It's illegal for anyone to pull even a soft of your credit without a permissible purpose.
Here is another 100% false statement. Softs are pulled all the time without you having anything to do with institution that is pulling the soft. Here is something you can do yourself to prove what I am saying is correct. Get a real copy of your CR and look under inquires. It will show soft and hard inquires. Under soft inquires you most likely see pulls you never gave permission to, they had a permissible purpose for or ever had anything to do with. Here are few under mine.
PRM-AAA AUTO CLUB GROUP 10/24/16
PRM-LIBERTY MUTUAL RESPONSE MARKET 10/21/16
PRM ONL-WYNDHAM VACATION OWNERSHIP 07/31/16
Most of you would say what is the big deal? Just let the troll keep trolling. The problem is he continually posts wrong information in this and other threads that can get members in trouble. When you correct him with facts he just keeps repeating the same BS over and over.
ETA: they had a permissible purpose for