What Debt Collectors Can and Cannot Legally Do to You

Consumer attorneys will tell you to request written verification before you say anything else to a debt collector, and there's a reason for that. The call you get at 7 AM isn't just uncomfortable. It's a moment where the wrong response can reset legal timelines, waive defenses, or hand a collector evidence they'll use in court.

Your rights against debt collectors are governed primarily by the Fair Debt Collection Practices Act, a federal law that sets hard limits on what third-party collectors can and cannot do. But those rights have conditions. The FDCPA covers third-party collectors, not always the original creditor collecting its own debt. It applies to consumer debts, not business debts. And the protections it offers are only as strong as your willingness to invoke them in writing.

Here's the tension most people don't anticipate: the FDCPA gives you real leverage, but using it incorrectly, or not at all, can leave you more exposed than if you'd never known the rules existed. A collector who violates the law owes you up to $1,000 in statutory damages plus attorney fees, according to the FDCPA itself, but only if you act. Silence is not protection.

The FDCPA's prohibited conduct list is longer than most people realize. Collectors cannot call before 8 AM or after 9 PM in your local time zone. They cannot call your workplace if you tell them your employer disapproves. They cannot use obscene language, make threats of violence, or misrepresent the amount you owe. They cannot claim to be attorneys or government officials if they aren't.

The threat prohibition deserves specific attention. A collector cannot threaten to sue you unless they actually intend to file suit and are legally permitted to do so. Threatening arrest for a civil debt is illegal. Threatening to garnish wages without a court judgment is illegal. These aren't gray areas. The Federal Trade Commission and the Consumer Financial Protection Bureau both treat these as clear FDCPA violations, and courts have consistently ruled accordingly.

What surprises people: a collector also cannot discuss your debt with third parties. They can contact your spouse, your attorney, or a co-signer. They cannot call your neighbor, your adult child (who isn't on the debt), or your employer to disclose what you owe. Location information is the only thing they can request from third parties, and even then, they generally can't identify themselves as debt collectors when doing it.

Or rather: they can attempt all of these things, and some will. The prohibition means it's illegal, not that it doesn't happen. Document every call. Write down the date, time, name given, and what was said. That log is evidence if you file a complaint or a lawsuit.

Collectors can contact you by phone, mail, email, or text (subject to consent rules for electronic contact under 2021 CFPB rule updates). They can report the debt to credit bureaus. They can file a lawsuit to obtain a judgment. And once they have a judgment, depending on your state, they may be able to garnish wages or place liens on property.

They can also be persistent. Nothing in the FDCPA says a collector must stop calling after one attempt. What it restricts is abusive frequency: calls designed to harass rather than reach you. The CFPB's 2021 Debt Collection Rule introduced a specific limit of seven calls within seven consecutive days per debt, and a 7-day waiting period after reaching you by phone before calling again. That's now an enforceable bright-line rule, not a vague standard.

Collectors can also send written notices demanding payment. Within five days of first contact, they are required by law to send a validation notice that states the amount owed, the name of the creditor, and your right to dispute the debt within 30 days. If you don't dispute in writing within that 30-day window, the collector can assume the debt is valid. That assumption matters legally.

The realistic picture: a collector working within the law is allowed to be a consistent, professional pressure. The FDCPA doesn't eliminate debt collection. It sets boundaries around how that pressure is applied.

This is where most guides get vague in ways that cost people money. Disputing a debt in writing within 30 days of the validation notice triggers a legal obligation: the collector must stop collection activity until they provide you with verification of the debt. Verification means something like a copy of the original agreement or a statement showing the account history. It doesn't require a full paper trail, but it must be more than the collector's say-so.

Send your dispute letter by certified mail with return receipt requested. Keep the receipt. Keep a copy of the letter. The FDCPA's protections for disputes exist only if you can prove you sent the dispute, and a vague verbal objection on a recorded call doesn't meet the standard. Written. Certified. Documented.

If the debt is old, the statute of limitations matters more than people expect. Each state sets its own limitations period for debt lawsuits, typically ranging from three to six years for credit card debt, though some states allow longer. After that window closes, the debt is time-barred: the collector cannot successfully sue you for it. But here's the critical wrinkle. Making a payment or, in some states, simply acknowledging the debt in writing can restart that clock. Before you pay anything on an old account, verify whether it's time-barred under your state's law. The CFPB's website provides state-by-state guidance as a starting point.

