What's more, unless you actually applied for a car loan or a mortgage, then your «friend» just caused his or her employer to violate the Fair Credit Reporting Act's
Permissible Purpose provision, which says that credit reports can only be accessed for legitimate purposes.