Consumer financial protection law covers problems between people and the companies that collect debts, compile credit and background reports, or place automated calls and texts. It rests mainly on federal law, including the Fair Debt Collection Practices Act, the Fair Credit Reporting Act and the Telephone Consumer Protection Act.
This page explains what federal law requires of these companies and when their conduct may become a legal issue. It also covers the options the law gives a consumer and what Federal Consumer Rights is.
The Federal Statutes Behind Consumer Financial Protection
The federal core of consumer financial protection law is:
- The Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq.
- The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.
- The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227
- The Consumer Financial Protection Act (CFPA), 12 U.S.C. § 5481 et seq.
Under the CFPA, "Bureau" means the Bureau of Consumer Financial Protection, usually called the CFPB. The CFPA also lists the Fair Credit Reporting Act (except with respect to two of its sections) and the Fair Debt Collection Practices Act among its "enumerated consumer laws." The CFPB accepts consumer complaints. Its own guidance says a consumer who believes a debt collector is harassing them can submit a complaint with the CFPB.
These laws may come into play in situations such as:
- contact from a debt collector
- an error on a credit report or background-check report
- automated calls or texts that will not stop
- identity theft that has spilled onto a credit file
- a denial of credit, a job or housing based on a report
Each of these laws has its own subject. A rule from one statute does not carry over to another statute's subject. That is why the first useful question in any of these situations is which company did what.
Federal Laws That Protect Consumers in Financial Matters
The FDCPA and debt collectors
The FDCPA applies to debt collectors. Under 15 U.S.C. § 1692a(6), a debt collector is a person who uses interstate commerce or the mails "in any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect, directly or indirectly, debts owed or due or asserted to be owed or due another." The definition also includes a creditor that collects its own debts under a different name that suggests a third party is collecting. The statute lists exclusions, including a creditor's own employees collecting in the creditor's name.
Contact with other people is one example of what the FDCPA addresses. Under 15 U.S.C. § 1692c(b), a debt collector generally may not discuss a debt with anyone other than these people:
- the consumer
- the consumer's attorney
- a consumer reporting agency, if otherwise permitted by law
- the creditor
- the creditor's attorney
- the debt collector's attorney
The statute makes exceptions:
- the location-information contacts allowed elsewhere in the FDCPA
- contact with the consumer's prior consent given directly to the collector
- contact with a court's express permission
- contact reasonably necessary to carry out a postjudgment judicial remedy
The CFPB's guidance describes other conduct the FDCPA addresses. That includes harassment, such as calls or messages intended to harass, oppress or abuse. It also includes false or misleading representations, such as misstating the amount owed.
The FCRA and reports about you
The FCRA governs three groups:
- Consumer reporting agencies are companies, such as credit bureaus and background-screening companies, that gather information about people and sell it as reports.
- Furnishers are the lenders, collectors and others that send information about a consumer to those agencies.
- Users of consumer reports are the companies that rely on those reports to make decisions.
A consumer report is the report such an agency produces about a person. The FCRA's purpose, stated at 15 U.S.C. § 1681(b), is to require reasonable procedures "with regard to the confidentiality, accuracy, relevancy, and proper utilization" of that information. The FCRA also addresses subjects including:
- Reinvestigation, the agency's process for reviewing information a consumer disputes, under 15 U.S.C. § 1681i(a)
- Mixed files, which are files combining information about two different people
- Adverse action, meaning generally an unfavorable decision about a consumer that relies on a report
The TCPA and automated calls
The TCPA governs calls and texts. It defines an automatic telephone dialing system, at 47 U.S.C. § 227(a)(1), as "equipment which has the capacity (A) to store or produce telephone numbers to be called, using a random or sequential number generator; and (B) to dial such numbers." Consent and its revocation are covered below.
State law
State law may add protections, and it differs from state to state. California's rule, Cal. Civ. Code § 1788.17, requires every debt collector collecting a consumer debt to comply with a range of the FDCPA's conduct provisions. It also makes those collectors subject to the FDCPA's remedies. The statute's references to federal codes are to those codes as they read January 1, 2001. Two FDCPA provisions, including the validation-notice provision, do not apply under the California rule to certain persons. Those persons are a creditor's own officers and employees collecting in the creditor's name, affiliated collectors described in the federal definition, and their principals.
