FDCPA violations by collectors: what goes wrong, by channel

FDCPA violations by collectors cluster, and the clusters are not where a rulebook-shaped checklist expects them. Borrowers’ complaints are dominated by two themes — how often they are contacted, and being asked for the wrong amount. Examiners keep writing up the same short list: a disclosure missing from later contacts, a conversation continued after the borrower said it was a bad time, conduct inside the call limit that still harassed, and a service provider doing it on the collector’s behalf. And each of those is found in a different artefact: a second in a recording, a clause in a message, a figure on a letter, a count across seven days. Collections Compliance Monitoring is Botminds’ software for collections quality and compliance teams — it reads every call, voicemail, text, email and letter overnight against the rulebook and the bank’s own policy, and pins each finding to the moment that caused it.

The sample figures and screens below come from one day at a fictional bank, Northmere Bank: its own collectors and three agencies had 41,286 conversations with borrowers on Monday 12 October. Every person, bank, agency and borrower named is invented, and every figure describing that day is sample data from one day, not a measured result for anybody. The complaint and examination figures are the regulator’s own, linked where they appear.

What are the most common FDCPA violations?

Nobody publishes a league table of proven breaches; what is published is complaints and supervisory findings, and the two tell a consistent story. The regulator’s own summary of its 2024 complaint data is that “the majority of complaints about communication tactics were about frequent or repeated calls (51 percent). Complaints of continued contact attempts despite requests to stop contact were also common (34 percent).”

Electronic channels show the same shape. Among complaints raising an electronic communication issue, “the most commonly reported sub-issue was frequent or repeated messages (58 percent), followed by told them to stop contacting you, but they keep trying (32 percent)”. Texting did not create a new category of grievance; it moved the old one into a new channel.

Two things follow for anybody deciding what to check first. Frequency and contact-after-stop are not subtle judgement calls — they are counts and flags, which is exactly the kind of thing software can test on every account rather than on a sample. And they are breaches of attempts, not of content: a quality programme that only reads what was said will not see them at all.

What borrowers complain about, in the CFPB’s own counts

Step back from communication tactics and the single largest theme is different again. The most common issue borrowers select is attempts to collect a debt that is not owed, and it has been the predominant issue since complaints on debt collection were first accepted. Most of those borrowers say the debt is not theirs; a substantial share say it arose from identity theft; smaller groups say it was already paid or discharged in bankruptcy.

That has a practical consequence for monitoring. A conversation can be word-perfect and still be a breach, because the problem is the account rather than the sentence — the wrong person, a paid balance, a bankruptcy on file. No amount of listening to the call finds it. It is found by reading the call against the account, which is why the checks that matter are the ones with the bank’s own system of record beside them.

Enforcement, by contrast, has been thin. The regulator records that “in 2024, the FTC was the only agency to announce public enforcement actions addressing harmful debt collection activity in violation of the FDCPA”. A desk that calibrates its own risk from the volume of public actions will calibrate it low; the realistic exposure for most banks runs through complaints, private actions and examinations rather than through headline cases.

What examiners actually found, finding by finding

The 2024 supervisory report is the closest thing to a list of what goes wrong in practice, and it reads as four distinct failures rather than a general warning.

The first is the disclosure in later contacts: examiners found collectors leaving out, in follow-up communications, the statement that they came from a debt collector. The second is outsourcing: “examiners found that the debt collectors’ service providers, when communicating about the debt with consumers on the telephone or via text message on behalf of the collectors, failed to disclose that the communication was from a debt collector” — a breach by the collector, committed by somebody else’s staff on somebody else’s platform.

The third is inconvenient times and places, and it is the one that is hardest to write a rule for, because the borrower told the collector in the conversation itself.

Examiners also identified instances in which a consumer informed a debt collector’s agent that it was a “bad time” to discuss the debt in question because they were at church without a wallet, but the agent nevertheless continued to discuss the debt.

CFPB, Supervisory Highlights issue 34, July 2024

No contact-hours rule catches that call: it was inside the window, on a number the borrower had given, at a time the dialer had no reason to doubt. The inconvenience was declared mid-conversation, in ordinary words, and the only evidence of it is the sentence the borrower spoke. The fourth failure is naming: in calls and letters examiners reviewed, collectors used names other than their true company names — which is the rule that makes a firm identifiable to a borrower who wants to complain about any of the other three.

Is collecting the wrong amount an FDCPA violation?

It can be, and it is the most-reported thing inside complaints about false statements: “the vast majority of complaints about false statements or representations were about attempts to collect the wrong amount from the consumer (91 percent)”. The rule behind it is narrow and useful, because it tests the amount against a document rather than against a feeling: a collector “must not collect any amount unless such amount is expressly authorized by the agreement creating the debt or permitted by law”, and “any amount” expressly includes any interest, fee, charge or expense incidental to the principal.

