← Back to Blog

Collection Agency Rights and Your Protections: What Collectors Can and Cannot Do

Debt collectors have legal rights, but so do you. Learn exactly what collection agencies can and cannot do -- from workplace calls to third-party contacts -- and how to fight back when they cross the line.

Updated April 2026 · 15 min read · Covers FDCPA Sections 803-809

If a collection agency has started contacting you about an unpaid debt, you are probably feeling a mix of stress, confusion, and maybe even fear. You might be wondering: What are they allowed to do? Can they call my boss? Can they show up at my house? Can they take money directly from my bank account? And perhaps most importantly: what can I do to protect myself?

These are the right questions to ask. Knowledge is your most powerful defense against aggressive collection tactics. The Fair Debt Collection Practices Act (FDCPA) -- the federal law that governs how third-party debt collectors operate -- draws very clear lines between what collectors can legally do and what they cannot. The problem is that most consumers do not know where those lines are, and many collectors count on that ignorance.

This guide gives you the complete picture. We will cover the legal rights that collection agencies actually have, the restrictions that limit those rights, the specific actions that are illegal, and the step-by-step process for filing complaints and suing collectors who violate the law. By the end, you will know exactly what is fair, what is not, and what to do about it.

Know Your Rights -- Take Action Today

Use our free tool to generate a personalized debt validation letter. It forces collectors to prove they own your debt and can stop collection activity in its tracks.

Generate Your Free Letter →

What Is a Collection Agency?

A collection agency is a business that pursues unpaid debts on behalf of creditors. There are two main types: first-party collectors, which are departments within the original creditor (like a bank's internal collections division), and third-party collectors, which are independent companies hired by creditors or debt buyers to collect outstanding balances.

The FDCPA applies specifically to third-party debt collectors. This includes collection agencies, debt buyers who purchase charged-off accounts for pennies on the dollar, and attorneys who regularly collect debts on behalf of others. If your original creditor is collecting its own debt, the FDCPA generally does not apply -- although many states have their own laws that cover original creditors as well.

Understanding who is contacting you matters because it determines which laws apply. If a collection agency calls you, the FDCPA is in full force. If your credit card company calls you about your own overdue account, it is not. For more on the scope of these protections, see our guide on FDCPA rights and protections.

Collection Agencies' Legal Rights: What They CAN Do

It is important to understand that debt collectors are not powerless. They have real, legally defined tools they can use to try to collect a debt. Being surprised by these actions makes them more intimidating. Knowing they are coming makes them manageable.

✔ What Collection Agencies Can Legally Do

  • Contact you by phone, mail, email, and text message to request payment. Collectors may reach out through multiple channels, but only within the hours of 8 AM to 9 PM in your local time zone, and only at reasonable frequency.
  • Report your debt to the three major credit bureaus (Equifax, Experian, and TransUnion). A collection account on your credit report can significantly damage your credit score and remain for up to seven years from the date of first delinquency.
  • Negotiate a settlement or payment plan. Collectors can offer to accept less than the full balance or set up an installment arrangement. In fact, debt buyers often purchase debts for 4-10 cents on the dollar, so they may be willing to settle for far less than the face value.
  • File a lawsuit against you. If negotiations fail, a collector can sue you in court to obtain a judgment. If they win, they may be able to garnish your wages, place a lien on your property, or levy your bank account -- depending on state law.
  • Contact third parties to locate you. Collectors can call your family members, friends, neighbors, or employer to find your current phone number or address. However, they cannot discuss your debt with these people or contact any single person more than once.
  • Add interest, fees, and charges that were authorized by the original credit agreement or permitted by state law. They cannot unilaterally invent new fees, but they can collect what the original contract allows.
  • Transfer or sell your debt to another collection agency. This happens frequently, and each new collector starts the collection process from scratch. You may receive multiple validation notices for the same debt from different agencies.

These rights may sound intimidating, but each one is tightly constrained by the FDCPA and by state law. The next section shows exactly where those constraints come into play.

What Collection Agencies Cannot Do: Illegal Tactics

The FDCPA draws bright red lines that debt collectors must not cross. Violating any of these rules gives you the right to file complaints, demand that the behavior stop, and potentially sue the collector for damages. Here is the complete list of prohibited actions.