That framing misses something. A time-barred debt can still be reported to credit bureaus (for up to seven years from the original delinquency date, under the Fair Credit Reporting Act). The statute of limitations bars a lawsuit, not the credit reporting. Those are separate clocks running simultaneously.

You have the right to send a cease-and-desist letter telling a collector to stop all contact. Under the FDCPA, once they receive it, they can only contact you to confirm they're ceasing communication or to notify you of a specific action they intend to take (like filing a lawsuit). That's it.

But stopping contact doesn't stop the debt. Collectors who receive a cease-and-desist letter from someone who owes a legitimate, collectible debt often do one thing next: file suit. You've removed their ability to pressure you informally, so the lawsuit becomes their remaining lever. If the debt is valid, within the statute of limitations, and large enough to justify court costs, silence from you accelerates that outcome.

I'd start with a debt validation request before jumping to a full cease-and-desist, especially on larger balances. Validation buys you time and information. A cease-and-desist buys you silence but can accelerate litigation. The right sequence depends on three things: whether the debt is yours, whether it's time-barred, and whether the collector has any interest in suing.

Who should use cease-and-desist letters without hesitation: anyone facing harassment, false threats, or contact on a debt they've already settled or that isn't theirs. In those cases, the letter creates a record of their continued contact, which is evidence for your FDCPA claim.

The FDCPA covers third-party debt collectors. Original creditors collecting their own debts are generally not bound by it, though some states have their own laws that fill this gap. California's Rosenthal Fair Debt Collection Practices Act, for instance, extends FDCPA-style protections to original creditors. If you're in a state without equivalent state law, a bank calling directly about your own credit card account has more latitude than a collection agency would.

Business debts are also excluded. If you personally guaranteed a business loan and a collector is pursuing you, the nature of the original debt matters. Consumer debt (credit cards, medical bills, personal loans, mortgages) is covered. A debt you incurred primarily for business purposes generally isn't.

Federal student loans have a separate framework. The Department of Education and its servicers operate under different rules, and some of the FDCPA's limits don't apply the same way. Private student loans do fall under the FDCPA if collected by a third party.

If you ignore a legitimate debt collector working within the law and a court judgment follows, your options narrow considerably. Wage garnishment, bank account levies, and property liens become real possibilities. The FDCPA gives you leverage before judgment. After judgment, the leverage largely belongs to the collector.

If a collector violates the FDCPA, you have three options: file a complaint with the CFPB or FTC, file a complaint with your state attorney general's office, or sue the collector directly in federal or state court.

Filing with the CFPB or FTC creates a record and can trigger regulatory action, but it won't put money in your pocket. The FDCPA's real financial remedy is the private right of action. You can sue a violating collector for actual damages, statutory damages up to $1,000 per lawsuit (not per violation), and attorney fees. The attorney fees provision is meaningful: consumer protection attorneys often take FDCPA cases on contingency because if they win, the collector pays legal fees.

The practical threshold: individual FDCPA lawsuits are most viable when the violations are documented, repeated, or involve false statements about the debt amount, legal status, or threatened action. A single questionable call is harder to pursue than a pattern of documented harassment. Your call log, certified mail receipts, and saved voicemails are the evidence base for any claim.

Check complaints against specific collectors through the CFPB's consumer complaint database, which is publicly searchable. A collector with hundreds of FDCPA complaints is telling you something about their operating model.

If you've received contact from a debt collector, start with the validation notice. If it's been more than five days since first contact and you haven't received one, that's already a potential violation. Send a written validation request immediately, certified mail.

While you wait for verification, check two things: whether the debt appears on your credit report as you understand it, and whether the statute of limitations has run under your state's law. The CFPB's website and your state attorney general's consumer protection office are both legitimate starting points for state-specific timelines.

If the debt is valid, within the limitations period, and you intend to resolve it, do so in writing and request a settlement agreement before sending any payment. Verbal agreements with collectors are difficult to enforce. Get the payoff amount, the settlement terms, and the collector's commitment to mark the account satisfied, all on paper, before you pay.

And if a collector has threatened arrest, claimed to be law enforcement, misrepresented the amount, or called after you told them in writing to stop: document it, save everything, and contact a consumer protection attorney. The FDCPA's attorney fees provision exists precisely so that people without money for legal fees can still enforce their rights.