On the sample day that is one letter. An agency wrote to a borrower claiming $2,316.40 past due, including a $120.00 collection fee. The bank’s own system showed $2,196.40 on that date, and the retail installment contract behind the loan allows a late charge and no collection fee. Two separate problems in one figure: a total that does not match the record, and a component the agreement does not authorise.

A letter read against the bank’s own record

The wider version of this problem is a template. On the sample day the agency’s remediation entry records that a batch of 214 letters carried a collection fee of $75 to $120 that the contract does not allow, of which two had been mailed, with the template stopped at 08:55 the same morning. One letter is a finding; a template is a programme failure, and the difference between catching it at two letters and at two hundred is whether anything reads the letters as they go out.

Threatening what cannot be done, or is not going to be done

Two rules sit behind the familiar complaint that a collector threatened something. One is about deception: a collector must not threaten to take any action that cannot legally be taken or that is not intended to be taken. The other is about property: a collector “must not take or threaten to take any nonjudicial action to effect dispossession or disablement of property if: (1) There is no present right to possession of the property claimed as collateral through an enforceable security interest; (2) There is no present intention to take possession of the property; or (3) The property is exempt by law from such dispossession or disablement.”

Notice what both turn on: a fact about the account, not a tone of voice. “The truck will get picked up on Friday” is a breach if there is no present intention to repossess, and perfectly lawful if the assignment exists and Friday is the date. The same eight words are a finding or a note depending on a field in the servicing system.

That is why a conduct check worth having reads the account before it calls a statement false. On the sample day the sentence at 03:04 was tested against the account — no repossession assignment on the loan, the bank’s policy putting a right-to-cure letter first at 75 days, the loan at 63 — and flagged amber for a person to decide, with the rule cited and the words quoted. A check that flagged the word “repossession” alone would have produced a finding on every lawful conversation about one.

What counts as harassment under the FDCPA?

The rulebook opens the harassment section with a general prohibition — conduct the natural consequence of which is to harass, oppress or abuse any person in connection with collecting a debt — and then lists particular conduct without limiting the general rule. That structure matters: staying inside every numbered limit is not a defence to the opening sentence.

The particulars are concrete. Placing calls or engaging someone in conversation repeatedly or continuously with intent to annoy, abuse or harass. Violence or criminal means. Obscene or profane language, or language whose natural consequence is to abuse the hearer or reader. Publishing a list of consumers who allegedly refuse to pay. Advertising a debt for sale to coerce payment. Placing calls without meaningfully disclosing who is calling. And using a medium the person has asked the collector not to use.

The call-frequency presumptions sit inside that section as a safe harbour in one direction and a presumption of breach in the other: no more than seven calls to a person about a particular debt in seven consecutive days, and no call within seven days of a telephone conversation about that debt. Seven is a presumption, not a permission — six calls in a week, each placed at dinner time to a borrower who has said that is when she cannot talk, is inside the count and squarely inside the opening sentence.

The disclosure that goes missing in later contacts

Of all the breaches on this page, the missing later-contact disclosure is the one most likely to be sitting in a programme that believes it is clean, because it is an absence in a message nobody wrote by hand. The rule is one sentence: in each communication with the consumer subsequent to the initial one, the collector must disclose that the communication is from a debt collector. The channels where examiners found it missing were calls and texts sent by service providers, and electronic payment confirmations produced on collectors’ behalf.

A script review cannot find it. The script is fine; the payment confirmation was generated by a payments platform that nobody thought of as a collection channel. The only way to know is to read the contacts as sent, which is the argument set out at length in the disclosure every collections call carries.

Where each kind of breach is found: call, voicemail, text, email, letter

Organising a quality programme by rule produces a checklist that is applied unevenly, because most rules cannot break in most channels. Organising it by channel produces something testable: for each kind of contact, the short list of things that can go wrong in it, and the artefact that proves each one.

The matrix also explains why channels get checked unevenly in practice. Calls are recorded, so they feel checkable; letters are templated, so they feel safe; texts and emails are high-volume and short, so they feel trivial. The rules do not agree: the opt-out obligation exists only in the two channels that feel trivial, and the amount that breaks the unauthorised-amounts rule is most often printed on the channel that feels safe.

Severity is a design statement as much as a grading. On the sample day the 1,214 conversations with a finding break into 764 vulnerability signals, 412 amber and 38 red: the largest band is not a breach at all but a borrower saying something about illness, bereavement or lost hours that should change how the account is handled, and the smallest is the one that costs someone their score — small enough that a named person can hear every one before breakfast. Inside that smallest band, the rules are not evenly represented either.

Three of the seven rules are about who heard the conversation or when it happened rather than about what was said — the third-party disclosures, the late contacts and the calls over the seven-day count. That is the half of the rulebook a programme built around listening to calls is least equipped to see, because none of the three can be judged from the audio alone.

