It is lawful. Insurers may investigate claims to see if they are legitimate--for example, that someone did not sell his motorcycle under the table but then claim it stolen, or pay someone to steal it so he could make an insurance claim. Theft claims are often suspect if the vehicle is not recovered. One thing the insurers look for is evidence that the insured was in financial distress, since if he was, that increases the likelihood that the theft was not legitimate, but was a way to get insurance money.If your boyfriend does not cooperate, the insurer likely will not pay. He could in theory then sue for "breach of contract" (an insurance policy is a contract) on the basis they are not honoring their contractual obligation; if he can prove in court they should pay, they will have to. But in the lawsuit, if they can convincince the judge that the credit report may be relevant, they'll be able to get it anyway (and/or banking information, credit card information, and other financial information); he therefore may wish to cooperate now, instead of forcing litigation and likely having to allow it anyway.