A strong collection partnership helps you recover overdue revenue while preserving consumer trust. Clear communication, respectful outreach, and consistent compliance make both outcomes possible.
The Fair Debt Collection Practices Act (FDCPA) provides the federal framework for these interactions. It governs third-party collection of consumer debts, prohibiting harassment and deception while protecting consumers’ rights to dispute debts.
However, applying those standards consistently remains a challenge. The Consumer Financial Protection Bureau’s (CFPB) 2025 FDCPA Annual Report recorded approximately 207,800 debt collection complaints in 2024. For creditors, that means examining a partner’s compliance controls as closely as its recovery results, both before placing accounts and throughout the relationship.
To help you make that assessment, this guide explains who the Act covers, what it requires and prohibits, what Regulation F added, and how to evaluate an agency’s compliance controls.
What is the Fair Debt Collection Practices Act?
The Fair Debt Collection Practices Act is a federal law that governs how third-party debt collectors pursue consumer debts. Congress passed it in 1977 to curb widespread abuse in the collection industry.
The Act prohibits harassment, false statements, and unfair practices. It requires written debt validation and gives consumers the right to dispute a debt and restrict contact.
Before the Act, threats of violence, midnight calls, impersonation of officials, and disclosure of debts to employers were common tactics with no federal remedy.
The statute targets four categories of conduct:
- Harassment or abuse (Section 806): repeated calls intended to annoy, threats, obscene language, and publishing consumer lists to shame people into paying.
- False or misleading representations (Section 807): misrepresenting the amount owed, claiming attorney or government status, or threatening actions the collector cannot take.
- Unfair practices (Section 808): adding unauthorized fees, depositing post-dated checks early, or communicating by postcard.
- Communication restrictions (Section 805): contacting consumers at inconvenient times or places, calling after a cease-and-desist, or disclosing debts to third parties.
Collectors must also send a written validation notice within five days of first contact. That notice must name the creditor, state the balance, and explain the consumer’s right to dispute.
The core statute remains largely unchanged since 1977. However, the CFPB’s Regulation F, effective 2021, added binding rules for digital channels.
Who the FDCPA applies to and which debts it covers
Under Section 803(6), the Act covers any person whose principal business is collecting debts owed to another party. That includes third-party agencies, debt buyers who purchase charged-off accounts, and attorneys who regularly collect for clients.
Original creditors collecting their own debts are generally exempt. In-house receivables teams and business-to-business operations also fall outside the statute. However, if an original creditor uses a name implying a third party, the FDCPA treats that outreach as covered activity.
The FDCPA covers obligations incurred primarily for personal, family, or household purposes. These include credit card balances, medical bills, auto loans, student loans, and mortgages. But commercial debts fall outside its scope.
Coverage requires closer review for mortgage servicers, loan originators, and process servers. In these cases, the entity’s role, the debt’s default status when obtained, and the activities performed can affect whether the Act applies.
| Category | Does FDCPA apply? | Key condition |
| Third-party collection agency | Yes | Principal business is collecting for others |
| Debt buyer | Yes | Acquires defaulted debt and collects on it |
| Attorney collecting for a client | Yes | Must “regularly” collect to qualify |
| Original creditor (own name) | No | Collecting its own debt under its own name |
| Original creditor (different name) | Yes | Using a name implying a third party |
| In-house receivables team | No | Employees of the original creditor |
| Did you know? The FDCPA does not cover original creditors, but other laws do. FTC Act Section 5 prohibits unfair or deceptive practices by any entity, including original creditors. Some states go further. California’s Rosenthal Act applies FDCPA-level rules to creditors collecting their own accounts. |
Consumer rights guaranteed under the FDCPA
The FDCPA grants consumers the following four rights that define how collection programs must operate:
- Validation notice within five days: After first contact, the collector must send a written validation notice. It must name the creditor, state the balance, and explain the right to dispute.
- 30-day dispute window: A consumer who disputes the debt in writing within 30 days triggers a hard stop. The collector must cease all activity until it verifies the debt and mails that verification.
- Right to restrict contact: Under Section 805, consumers can direct the collector to stop contact entirely. They can also restrict calls to specific times or bar workplace calls. Collectors must honor these restrictions immediately.
- Private right of action: Section 813 allows consumers to sue for FDCPA violations. Statutory damages reach $1,000 per action, plus actual damages and attorney fees.
In class actions, statutory damages for unnamed class members are capped at the lesser of $500,000 or 1% of the collector’s net worth. Yet, this cap applies per action. Hence, systemic violations can increase financial exposure across multiple lawsuits.
Rules and restrictions the FDCPA places on debt collectors
Four key FDCPA sections establish the communication and conduct standards your collection partner must follow.