Why your rate and the agency’s are not the same number

Comparing an in-house team with a placed agency is the point at which most oversight programmes quietly stop measuring. The teams work different books, in different channels, at different volumes, under different scripts — and are usually assessed on different evidence, because the agency chooses what it shares.

On the sample day the four teams are compared on the same checks of every conversation, which makes the arithmetic simple: the bank’s own team had 8 red findings in 19,870 conversations, Summit Ridge 7 in 9,412, Pinegate 9 in 6,980 and Calder & Voss 14 in 5,024 — 0.40, 0.74, 1.29 and 2.79 red findings per 1,000. The last is about seven times the first. That is one day’s arithmetic on one fictional book; it is not a market figure, and nobody should read it as one. What it illustrates is the method: same rulebook, same checks, same denominator, so the comparison is about conduct rather than about who reported what.

Four teams, the same checks, one denominator each

The remediation panel is the half that oversight programmes usually lack. A score tells an agency it is behind; a letter naming four third-party disclosures and three threats, with the moments attached and a retraining plan asked for inside ten business days, tells it what to fix. In the solution nothing goes to an agency without a named person reading it first.

How a breach is found, and how big a sample would have to be

Examiners say what they do: they sample records and listen to a sample of collection calls, working from letters on paper or on screen, voice recordings, and the notes made during or after calls and visits. Regulators sample because they are auditing somebody else’s controls. A collector sampling its own conversations is doing something different: it is deciding how many breaches it is content not to see.

Where a published sample size exists, it is modest. New York City’s records rules let a licensed agency record either all of its oral communications with consumers or a randomly selected sample of at least five percent, provided it keeps the selection method and the monthly counts. That is a rule about recording rather than about reviewing, and it is worth reading as the floor it is.

The arithmetic of sampling on the sample day is on the screen itself. A 2% sample of 41,286 conversations is 826 of them, which would be expected to contain about one of the night’s 38 red findings. The other thirty-seven are in the 40,460 nobody listened to. That is the whole argument for checking everything, and it holds whatever the percentage: the breaches worth finding are rare per conversation, so a sample that is large enough to be representative is still small enough to miss almost all of them.

Thirty-eight red findings, by rule and by team

The findings a programme can defend are the ones with a person’s name on them. In the solution every red finding is heard and confirmed by the compliance analyst before it becomes a coaching item or moves an agency’s score, dismissing one needs a reason and a second signature, and every decision lands in an append-only log that can be exported for an examination. Where the third-party breaches at the top of that matrix come from is set out in what a collector may say to a relative, and the voicemail rule behind the second row in what a collector’s voicemail may say. To see the night’s findings on a day of your own conversations, start from Collections Compliance Monitoring.

Questions people ask

What are examples of FDCPA violations?

Naming the debt to someone other than the borrower; calling outside 8 a.m. to 9 p.m. at the borrower’s location; exceeding seven calls on one debt in seven days; threatening repossession where none is assigned or intended; demanding a fee the agreement does not authorise; continuing after a written request to stop or after an attorney is known; and omitting the disclosure that a later contact is from a debt collector.

What did CFPB examiners find debt collectors doing wrong?

In the 2024 supervisory report: failing to make the required disclosures in initial and later communications; service providers failing to disclose on calls, texts and payment confirmations sent on collectors’ behalf; continuing to discuss a debt after a borrower said it was an inconvenient time or place; and using company names other than their true names in calls and letters.

Can a collector threaten repossession?

Only where the facts support it. A collector must not take or threaten non-judicial action to dispossess property where there is no present right to possession through an enforceable security interest, no present intention to take possession, or the property is exempt. The same sentence is lawful or a breach depending on whether the assignment exists and is intended — which is a fact on the account, not a matter of wording.

What is an unauthorized fee under the FDCPA?

Any amount not expressly authorised by the agreement creating the debt or permitted by law, including interest, fees, charges and expenses incidental to the principal. A collection fee added to a balance where the contract allows only a late charge is the standard example, and because it usually arrives through a template it tends to appear on many letters at once rather than on one.

How are FDCPA violations found?

By comparing the contact with the account and the rulebook: the second in a recording where a debt was named, the clause in a voicemail, the timestamp converted to the borrower’s own clock, the count across seven days and every campaign, the figure on a letter against the system of record. Each has a different artefact, which is why checking organised by channel finds more than checking organised by rule.

Which debt collection complaint is the most common?

Attempts to collect a debt the borrower says is not owed, which has been the predominant issue borrowers select since debt collection complaints were first accepted. Most of those borrowers report that the debt is not theirs; others report identity theft, a debt already paid, or one discharged in bankruptcy. It is an account problem rather than a conversation problem, and no amount of listening to the call reveals it.