My boss added me to his personal Amex credit card, which he had been using as a business card because of its high credit limit, points, etc. He told me that it wouldn't affect my credit, but it did—it pulled my credit and impacted my average age of accounts and overall debt. I'm no longer with the company, so they closed the account where I was an authorized user on his Amex. The only thing I did was call to activate the card. I'm pretty sure my boss completed the online application and pulled my credit using my SSN. Is this legal in Virginia?