Article

FDCPA Basics: What Debt Collectors Can and Cannot Do

The Fair Debt Collection Practices Act sets the rules third-party debt collectors have to follow — when they can call, what they can say, and what they have to prove. Here is what the statute actually bans, what the CFPB's Regulation F added in 2026, and how to use a validation request, a cease-and-desist letter, or an FDCPA lawsuit when a collector crosses the line.

1 min read

The Fair Debt Collection Practices Act is the federal law that limits what third-party debt collectors can do when they try to collect a consumer debt. It governs when they call, what they say, what they have to send you in writing, and what happens when they cross a line. Understanding the statute matters because the cost of guessing is real — a missed validation deadline, a contact you didn't push back on, or a fee you paid that wasn't authorized.

This guide covers what the FDCPA reaches, what debt collectors cannot do, when they can and cannot contact you, your validation and dispute rights, what to do when those rights are violated, and the practical numbers — call limits, statute of limitations, statutory damages — that actually matter.

What the FDCPA is and who it covers

The Fair Debt Collection Practices Act was enacted in 1977 and is (https://www.ftc.gov/legal-library/browse/rules/fair-debt-collection-practices-act-text). The CFPB's (https://www.consumerfinance.gov/compliance/compliance-resources/other-applicable-requirements/debt-collection/debt-collection-rule-faqs/), effective November 30, 2021, layered new rules on top — including the 7-in-7 call cap and a model validation notice. Together they form the working rulebook for consumer debt collection.

The FDCPA covers debts incurred for personal, family, or household purposes — credit cards, medical bills, auto loans, student loans, mortgages, utility bills. It does not cover business debts. And it applies to third-party debt collectors: companies and law firms that collect debts on behalf of someone else, or that buy delinquent debts and collect on their own account. The original creditor collecting its own debt is generally outside the statute. The one exception, per (https://www.law.cornell.edu/wex/fair_debt_collection_practices_act_(fdcpa)), is when an original creditor uses a name that suggests a third-party collector is involved — that pulls them inside.

If you're contacted by a collector you don't recognize, that distinction matters. FCRA disputes go to the credit bureaus; FDCPA validation requests go to the collector itself, and they trigger a different set of obligations on a different clock.

What debt collectors cannot do

The Act splits the prohibited behavior into three buckets. The CFPB's enumeration is the working reference.

Harassment (§ 806). Repeated phone calls intended to annoy or abuse, threats of violence, obscene or profane language, publishing lists of people who refuse to pay (other than to a credit bureau), and calls without identifying the collector are all banned. The 7-in-7 call rule under Regulation F operationalizes the harassment standard — anything above that cap is presumptively harassing.

False or misleading representations (§ 807). Collectors cannot misrepresent the amount owed, falsely claim to be an attorney or government agent, threaten arrest or wage garnishment that can't legally happen, threaten any action they don't actually intend to take, or use letters that look like government documents.

Unfair practices (§ 808). Collectors cannot collect interest, fees, or charges that aren't authorized by your contract or by law. They cannot ask for postdated checks to use as leverage, deposit postdated checks before the date stated, take or threaten to take property where the action isn't legally available, or contact you by postcard.

The unifying principle is that the FDCPA puts the burden on the collector to be accurate, to be reachable, and to behave like a regulated business rather than a pressure tactic.

When collectors can and cannot contact you

The default rule is simple: between 8 a.m. and 9 p.m. local time. (https://consumer.ftc.gov/articles/debt-collection-faqs) under the FDCPA. If you've told the collector that your employer prohibits calls at work, they can't call you at work either. They also can't talk to anyone else about the debt — they can contact third parties only to locate you, and only once per third party.

Regulation F added more structure. A collector cannot make more than 7 phone-call attempts per debt within any 7-day period, and once they've actually spoken with you about a particular debt, they cannot call about that debt again for 7 days. Multiple debts mean the cap is per-debt, not per-collector — which matters when a single agency holds multiple accounts on you.

Electronic communication is allowed, but Regulation F requires a "reasonable and simple" opt-out method in every email or text. Collectors also cannot use social media to publicly post about a debt; private messages are allowed only with consent and an opt-out path.

The strongest contact-stop tool is a written cease-and-desist letter. Once the collector receives it, they can only contact you to confirm receipt or to announce a specific action — typically a lawsuit. That doesn't make the debt go away, and it doesn't help if the debt is genuinely past the FDCPA statute of limitations — but it stops the calls.

Your validation and dispute rights

Within five days of first contacting you, a collector has to send a validation notice. It identifies the creditor, states the amount, and tells you that you have 30 days from receipt to dispute the debt in writing. The notice now uses Regulation F's model form, which itemizes the debt and lays out your rights in plain language.

If you dispute in writing within that 30-day window, the collector has to stop collection until they send you verification. That's the practical lever — a properly written dispute pauses the entire process. Our (/how-to-write-a-debt-validation-letter-with-template) walks through what to include and what to leave out.

The FDCPA validation right is separate from the FCRA dispute you can file with the bureaus if the debt is also showing on your credit report. The two run on different clocks and different remedies — a single delinquent collection can generate both a § 1692g validation request and a § 611 bureau dispute on the same day.

What to do when an FDCPA right is violated

You have two parallel paths, and they don't cancel each other out.

File with the regulator. The CFPB's portal at consumerfinance.gov/complaint forwards the complaint to the collector and tracks the response. The FTC takes complaints at reportfraud.ftc.gov. Your state Attorney General may also enforce state debt-collection acts that layer on top of the FDCPA.

Use the private right of action. The FDCPA at § 813 lets you sue in federal or state court for actual damages, statutory damages up to $1,000 per action, and attorney's fees. The one-year statute of limitations runs from the date of the violation, so timing matters. Save voicemails, keep the envelopes, screenshot the texts.

If the collection is also on your credit report and the dispute work is dragging, a legitimate credit-repair company can run both the FCRA dispute and the FDCPA validation request on your behalf — under the Credit Repair Organizations Act they can't collect a fee until services are performed, must give you a written contract, and must honor a three-day right to cancel.

Frequently Asked Questions

Does the FDCPA cover the original creditor or just debt collectors?

The FDCPA applies to third-party debt collectors — companies or law firms that collect on behalf of someone else, or that buy delinquent debts to collect on their own. The original creditor collecting its own debt is not covered, with one exception: if the original creditor uses a name that suggests a third-party collector is involved, it falls inside the statute.

What hours can a debt collector call?

Generally between 8 a.m. and 9 p.m. in your local time zone. Calls outside that window are presumed inconvenient. The collector also cannot call you at work if you've told them your employer prohibits such calls.

How many times can a debt collector call me per week?

Under the CFPB's Regulation F, a collector cannot make more than 7 phone-call attempts per debt within any 7-day period, and cannot call within 7 days after speaking with you about a particular debt.

What is a validation notice and what should it contain?

Within five days of first contact, a collector must send a validation notice that identifies the creditor, states the amount, and tells you that you have 30 days to dispute the debt in writing. Regulation F's model form also itemizes the debt and lists your rights.

What can I recover if a debt collector violates the FDCPA?

You can sue for actual damages, statutory damages up to $1,000 per action, and attorney's fees. The statute of limitations is one year from the violation. You can also file a complaint with the CFPB or the FTC.

The bottom line

The FDCPA gives you specific levers — the validation request, the cease-and-desist letter, the private right of action — and they work when you actually use them. A documented validation request pauses collection. A written cease-and-desist stops the calls. A one-year suit window is short but real. If you'd rather hand the dispute work to a vetted company, (/#top-companies) on our independent reviews page.