✘ What Collection Agencies Cannot Do

  • Call you before 8 AM or after 9 PM in your local time zone. This is one of the most commonly violated rules, and also one of the easiest to document.
  • Call you at work after you tell them to stop. Once you inform a collector that you cannot receive personal calls at your workplace, they must immediately remove your work number from their contact list.
  • Harass you with excessive or repeated calls. While the FDCPA does not specify a maximum number of calls, calling repeatedly or continuously with the intent to annoy, abuse, or harass is illegal. Courts have found violations for as few as seven calls per week.
  • Use threats, profanity, or abusive language. Collectors cannot curse at you, yell, threaten violence, or use any language "the natural consequence of which is to harass, oppress, or abuse."
  • Threaten you with arrest or jail time. There is no debtor's prison for civil debts in the United States. Any threat to have you arrested for owing money is illegal and one of the most serious FDCPA violations.
  • Falsely claim to be an attorney, police officer, or government agent. Collectors cannot impersonate law enforcement, use official-sounding titles to mislead you, or send letters that appear to come from a law firm when they do not.
  • Lie about the amount you owe. Collectors cannot inflate your debt with unauthorized fees, misrepresent the legal status of the debt, or claim you owe more than the original contract allows.
  • Discuss your debt with third parties. Collectors can contact family, friends, or your employer to locate you, but they cannot reveal that you owe a debt, ask them to pay, or contact the same person more than once.
  • Threaten to sue if they cannot or will not actually sue. Empty threats of legal action -- especially when the statute of limitations has expired -- are a clear FDCPA violation.
  • Send mail that reveals the communication is from a debt collector. Postcards, envelope markings, or any other format that exposes your debt status to third parties is prohibited.
  • Continue contacting you after a written cease and desist request. Once you send a written request to stop contact, the collector can only reach you twice more: once to acknowledge your letter and once to notify you of specific legal action.
  • Garnish wages without a court order. Collectors cannot take money from your paycheck on their own. They must sue you, win, and obtain a court-ordered garnishment. Even then, federal law caps the amount.

Can vs. Cannot: The Complete Collection Agency Rights Table

This table is your quick reference for understanding exactly where the line is drawn between legal collection activity and illegal harassment. Save it, bookmark it, or print it out -- you will want to have it handy if a collector calls.

Action Can or Cannot? Details and Conditions
Call you by phone CAN Only between 8 AM and 9 PM in your local time zone. Cannot call at times they know are inconvenient for you.
Send you letters by mail CAN Must not use postcards or any format that reveals the communication is from a debt collector. Envelope cannot display collection-related language.
Send emails or text messages CAN Must include a clear opt-out mechanism. Cannot send emails with deceptive subject lines. The CFPB's 2020 rule clarified digital communication allowances.
Call you at work CAN until you say stop Legal until you inform them -- orally or in writing -- that you cannot receive personal calls at work. After that, workplace calls are prohibited.
Report your debt to credit bureaus CAN Must report accurately. Cannot report information they know or should know is inaccurate. Collection accounts can remain on your report for 7 years.
Sue you in court CAN Must file within your state's statute of limitations. If the SOL has expired, any threat or attempt to sue is an FDCPA violation.
Garnish your wages CAN with court order Requires a court judgment first. Federal law caps garnishment at 25% of disposable earnings. Some states prohibit wage garnishment for consumer debts entirely.
Negotiate a lower settlement CAN Collectors often accept 30-60% of the balance. Debt buyers who purchased your debt for pennies may accept even less.
Call before 8 AM or after 9 PM CANNOT Clear FDCPA violation. Each call outside this window is a documentable offense. The time zone is yours, not the collector's.
Threaten arrest or jail CANNOT No debtor's prison exists for civil debts. This is one of the most serious and most commonly used illegal tactics.
Call your family about your debt CANNOT Can only contact third parties to locate you. Cannot reveal the existence of a debt, discuss details, or ask them to pay.
Use profanity or abusive language CANNOT Any language intended to harass, oppress, or abuse is prohibited. This includes name-calling, threats of violence, and repeated calls intended to annoy.
Pretend to be law enforcement or an attorney CANNOT False representation of identity, credentials, or the legal nature of the communication is a clear FDCPA violation.
Add unauthorized fees or inflate the debt CANNOT Can only collect what the original contract and state law authorize. Collection fees, processing fees, and administrative charges not in the original agreement are illegal.
Contact you after a cease and desist letter CANNOT After receiving your written request, they may contact you only twice: once to acknowledge and once to notify of specific legal action. Every contact beyond that is a violation.
Threaten to sue when the SOL has expired CANNOT Once the statute of limitations has expired, the collector cannot legally sue you. Any threat or implication that they will is an FDCPA violation.
Continue collecting while validation is pending CANNOT If you dispute the debt in writing within 30 days, the collector must stop all collection activity until they provide written validation.

Contacting You at Work: The Rules Explained

One of the most common concerns people have when dealing with collection agencies is whether the collector can call them at their workplace. The answer is nuanced, and understanding it can save you from significant embarrassment and stress.

