Debt Collectors: What They Legally Can and Can't Do (Your FDCPA Playbook)

A debt collector's business model depends on one thing: you not knowing the rules. The Fair Debt Collection Practices Act (FDCPA) gives you specific, enforceable rights — limits on when and how often they can call, a right to demand proof of the debt, and the power to shut off contact entirely with one letter. Collectors know these rules cold. Most consumers have never heard of them.

That knowledge gap costs real money. People pay debts they don't owe, pay the wrong collector, or pay time-barred debt that could never have survived a validation request — because a stranger on the phone sounded certain and a little threatening.

This is the playbook: what collectors legally can and can't do, the exact words that invoke each protection, and what to do when they cross the line. None of it requires a lawyer. Most of it requires one letter and a habit of writing things down.

Who the FDCPA covers — and who it doesn't

The FDCPA applies to third-party debt collectors: collection agencies, debt buyers, and lawyers who collect debts. It generally does not cover the original creditor collecting its own debt — your card issuer calling about your own account plays by different (mostly state-law) rules. It covers personal, family, and household debts: credit cards, medical bills, auto loans, personal loans. Not business debts.

One more scope note: since 2021, federal rules (Regulation F) extended and clarified the FDCPA for modern channels — texts, emails, and social media DMs are all regulated too, and every electronic message must include a way to opt out.

The hard rules collectors must follow

Contact limits. Under Regulation F, a collector is presumed to violate the law if they call you more than 7 times within 7 days about a single debt, or call you within 7 days of actually speaking with you about it. Calls are restricted to 8 a.m. to 9 p.m. your local time unless you agree otherwise.

The validation notice. Within five days of first contact (or in the first communication itself), the collector must send you a written validation notice stating the amount, the creditor's name, an itemization of the debt, and your dispute rights.

Your 30-day window. From the day you receive that notice, you have 30 days to dispute the debt or demand verification in writing. Do it inside the window and the collector must stop all collection activity until they mail you verification. That number is worth repeating, because it's the single most valuable deadline in consumer debt law: 30 days to demand validation — use them. Even if you think you owe the debt, validate it anyway. Debt buyers purchase accounts for pennies on the dollar, often with incomplete records; a meaningful share of collection attempts can't survive a proper validation demand because the paperwork simply isn't there.

Workplace and third parties. They must stop calling your job if you tell them your employer prohibits it. They may contact other people only to locate you — they can't discuss your debt with your family, friends, or coworkers.

No lies, no abuse. Prohibited outright: threatening arrest or jail, threatening lawsuits they don't intend to file, claiming to be law enforcement or a government agency, misstating the amount owed, using obscene language, calling repeatedly to harass, publishing your name as a debtor, or telling you a debt will stay on your credit report longer than the FCRA allows (see our negative-items timeline guide for those limits).

They did X — here's your move

| They did this | Your move | |---|---| | First contact, by phone or letter | Say nothing about the debt. Get their company name and address. Send a validation demand within 30 days, certified mail. | | Won't send a validation notice | That's a violation. Document it and file a CFPB complaint. | | Calling 8+ times a week, or right after you spoke | Presumptive violation of Reg F. Log every call: date, time, number, name. | | Calling your workplace after you said stop | Violation. Say it once on a recorded-note call, then put it in writing. | | Discussing your debt with family or coworkers | Violation. Get the third party to write down what was said and when. | | Threatening arrest, jail, or "fraud charges" | Serious violation. Save voicemails; note exact words. Consider an FDCPA attorney — statutory damages run up to $1,000 plus fees. | | Demanding payment on a debt you don't recognize | Dispute in writing within the 30-day window. Collection must pause until verified. | | Pushing a "small good-faith payment today" | Decline until validation is complete. In many states a partial payment restarts the statute of limitations for a lawsuit — varies by state, verify yours. | | Debt is beyond your state's statute of limitations | They can still ask; they generally can't sue (and threatening to can be a violation). Don't acknowledge or pay before understanding revival rules in your state. | | You just want the calls to stop | Send a cease-communication letter, certified mail. After that they may contact you only to confirm they're stopping or to notify you of a specific action like a lawsuit. |

The scripts

On any phone call (say this and nothing else):

"I don't discuss financial matters by phone. Send me written validation of this debt at my mailing address. What is your company's name and mailing address?"

Then stop talking. Anything you say about the debt — "I know it's mine, I just can't pay right now" — can be used later, and in some states an acknowledgment can restart the lawsuit clock.

The validation demand letter (send within 30 days of the validation notice, certified mail with return receipt):

"I am responding to your contact about an alleged debt (reference number, if any). I dispute this debt and request validation under the FDCPA, 15 U.S.C. 1692g. Please provide: the amount and an itemization of the alleged debt; the name and address of the original creditor; proof you own or are authorized to collect this debt; and a copy of the original signed agreement. Until you provide validation, cease all collection activity as the law requires."

The workplace stop:

"My employer does not permit these calls. Under the FDCPA you may not contact me at my workplace again. My mailing address for written correspondence is below."

The cease-communication letter (when you want silence — best for debts you can't or won't pay, or time-barred debts):

"Under 15 U.S.C. 1692c(c), I demand that you cease all communication with me about this alleged debt, in every channel including phone, text, email, and social media."

Use this one deliberately: it stops the calls, but it doesn't erase the debt, and it removes your chance to negotiate. If the debt is large, recent, and legitimate, negotiating is often smarter than silence.

Document everything, then escalate

A violation you can't prove is a violation that didn't happen. Keep a call log (date, time, caller, number, what was said), save every letter and envelope, keep voicemails and screenshots of texts, and send everything important by certified mail. Note that recording calls requires all-party consent in some states — varies by state, verify yours before recording.

When violations pile up, you have three escalation paths, and they stack:

1. File a complaint with the CFPB at consumerfinance.gov/complaint — collectors must respond, typically within 15 days, and complaints create a paper trail regulators act on. Copy your state attorney general.
2. Report to the FTC at ftc.gov, which tracks patterns and has shut down abusive collection operations.
3. Sue under the FDCPA. You can recover up to $1,000 in statutory damages plus actual damages, and — this is the part that changes collector behavior — they pay your attorney's fees if you win. Many consumer attorneys take clean FDCPA cases at no upfront cost. You generally have one year from the violation to file.

A documented violation is also leverage. Collectors settle debts at steep discounts for consumers who can credibly show FDCPA problems, because a $1,000-plus-fees exposure over a $600 collection account is bad math for them.

Your next steps

The power balance in debt collection is set by whoever knows the rules better. As of this week, that's you. The system: never discuss a debt on a first call, validate everything in writing within the 30-day window, log every contact, and escalate documented violations to the CFPB — or to an attorney when the conduct is bad enough to be worth $1,000 of their money.

1. If a collector has contacted you in the last 30 days: send the validation demand today, certified mail.
2. Start your call log now, even if nothing has gone wrong yet.
3. Check your credit reports for the collection's details and dates — errors there are separately disputable under the FCRA, and our dispute guide covers that process.
4. Once validation settles what's real, decide: negotiate, pay, or wait out the clock.

Collections also quietly inflate what you pay for credit, insurance, and more. Run our free Am I Overpaying? audit to see what your current profile is costing you — and where the quickest savings are while you clean things up.

This article is general education, not legal advice. The FDCPA and Regulation F rules described are current as of mid-2026; statutes of limitations and call-recording laws vary by state — verify yours. For case-specific guidance, consult a consumer-law attorney; many offer free FDCPA consultations.