Debt collectors, robocalls, credit report errors and data breaches

Debt collectors: the Fair Debt Collection Practices Act (FDCPA)

• No harassment. Collectors can't threaten you, use abusive language, or call over and over to annoy you. Under Regulation F, a collector is presumed to break the rule if it calls about a particular debt more than seven times in seven days, or within seven days after a phone conversation with you about it.
• No lies. They can't pretend to be a lawyer or a government official, misstate what you owe, or threaten arrest.
• Reasonable hours. They generally can't contact you before 8 a.m. or after 9 p.m. your time, unless you agree to it. They also can't contact you at work if they know your employer doesn't allow it.
• Validation information. When a collector first contacts you, or within five days after, it must give you information about the debt, including the creditor's name, the amount, and how to dispute it.
• Disputes. If you dispute the debt in writing within 30 days, the collector has to stop collecting until it sends you written verification.
• Stopping contact. You can tell a collector in writing to stop contacting you. After that, it can generally contact you only to confirm it will stop or to tell you about a specific action, such as a lawsuit.
• Old debts. If the time to sue over a debt has run out under state law, a collector can't sue you or threaten to sue over it.

Sources: FTC, debt collection FAQs (opens in a new tab), 12 CFR § 1006.14 (opens in a new tab)

Robocalls and texts: the Telephone Consumer Protection Act (TCPA)

The TCPA (47 U.S.C. § 227) and the Federal Communications Commission's rules restrict automated calls and texts.

• Consent for robocalls and robotexts. Autodialed or prerecorded calls and autodialed texts to a cell phone generally need your prior consent, unless it's an emergency. Prerecorded telemarketing calls need your prior written consent.
• Taking back consent. Under FCC rules that took effect April 11, 2025, you can revoke consent in any reasonable way. Replying "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe" to a text counts. Callers must honor the request as soon as practicable, and no later than 10 business days.
• The National Do Not Call Registry. Registering is free and never expires. It can take up to 31 days for sales calls to stop. The registry doesn't cover political calls, charities, debt collectors, purely informational calls or surveys.
• Your own lawsuit. The TCPA lets people bring their own lawsuits for certain violations.

Sources: FCC, stop unwanted robocalls and texts (opens in a new tab), FTC, National Do Not Call Registry FAQs (opens in a new tab), 47 CFR § 64.1200(a)(10) (opens in a new tab)

Credit reports: the Fair Credit Reporting Act (FCRA)

The FCRA (15 U.S.C. § 1681 and following) covers the accuracy and privacy of the information credit bureaus collect about you.

• Free reports. You can check your credit reports from Equifax, Experian and TransUnion for free every week at AnnualCreditReport.com.
• Disputes. You can dispute inaccurate or incomplete information with the credit bureau and with the company that supplied it. The bureau generally has 30 days to investigate and must send you the results in writing.
• Old negative information. Most negative information can stay on a report for seven years, and a bankruptcy for up to ten (15 U.S.C. § 1681c).
• Identity theft. If someone opened accounts in your name, an identity theft report from IdentityTheft.gov can help you get fraudulent information blocked.

Sources: FTC, disputing errors on your credit reports (opens in a new tab), CFPB, how to dispute a credit report error (opens in a new tab)

Data breaches

There's no single federal law that requires every business to tell you about a breach, but every state has its own breach notification law. Some industries also have federal rules. Health plans and health care providers covered by HIPAA must notify affected people without unreasonable delay, and no later than 60 calendar days after discovering a breach (45 CFR § 164.404).

After a breach, you can place a credit freeze with each of the three bureaus for free, and it lasts until you lift it. A fraud alert is also free: contacting one bureau is enough, and it lasts one year. People who have had their identity stolen can get an extended fraud alert that lasts seven years.

Some breaches lead to lawsuits, including class actions. Whether you can be part of one depends on the facts and the law that applies.

Sources: FTC, credit freezes and fraud alerts (opens in a new tab), 45 CFR § 164.404 (opens in a new tab)

• A collector calls again and again, calls at odd hours, calls your work after you said not to, or threatens arrest
• A collector won't say who the original creditor is, or is collecting a debt you don't recognize or an amount you don't owe
• You get robocalls or texts you never agreed to, or they keep coming after you replied STOP
• Sales calls continue more than 31 days after you registered on the Do Not Call Registry
• Your credit report shows accounts that aren't yours or late payments that never happened, and a dispute didn't fix it
• You were turned down for credit, housing or a job because of a report error
• You received a breach notice and then found accounts or charges you didn't make

None of these on its own means you have a case. A lawyer can look at the facts.

• Credit bureau investigations: generally 30 days after the bureau receives your dispute.
• Do Not Call Registry: sales calls should stop within 31 days of registering.
• Revoking consent to robocalls and robotexts: callers must honor it within 10 business days.
• Health data breaches covered by HIPAA: notice to you within 60 calendar days of discovery, at the latest.
• If you've been sued: the deadline to respond is on the court papers, and it's usually short.

State consumer protection laws may add rights and set different deadlines.

• You've been sued over a debt, or received court papers
• A collector keeps contacting you after you asked in writing for it to stop, or has threatened you
• Robocalls or texts continue after you said stop
• A credit report error wasn't fixed after you disputed it, and it cost you credit, housing or a job
• Someone has used your identity to open accounts or take out loans

Some consumer protection laws, including the FDCPA and the FCRA, allow a court to order the company to pay a consumer's attorney's fees if the consumer wins. That's one reason some lawyers take these cases without an up-front fee. Ask how fees work before you sign anything.

• Consumer Financial Protection BureauCFPB: submit a complaintComplaints about debt collection, credit reports and other financial products. Companies generally respond within 15 days.consumerfinance.gov (opens in a new tab)
• Consumer Financial Protection BureauCFPB: debt collectionYour rights when a collector contacts you.consumerfinance.gov (opens in a new tab)
• Consumer Financial Protection BureauCFPB: how to dispute a credit report errorconsumerfinance.gov (opens in a new tab)
• Federal Trade CommissionFTC: debt collection FAQsconsumer.ftc.gov (opens in a new tab)
• Federal Trade CommissionFTC: disputing errors on your credit reportsconsumer.ftc.gov (opens in a new tab)
• Free credit reportsAnnualCreditReport.comFree credit reports from all three bureaus.annualcreditreport.com (opens in a new tab)
• Federal Trade CommissionNational Do Not Call RegistryRegister your number or report an unwanted sales call.donotcall.gov (opens in a new tab)
• Federal Communications CommissionFCC: stop unwanted robocalls and textsfcc.gov (opens in a new tab)
• Federal Communications CommissionFCC Consumer Complaint CenterFile a complaint about unwanted calls or texts.consumercomplaints.fcc.gov (opens in a new tab)
• Federal Trade CommissionReportFraud.ftc.govReport scams and fraud to the FTC.reportfraud.ftc.gov (opens in a new tab)
• Federal Trade CommissionIdentityTheft.gov: data breachesSteps based on what was exposed.identitytheft.gov (opens in a new tab)
• Federal Trade CommissionFTC: credit freezes and fraud alertsconsumer.ftc.gov (opens in a new tab)

More questions in the FAQ