates § 1681q automatically *49subject to liability under § 1681n. Nonetheless, we find it unnecessary to offer a categorical definition of “users of information” in order to decide this appeal because we are persuaded that Hoffman clearly qualifies as a “user of information” and that Northrop should be given an opportunity to prove that the individual defendants also qualify.
Hoffman — an automobile dealership — is clearly a party that in the ordinary course of business would have occasion to request and receive credit reports from consumer reporting agencies for the permissible purposes described in § 1681b. It is therefore precisely the sort of party that would be expected to “use” credit reports under the Act. Presumably, it was by virtue of Hoffman’s being in this position that the individual defendants were able to obtain plaintiffs credit report from a consumer reporting agency. Whatever other types of parties Congress had in mind when it included the term “users of information” in § 1681n, we are convinced that Hoffman — a prototypical “user” of credit reports — qualifies.
The situation of the individual defendants in this case is somewhat more complicated. Whether an employee may be held hable as a “user of information” under § 1681n for violating § 1681q depends on whether the employee impermissibly obtained credit information for personal purposes, or merely in the ordinary course of employment. See Austin v. BankAmerica Service Corp., 419 F.Supp. 730, 734 (N.D.Ga.1974) (“[T]he Fair Credit Reporting Act is inapplicable to these defendants who are merely employees of a ‘user’ of consumer credit reports-”); Yohay, 827 F.2d at 973 (distinguishing Austin, where the employees sued “had no independent interest in the reports they had obtained on behalf of their employer,” and stating that “[t]o hold that an employee is shielded from liability under the FCRA when he uses the facilities of his employer to obtain a credit report for his own purposes would create a loophole in the statute which does not comport with the aims of the Congress in enacting the FCRA”); Wiggins v. Hitchens, 853 F.Supp. 505, 509 (D.D.C.1994) (comparing Austin and Yohay and finding that defendants “could only be considered ‘users’ under the Act if they were acting outside the scope of their employment.”). In situations where one person obtains a credit report for the use of another, moreover, “the term ‘user’ includes ‘the ultimate destination of a credit report’ as well as ‘the person who acquires [a credit report] for another.’ ” Yohay, 827 F.2d at 973 (quoting Boothe, 557 F.Supp. at 71); accord Rylewicz v. Beaton Services, Ltd., 698 F.Supp. 1391, 1400 (N.D.Ill.1988).
Accordingly, it may be possible for Northrop to prove that the individual defendants in this case qualify as “users,” either because they had personal, non-employment-related reasons for obtaining her report, or because they requested others to obtain the report on their behalf.12 Although Northrop’s complaint does not allege the purpose for which defendants obtained her report, we believe it would be premature, in light of the liberal pleading principles of Rule 8 of the Federal Rules of Civil Procedure, to dismiss the complaint prior to discovery, particularly inasmuch as the absence of any clear explanation why the defendants would have requested Northrop’s report is the very basis for her claim that they obtained it under false pretenses.
With regard to defendants John Doe # 1 and John Doe # 2, we are aware that they are alleged in plaintiffs Second Amended Complaint to have requested plaintiffs credit report “in the performance of his or their duties as employees of Hoffman” — a fact that, if proven, will shield these defendants from liability. Nonetheless, the fact that a eomplaint alleges facts that constitute a defense to plaintiffs claim does not in all cases require dismissal of the complaint. See 5 Charles Alan Wright & Arthur R. Miller, *50Federal Practice & Procedure § 1226, at 209-10 (1990) (“The court, in its discretion, may allow the pleader to amend his complaint if it believes that the defense can be avoided.... Even if the defense is absolute on the face of the complaint, the court may decide that a motion for summary judgment, which provides an opportunity for an investigation of the facts surrounding the bare allegations in the pleading, is more appropriate and more productive in terms of reaching the merits than a motion to dismiss under Rule 12(b)(6).”). Accordingly, we leave it to the discretion of the district court on remand to determine what actions are appropriate regarding the claims against defendants John Doe # 1 and # 2.
YI.
For the reasons stated above, we vacate the district court’s dismissal of Northrop’s complaint, and remand the ease to the district court for further proceedings consistent with this opinion.