The default rule: collectors can call you at work. If you have not told them otherwise, workplace calls are legal under the FDCPA. Collectors know this, and many will try your workplace number first because they assume you will be more motivated to resolve the debt when coworkers might overhear.

But you can shut it down with a single sentence. Under Section 805(a)(3) of the FDCPA, if you inform a debt collector -- either orally or in writing -- that you cannot receive personal calls at your workplace, they must stop calling you there immediately. You do not need to provide a reason. You do not need your employer's permission. You simply need to tell the collector that workplace calls are not permitted.

We strongly recommend making this request in writing. A written notice gives you a paper trail that proves the collector was informed. If they call your workplace after receiving your written notice, that is a clear, documentable FDCPA violation. Send the notice by certified mail with return receipt requested, and keep a copy for your records.

Beyond workplace calls, the FDCPA also prohibits collectors from contacting you at any time or place they know or should know is inconvenient. This means if you tell a collector that you work night shifts and sleeping during the day, calling you at 10 AM is a violation. If you inform them that a specific phone number belongs to a family member who is not involved in the debt, calling that number is a violation.

For a comprehensive look at how to handle persistent workplace calls, see our guide on how to stop debt collectors from calling.

Contacting Third Parties: What Collectors Can Tell Your Family, Friends, and Employer

Perhaps the most emotionally distressing aspect of debt collection is when a third party -- a family member, a friend, a neighbor, or your boss -- gets pulled into the situation. The rules around third-party contact are strict, and collectors who violate them face serious consequences.

What Collectors CAN Do With Third Parties

A debt collector can contact third parties for one purpose only: to locate you. This means they can ask for your current phone number, home address, or place of employment. They can contact your spouse, your parents, your siblings, your friends, your neighbors, and your employer -- but only to find out how to reach you directly.

What Collectors CANNOT Do With Third Parties

The restrictions are extensive:

If a collector has already discussed your debt with a third party, document exactly what was said, who was contacted, when, and how the information was revealed. This is a clear FDCPA violation that you can use as the basis for a complaint or a lawsuit. For more on documenting violations, see our detailed guide on debt collector harassment and what to do.

Time and Place Restrictions: When and Where Collectors Can Reach You

The FDCPA places specific limits on when and where debt collectors can attempt to contact you. These restrictions are designed to protect your privacy and prevent collectors from using inconvenient timing as a pressure tactic.

Permitted Hours: 8 AM to 9 PM

Debt collectors may only contact you between 8:00 AM and 9:00 PM in your local time zone. This is a hard rule with no exceptions. The time zone is yours, not the collector's. A collector in California calling you in New York at 7 AM Pacific (10 AM Eastern) is fine, but calling you at 7 AM Pacific when you are in Hawaii (12 PM Hawaii) is not -- because it would be noon your time, which is within the window. The rule is based entirely on the consumer's location.

Every call, text, or email outside this window is a potential FDCPA violation. Keep a log with the date, time, and method of contact, and save phone records as independent corroboration.

Inconvenient Times and Places

Even within the 8 AM to 9 PM window, collectors cannot contact you at a time or place they know or should know is inconvenient. If you tell the collector that you are in a hospital, at a funeral, working a night shift, or any other situation where contact would be inappropriate, they are legally required to accommodate that information.

The standard is what a "reasonable person" would consider inconvenient. Courts have generally found that calls during work hours (even within the 8-9 window) to a workplace where personal calls are prohibited qualify as inconvenient.

Frequency Limits

The FDCPA prohibits contacting you with a frequency or pattern that is intended to annoy, abuse, or harass. While the law does not set a specific number, the CFPB's 2020 Debt Collection Rule established a presumption that calling you seven or more times within seven consecutive days about a particular debt is excessive. This is not a hard cap -- calling six times could still be harassment depending on the context -- but seven calls in seven days creates a rebuttable presumption of violation.

Harassment Rules: The FDCPA's Core Protections

The heart of the FDCPA is its prohibition on harassment. Section 806 of the Act (15 U.S.C. Section 1692d) states that a debt collector may not engage in any conduct "the natural consequence of which is to harass, oppress, or abuse any person in connection with the collection of a debt." Here is what that covers in practice.

Repeated or Continuous Phone Calls

Calling you multiple times per day, every day, with the intent to annoy is illegal. The CFPB's seven-calls-in-seven-days presumption provides a concrete benchmark, but even fewer calls can constitute harassment if the pattern is clearly designed to pressure or intimidate you.

Threats of Violence or Harm

Any threat of physical harm, property damage, or reputational harm is strictly prohibited. This includes threats to "send someone to your house," "make sure your neighbors know," or "ruin your life." These are intimidation tactics designed to exploit your fear, and they are illegal.