1. Communication rules
Section 805 restricts when, where, and with whom a collector may communicate. Generally, collectors must avoid contact before 8 a.m. or after 9 p.m. at the consumer’s location. They must also avoid workplace calls when they know or should know the employer prohibits them.
In addition, collectors must limit debt disclosures to legally permitted recipients. These include the consumer, their spouse or attorney, a minor’s parent, and authorized guardians or estate representatives. For example, a detailed voicemail overheard by an unauthorized family member can create a disclosure risk.
2. Prohibited harassment and abuse
Section 806 bars threats of violence, obscene language, and repeated calls intended to annoy, abuse, or harass. To clarify how this applies to calling patterns, Regulation F provides call-frequency presumptions, explained below.
3. False or misleading representations
Section 807 prohibits false claims about who the collector is, how much is owed, or what legal action may follow. Collectors cannot pretend to be attorneys or government officials.
For example: An agent says, “Pay by Friday, or we’ll sue,” even though neither the agency nor the creditor intends to file a lawsuit. That threat can violate Section 807.
Scripts should therefore describe possible next steps accurately, without suggesting legal action that is unlawful or not intended.
4. Unfair practices
Section 808 prohibits collecting amounts unless expressly authorized by the agreement creating the debt or permitted by law. It also bars depositing or threatening to deposit postdated checks early. Communicating about debts by postcard is prohibited because it can expose debt information to others handling the mail.
| Pro tip: Courts apply a “least sophisticated consumer” standard when evaluating FDCPA violations. Language a reasonable professional would understand can still violate the Act if a naive reader could be misled. Stress-test every script and letter template against that standard. |
Regulation F: what the 2021 rule added to the FDCPA
The original FDCPA predates email, texting, and social media. Regulation F took effect November 30, 2021, to modernize the statute for current channels. Here is what you need to know:
The 7-in-7 call frequency rule
Section 1006.14 creates a presumption of harassment if a collector places more than seven calls in seven days about a specific debt. Any call within seven days of a completed conversation also triggers the presumption.
The rule counts calls per debt, so a collector working three separate accounts for the same consumer could place 21 calls in seven days.
Digital communication rules
Regulation F brought email, texts, and social media under the FDCPA framework. Every electronic message must include a clear opt-out mechanism. Missing opt-out instructions carry the same violation risk as calling outside permitted hours.
Model Validation Notice
The CFPB published a Model Validation Notice (Form B-1). It creates a safe harbor for debt collection compliance. Collectors who use the model form are presumed to meet validation disclosure requirements. Whether your partner uses this notice is a baseline compliance indicator.
Limited-content voicemail
Regulation F defines “limited-content messages” that collectors can leave without triggering third-party disclosure risk. These may include the collector’s name, a callback number, and a return-call request, but not the purpose, the creditor’s name, or the amount owed.
FDCPA enforcement: regulators, penalties, and recent activity
FDCPA enforcement can affect both the cost and continuity of a collection program. With regulators and consumers able to take action, creditors need to understand who enforces the law and where financial exposure arises:
- Regulatory oversight: The CFPB and Federal Trade Commission (FTC) share FDCPA enforcement authority with other federal regulators. State attorneys general can also act under applicable consumer-protection laws.
- Individual lawsuits: In addition to regulatory action, consumers can bring claims under Section 813, making private litigation another source of financial exposure.
- Enforcement example: The CFPB’s 2025 FDCPA Annual Report describes an FTC case involving more than $7.6 million allegedly collected through bogus debt demands. A court temporarily halted the operation and froze its assets.
- Litigation activity: WebRecon data reported by Consumer Financial Services Law Monitor showed 396 FDCPA cases filed in January 2026, up 26.5% from January 2025.
For creditors, this makes compliance evidence central to agency selection and ongoing oversight. Ask your partner to demonstrate how its controls guide daily decisions and produce records showing how consumer interactions were handled.
FDCPA compliance checklist for creditors working with a third-party agency
Choosing a collection partner is a compliance decision. Courts have held creditors vicariously liable for their agency’s misconduct, and the CFPB’s UDAAP examination procedures apply to the creditor too.
When your agency violates the FDCPA, the complaint and regulatory inquiry land on your desk alongside theirs.
Here is what to require from any third-party collection partner:
- Consumer-level contact frequency tracking: Account-level tracking misses Regulation F’s per-debt call limits. The partner must cap contacts at the individual consumer level across all debts.
- Real-time cross-channel opt-out sync: A text opt-out must propagate to email, phone, and mail immediately. Lag between channels is where violations occur.