. The other defendants in this case are implicated by the following facts, alleged in plaintiff’s complaint “on information and belief.” Defendants John Doe # 1 and/or John Doe # 2, in the performance of his or their duties as Hoffman employees, utilized Hoffman’s facilities to obtain plaintiff’s credit report. Defendant XYZ Corporation and/or its employee, defendant-appellee Larry F. Katzke, utilizing his position with XYZ Corporation, requested John Doe # 1 and/or John Doe # 2 to obtain the report. Defendant Richard Roe requested XYZ Corporation and/or Katzke, and/or John Doe # 1 and/or John Doe # 2, to utilize Hoffman’s facilities to obtain the report.
. Northrop claims on appeal that "the Motion to Dismiss was granted despite Defendant Katzke’s acknowledgement that, as material outside the pleadings was presented, the motion should have been treated as one for summary judgment.” It is true that “[i]n considering a motion to dismiss for failure to state a claim under Fed.R.Civ.P. 12(b)(6), a district court must limit itself to facts stated in the complaint or in documents attached to the complaint as exhibits or incorporated in the complaint by reference,” and that ”[i]f a district court wishes to consider additional material, Rule 12(b) requires it to treat the motion as one for summary judgment under Rule 56.” Kramer v. Time Warner Inc., 937 F.2d 767, 773 (2d Cir.1991). However, nothing in the district court’s ruling suggests that it looked beyond the four comers of the complaint.
.Elsewhere in her complaint Northrop refers generally to violations of "15 U.S.C. § 1681a et seq.,” but after the substance of her factual allegations are detailed, the only sections expressly asserted to have been violated are "§§ 1681b, c, and/or e.”
. Section 1681m was amended after the events giving rise to this case. The new version of this provision imposes disclosure obligations when a party takes an "adverse action” based on the receipt of credit information, rather than simply when it denies credit or increases the charge for credit. See Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2411, 110 Stat. 3009, *3009-443 to -446 (1996). This subsequent amendment (which is effective 365 days after Sept. 30, 1996, unless any person or entity complies with any provision before that date, see id. at § 2420, 110 Stat. at *3009-454) does not apply to the instant case. In any event, as discussed below, we do not believe that § 1681m governs this dispute, and therefore need not speculate as to what this amendment suggests regarding the original intent of § 1681m. Other amendments to § 1681m, as well as to § 1681n, are more directly relevant to this case and are described infra notes 5 and 9, although they likewise do not ultimately influence our analysis.
. As discussed supra, note 4, the FCRA was amended subsequent to the events in this case, which amended version does not govern the present dispute. The amended version of 15 U.S.C. § 1681n expressly recognizes a civil cause of action against a party for "obtaining a consumer report under false pretenses or knowingly without a permissible purpose." Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2412, 110 Stat. 3009, at *3009-446. This amendment appears to codify the interpretation of the pre-amended statute adopted in the cases cited below that found a civil cause of action to be available under § 168In based on the receipt of credit information under false pretenses. Inasmuch as we cannot be certain whether this amendment clarifies Congress’s original intent, or simply reflects Congress’s belief that such a civil cause of action should be available (whatever the pre-amended version may have intended), we do not allow the amendment to affect our interpretation of the pre-amendment statute.
. However mistaken the statutory basis (as opposed to the underlying claim) of her complaint, appellant may have intended to support her "false pretenses” argument by citing § 1681b, which lists the exclusive circumstances under which a consumer reporting agency may furnish a credit report. Other courts have in fact read the "false pretenses” prohibition of § 1681q in light of § 1681b. See, e.g., Hansen v. Morgan, 582 F.2d 1214, 1219-20 (9th Cir.1978) ("The standard for determining when a consumer report has been obtained under false pretenses will usually be defined in relation to the permissible purposes of consumer reports which are enumerated in 15 U.S.C. § 1681b_ [Ojbtaining a consumer report in violation of the terms of the statute without disclosing the immpermissible [sic] purpose for which the report is desired can constitute obtaining consumer information under false pretenses_”); accord Yohay v. City of Alexandria Employees Credit Union, Inc., 827 F.2d 967, 971-72 (4th Cir.1987). This makes it all the more clear that plaintiffs Second Amended Complaint was sufficient to state a claim that defendants obtained her credit report under false pretenses, in violation of § 1681q.