Situations Where These Laws May Apply
The question in each situation is which law covers the company and the conduct involved. Whether a particular situation violates the law always depends on its facts.
Debt-collection contact. A debt collector generally may not contact a consumer at these times or places, without the consumer's prior consent given directly to the collector or a court's express permission:
- at an unusual or inconvenient time or place
- at work, if the collector knows or has reason to know the employer prohibits such calls
Under 15 U.S.C. § 1692c(a), a collector is to assume, without knowledge to the contrary, that the convenient time is after 8 a.m. and before 9 p.m. at the consumer's location. A collector that knows a consumer has an attorney for the debt, and knows or can readily find out the attorney's name and address, generally must go through that attorney. That changes if the attorney fails to respond within a reasonable time or consents to direct contact.
Under 15 U.S.C. § 1692c(c), a consumer may notify a collector in writing that they refuse to pay or want contact to stop. After that, the collector generally may contact the consumer about that debt only for three purposes:
- to say its efforts are ending
- to say that it or the creditor may invoke specified remedies they ordinarily invoke
- where applicable, to say that it or the creditor intends to invoke a specified remedy
A notice sent by mail is complete when the collector receives it.
Some conduct may violate the FDCPA, depending on what was said and to whom. Examples include calls to relatives or an employer outside the permitted exceptions, and misrepresentations about the amount owed, which the CFPB's page lists among false, deceptive or misleading practices. Debt validation is information a collector provides about the debt it claims. A collector's handling of validation is also part of what the statute addresses. Repeated calls are covered in more depth on the page about a debt collector that keeps calling.
Credit-report errors. Several kinds of errors fall within the FCRA's reinvestigation process:
- inaccurate balances or payment history
- accounts that belong to someone else, as in a mixed file
- outdated negative information
Background-check errors. Reports used for employment or credit can be consumer reports governed by the FCRA, which includes adverse action taken on them. Tenant screening report errors are covered on their own page.
Robocalls and robotexts. Prior express consent is permission the called party gave before the call. The TCPA addresses automated or prerecorded calls made without that consent, and calls that continue after revocation, meaning the withdrawal of that consent. Under 47 U.S.C. § 227(b)(1)(A), it is unlawful to make an autodialed or artificial or prerecorded voice call to a cellular number unless one of two things is true:
- the call is made for emergency purposes
- the call is made with the called party's prior express consent
Identity theft. Several of these statutes may address what follows identity theft:
- fraudulent accounts on a credit report
- unauthorized inquiries
- collection of debts the consumer never incurred
The page on identity theft and consumer law goes further.
The CFPB notes that records "can help you if you're disputing the debt, meeting with a lawyer, or going to court." Useful records include letters, call dates and times, and notes of what was said.
Revoking Consent and Disputing a Report
Revoking consent and disputing a credit report are separate processes, and each has its own rule.
Revoking consent to robocalls and robotexts. Under 47 C.F.R. § 64.1200(a)(10), a called party may revoke prior express consent, including prior express written consent, "by using any reasonable method to clearly express a desire not to receive further calls or text messages." Several methods count as reasonable per se:
- an automated, interactive voice or key-press opt-out mechanism on a call
- a reply text using "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe"
- a website or telephone number the caller designated to process opt-out requests
If a reply text uses other words, the caller must treat it as a revocation if a reasonable person would understand it that way. A sender whose texting protocol does not allow replies must say so on each text. It must also give reasonable alternative ways to revoke. Revocations made in any reasonable manner must be honored "within a reasonable time not to exceed ten business days from receipt." Under the regulation's text, callers covered by these rules may not designate an exclusive means of revocation.
Disputing a credit report. Under 15 U.S.C. § 1681i(a), a consumer may dispute the completeness or accuracy of an item in their file. The dispute can go directly to the agency or through a reseller. The agency then generally must, free of charge, conduct a reasonable reinvestigation. It must then either record the item's current status or delete it, within 30 days of receiving the dispute.
