It wasn’t immediately clear how many people were affected by the companies’ practices that were challenged by the CFPB.

But it could be a large number, given the number of incidents where hackers stole personal information on millions of consumers at large retailers in recent years, prompting people to check their credit reports.

Under federal law, consumers can obtain one free credit report annually from each credit reporting firm, or up to three a year from the three major credit reporting firms.

But the CFPB said that between 2011 and 2014, Equifax and TransUnion deceived customers into signing up for subscriptions, typically for $16 a month, for their credit scores and other information that often can be obtained for free.

The federal agency said the two companies also sold credit scores to consumers that typically aren’t the same as those used by banks and other lenders to make credit decisions. The CFPB said most lenders instead use so-called “FICO” credit scores offered by another company, Fair Isaac Corp.

The CFPB said the two firms’ actions violated the federal Fair Credit Reporting Act by making it difficult for customers to know how much they would be charged for the subscription services after a free trial period.

In its consent order, Equifax agreed to pay a $2.5 million civil fine and to provide $3.8 million in restitution to customers.

TransUnion, based in Chicago, agreed to pay a $3 million fine and to provide more than $13.9 million in restitution.

Under the consent orders, the companies will determine which customers were affected, and up to 90 days to come up with CFPB-approved plans to provide written notices and restitution payments to those people.

The companies also agreed to provide clearer information on the cost and usefulness of their services, and to get customers’ express consent before signing them up for monthly subscriptions.