. Not before us is the question whether § 1681q states a "requirement” enforceable under § 1681o, which unlike § 1681n imposes liability for "negligent,” rather than "willful,” failure to comply with any of the "requirements” of the FCRA. We note that while some courts have assumed that § 1681 q is incorporated into § 1681o as well as § 1681n, see Yohay, 827 F.2d at 971-72; Hansen, 582 F.2d at 1219, the Sixth Circuit correctly points out that "[s]ince violation of Section 1681q occurs only when an individual acts knowingly and willfully. Section 168In rather than Section 1681o is the proper vehicle for civil liability for violations of Section 1681q." Kennedy, 747 F.2d at 368 n. 1.
. It should be understood that because a private right of action is expressly authorized by § 168 In, the issue here is not whether a private right of action should be "implied” from the criminal provision set forth in § 1681q. See Kennedy, 747 F.2d at 369; Rice, 450 F.Supp. at 671 n. 2. Further, although we deem § 1681n sufficiently clear to render any resort to legislative history unnecessary, we note that defendants have offered no evidence from the legislative *48history of the FCRA to suggest, contrary to the clear language of the Act, that Congress intended to exclude § 1681q from the "requirements” referred to in § 168 In; nor have other courts, in examining the legislative history of the FCRA, discovered any such intent. See Kennedy, 747 F.2d at 369.
.The amended version of § 168In, see supra note 5, replaced the reference to "[a]ny consumer reporting agency or user of information” with “any person.” Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2412, 110 Stat. 3009, at *3009-446. Section 1681m was also amended at the same time by replacing the word "user” with "any person” and "a person,” although “user” continues to appear in the heading and in new subheadings. Id. at § 2411, 110 Stat. at *3009-443 to *3009-446. Cf. supra, note 4 (describing other amendments to § 1681m).
It is unclear what conclusions we can draw from these amendments with respect to the meaning of "user” in the pre-amended version of the statute. On the one hand, it might be argued that the amendments reflect Congress's intent to expand the FCRA beyond its initial scope and to permit it to apply to previously excluded defendants. (Of course, even if this were true it would not mandate any particular conclusion regarding which defendants are and are not “users” under the old statute.) It might just as easily be argued, however, that these amendments were intended simply to clarify that Congress never intended to employ "users” in § 1681m and (more importantly here) § 1681n as a restrictive term. In any event, inasmuch as we find no convincing reason to favor one interpretation of the amendments over another, our analysis of the pre-amended statute is not influenced by them.
. Indeed, accepting, as we do, that § 1681n incorporates § 1681q, it would make little sense to limit “users of information" under § 168In to those parties who actually deny credit or increase the charge for credit. Inasmuch as parties who regularly would have occasion to deny credit, increase the charge for credit, or otherwise engage in credit transactions are precisely the type of party to whom credit reports are permitted to be distributed, see 15 U.S.C. § 168 lb(a)(3)(A), a party who actually obtained credit information for these permissible purposes would in all likelihood not have done so "under false pretenses." See Hansen, 582 F.2d at 1219 ("The standard for determining when a consumer report has been obtained under false pretenses will usually be defined in relation to the permissible purposes of consumer reports which are enumerated in 15 U.S.C. § 1681b.”).
. Apart from those cases, at least one court has apparently taken the express position that a party who requests and obtains a credit report need not put it to any particular "use” in order to qualify as a "user of information” under § 1681n. See Zeller v. Samia, 758 F.Supp. 775, 779 n. 2 (D.Mass.1991) ("The defendant ... argues that FCRA does not apply because he is not a 'user of information.' ... This argument, however, is without merit. It is undisputed that the defendant both requested and received the plaintiff's credit report. Therefore, the defendant is a ‘user of information' under the Act regardless whether he actually ever used the information for any purpose other than to 'verify that a charge-off' had been received and recorded by the credit agency.”).
. Defendant XYZ Corporation may also fall into the latter category, inasmuch as it is alleged "on information and belief" that this defendant "and/or its employee, Defendant Larry F. Katz-ke,” requested Hoffman employees to obtain Northrop’s credit report. We express no conclusions regarding any liability that may be imposed upon any of the corporate or individual defendants based not on their own status as "users of information" but on their responsibility for any violations by other defendants.