That period may be extended by up to 15 days if the consumer sends relevant information during the 30 days. The extension does not apply if, within the 30 days, the information is found inaccurate or incomplete or cannot be verified. The agency must notify the furnisher within 5 business days, and it must consider all relevant information the consumer submits. If the agency reasonably determines that a dispute is frivolous or irrelevant, it may stop the reinvestigation. In that case it must notify the consumer within 5 business days, with its reasons and what information it needs.
What the Law Makes Available to Consumers
Each statute sets its own remedies, and each remedy depends on conditions. None of them applies automatically because something went wrong.
FDCPA. Under 15 U.S.C. § 1692k(a), a debt collector that fails to comply with a provision of the FDCPA with respect to a person is liable to that person for any actual damage sustained as a result of the failure; in an individual action, such additional damages as the court may allow, but not exceeding $1,000; and, in a successful action, the costs of the action together with a reasonable attorney's fee as determined by the court. Under 15 U.S.C. § 1692k(c), a collector is not liable if it shows by a preponderance of evidence that the violation was not intentional and resulted from a bona fide error notwithstanding the maintenance of procedures reasonably adapted to avoid any such error. Under 15 U.S.C. § 1692k(d), an action may be brought within one year from the date on which the violation occurs, and the CFPB says that for a violation of state collection law, some state laws may allow more time (CFPB).
FCRA. The FCRA has its own remedy provisions, separate from the FDCPA's. They are outlined on the page about consumer rights remedies.
TCPA. The TCPA has two separate private actions:
- 47 U.S.C. § 227(b)(3) covers the automated-call and artificial or prerecorded voice rules. It allows a person, if otherwise permitted by the laws or rules of court of a State, to bring in an appropriate court of that State an action to recover actual monetary loss or $500 in damages for each violation, whichever is greater.
- 47 U.S.C. § 227(c)(5) covers the do-not-call rules. It is available to a person who has received more than one telephone call within any 12-month period by or on behalf of the same entity in violation of the regulations prescribed under that subsection, if otherwise permitted by the laws or rules of court of a State, in an appropriate court of that State. It allows actual monetary loss or up to $500 in damages for each violation, whichever is greater. A defendant has an affirmative defense if it shows it established and implemented, with due care, reasonable practices and procedures.
Under each, the court may, in its discretion, increase the award to not more than 3 times that amount if it finds the violation willful or knowing. These are what the statute allows a court to award, not amounts any consumer is owed. The stages of a case are set out in how consumer lawsuits work.
Filing a Complaint with the CFPB or Other Federal Agencies
The CFPB says a consumer who believes a debt collector is harassing them can submit a complaint with the CFPB and can also contact their state's attorney general. The CFPB also offers sample letters that "may help you to get information, set limits on or stop any further communication, or exercise some of your rights" (CFPB).
The CFPB adds a caution. Collectors keep records too, and statements such as admitting a debt "could be used against you."
The Federal Trade Commission and the Federal Communications Commission also have roles under some of these laws. This page does not describe their complaint processes. The credit-report dispute process under 15 U.S.C. § 1681i(a), described above, is a separate route that runs directly to the reporting agency.
How Federal Consumer Rights Works
Federal Consumer Rights is a website that provides information and facilitates inquiries concerning consumer-protection matters. It is not a law firm, and it names no attorney.
A request for a case review sent through this site may be passed to attorneys. Those attorneys decide for themselves whether to respond. No response is promised, and no timeline is promised.
This site's information is about the following areas:
- debt collection
- credit reporting
- background checks under the FCRA
- calls and texts under the TCPA
- data breaches
- identity theft
- the collectors, debt buyers and credit bureaus involved in those matters
It does not address criminal matters, personal injury, family law, immigration, bankruptcy, debt relief or debt settlement. It does not address whether any particular debt should be paid. Beyond the California statute quoted above, this page does not state any state's own rules.
Requesting a Consumer Rights Case Review
This page cannot say whether any particular situation violates the law, and it does not address bankruptcy or whether a debt should be paid.
A consumer may request a consumer rights case review through Federal Consumer Rights.