- Compliance audit documentation and complaint rate data: Require a current System and Organization Controls (SOC 2) Type II report. This confirms controls are independently tested and operational.
- Regulation F training records and call monitoring: Agents need documented training on the 7-in-7 rule, limited-content voicemails, and digital opt-out procedures.
- 24-hour audit trail retrieval: When a consumer or regulator inquires about an account, the partner should produce a complete log within one business day.
How First Credit Services approaches FDCPA compliance across digital and traditional collections
At First Credit Services (FCS), our focus is on providing accurate account information, communicating appropriately, and ensuring consumers understand their options, whether they interact with an agent or use a digital channel.
Digital collections
FCS uses digital channels such as email and SMS to share account information, send payment reminders, and direct consumers to online payment options. Payment links offer a convenient way for consumers to make payments without speaking to an agent. These communications must be clear and accurate, with appropriate safeguards for consumer information. We also account for applicable requirements around communication frequency, consent, and opt-out requests, ensuring that consumer preferences are handled appropriately.
Traditional collections
Telephone conversations and written correspondence remain important for consumers who need direct assistance or have questions about their accounts. At FCS, regular agent training reinforces professional communication, accurate representation of account information, and appropriate handling of call timing and third-party communications. Training also covers how to respond when consumers dispute a debt, request clarification, or raise concerns about their accounts. Disputes are handled in accordance with applicable requirements, including verification procedures and collection pauses where required.
Across both channels, our approach aims to balance effective recovery with clear communication and respectful consumer interactions.
How to read an FDCPA-compliant collection program: a decision framework
Once you have the checklist data, five signals indicate a program built for sustained compliance.
- Documented complaint rate below the industry average: Ask the partner for their rate per thousand accounts and compare it against CFPB annual reporting. A rate significantly above average warrants further diligence.
- Written Regulation F communication policy, reviewed annually: It should specify call frequency caps, digital opt-out procedures, voicemail scripts, and validation notice timing.
- Segmented consent management: Track contact preferences separately for email, texts, calls, and mail. A consumer may opt out of texts but still accept emails. Your partner should therefore apply each request to the channels it covers.
- Independent quality assurance on validation notices and disputes: QA should come from a team separate from the collectors whose work they review. Self-grading creates blind spots on notice accuracy and dispute timing.
- Clear complaint escalation path with defined service-level agreements: Complaints should follow a documented path from intake through resolution with time-bound milestones.
What to walk away from
Avoid partners who cannot produce audit trails on demand or who treat compliance as a legal department function rather than an operational one. Volume-based agent compensation without compliance gates drives harassment and misrepresentation violations.
Build a recovery program with FDCPA compliance as its foundation
A dependable collection partner makes compliance part of daily decisions and gives you the evidence to verify it. The FDCPA establishes the federal baseline. Besides that, applicable state laws and broader consumer protection requirements add obligations your partner must address.
That makes oversight an ongoing part of the partnership. Use audit findings and complaint trends to assess how consistently controls work. When issues arise, your partner should explain the corrective action taken and demonstrate whether it resolved the problem. This accountability gives you a clearer basis for trusting an agency with your portfolio.
Schedule a consultation about how FDCPA and Regulation F are built into every consumer interaction.
FAQs
1. When was the FDCPA last updated?
The core statute has not been amended since 1977. The CFPB’s Regulation F took effect November 30, 2021, adding binding rules on call frequency, electronic communications, and validation notice format.
2. Does the FDCPA cover medical debt collection differently?
Medical debts are covered the same way as any other personal obligation. However, recent CFPB rulemaking on medical debt reporting adds separate credit reporting restrictions that sit alongside FDCPA requirements.
3. How long does an FDCPA violation stay actionable?
Consumers have one year from the violation date to file a private lawsuit under Section 813(d). CFPB and FTC enforcement actions follow separate limitation periods and are not bound by that one-year window.
4. Do FDCPA rules apply to text messages and email?
Yes. Regulation F brought all digital channels under the FDCPA framework. Every electronic message must include opt-out instructions, and collectors must maintain reasonable procedures for processing those requests promptly across all channels.
5. Is a debt collector required to prove a consumer owes the debt?
If the consumer disputes in writing within 30 days of the validation notice, the collector must cease activity until it obtains and mails verification. Verification typically means confirming the amount and original creditor, though the required level of proof varies by jurisdiction.
6. How does FDCPA enforcement differ from UDAAP enforcement?
The FDCPA applies to third-party collectors and defines prohibited conduct in detail. UDAAP is broader, covering any financial services provider, including original creditors. A practice can pass FDCPA scrutiny and still violate UDAAP if the CFPB deems it unfair or deceptive under the broader standard.