Publication of "Deadbeat Lists"

Collectors cannot publish or threaten to publish a list of consumers who allegedly refuse to pay their debts. This was a historical practice that the FDCPA specifically outlawed. Today, this extends to posting about your debt on social media, community forums, or any public platform.

Use of Obscene or Profane Language

Profanity, cursing, name-calling, and any language designed to demean or intimidate you is prohibited. The standard is objective: would a reasonable person consider the language abusive? If yes, it is a violation regardless of whether specific curse words were used.

Anonymous or Repeated Calls Without Identification

Collectors must meaningfully disclose their identity in every communication. Calling without identifying the company, using blocked or spoofed caller ID, or failing to state the purpose of the call in written communications are all violations.

Protect Yourself Before Things Get Worse

Our free tool creates a customized, FDCPA-compliant debt validation letter in under 60 seconds. Force collectors to prove they own your debt before you pay a single cent.

Generate My Free Debt Validation Letter →

Free forever · No account needed · Instant PDF download

What Happens If a Collection Agency Violates the FDCPA?

When a debt collector breaks the law, there are real consequences -- for them and potentially for you in the form of compensation. Here is what the enforcement landscape looks like.

Regulatory Enforcement

The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) are the primary federal agencies responsible for enforcing the FDCPA. When they identify patterns of violations, they can take enforcement actions that include:

The CFPB has brought dozens of enforcement actions against debt collection agencies since its creation. In recent years, major agencies have been fined millions of dollars for systematic FDCPA violations. Your individual complaint contributes to these larger enforcement efforts.

Your Private Right of Action

Beyond regulatory enforcement, the FDCPA gives you a private right of action -- meaning you can sue the collector yourself. This is where the real teeth of the law come into play. You do not need to wait for the government to act. You can file your own lawsuit in state or federal court.

The damages available in an FDCPA lawsuit include:

Statute of Limitations for FDCPA Lawsuits

You have one year from the date of each FDCPA violation to file a lawsuit. This means if a collector violated your rights on January 15, 2025, you must file suit by January 15, 2026. However, if the collector continued to violate your rights over several months, each new violation starts its own one-year clock. So you can sue for the most recent violations even if older ones have expired.

It is best to act quickly. Document every violation as it happens, and consult an attorney as soon as you notice a pattern. For a deeper dive into what violations you can sue for and how to build a case, see our guide on FDCPA violations you can sue for.

How to File a Complaint Against a Debt Collector

Filing a complaint is free, takes only a few minutes, and creates an official record that can lead to enforcement action against the collector. We recommend filing with multiple agencies to maximize the impact.

1

Consumer Financial Protection Bureau (CFPB)

File at consumerfinance.gov/complaint. The CFPB forwards your complaint to the company and requires them to respond within 15 days (60 days total to close). You can track the status of your complaint online. This is the most effective federal complaint channel because the company is required to respond.

2

Federal Trade Commission (FTC)

File at reportfraud.ftc.gov. The FTC does not resolve individual complaints but uses them to identify patterns of misconduct and build enforcement cases. The FTC has brought major enforcement actions against debt collectors based on consumer complaints.

3

Your State Attorney General

Every state has a consumer protection division within the attorney general's office. Many states have their own debt collection laws that provide additional protections beyond the FDCPA. Your state AG may be able to mediate the dispute, take enforcement action, or provide guidance on your specific situation. Find your state AG at naag.org.

4

Your State's Financial Regulatory Agency

Many states license and regulate debt collection agencies through a banking or financial services department. If a collector is operating without a required license or violating state-specific rules, the regulatory agency can take direct action against their license. Search for "[your state] debt collector licensing complaint" to find the right form.

5

Dispute With Credit Bureaus

If a collector is reporting inaccurate information about your debt, file disputes directly with Equifax, Experian, and TransUnion. Under the Fair Credit Reporting Act (FCRA), credit bureaus must investigate disputes within 30 days. If the collector cannot verify the accuracy of the information, the entry must be corrected or removed from your credit report.

How to Sue a Collection Agency

Suing a debt collector under the FDCPA is more accessible than most people think. You do not need to be a legal expert, and you do not need deep pockets. Here is how the process works.

Step 1: Gather Your Evidence

Before filing a lawsuit, you need documentation. Collect the following:

Step 2: Find an FDCPA Attorney

The National Association of Consumer Advocates (NACA) maintains a directory of consumer protection attorneys at naca.net. You can also contact your state bar association for a referral. Most FDCPA attorneys offer free initial consultations and work on contingency, meaning you pay nothing unless you win. The attorney fee provision of the FDCPA makes it financially viable for lawyers to take even small cases.

Step 3: File Your Lawsuit

Your attorney will file the lawsuit in either state or federal court, depending on the circumstances. FDCPA claims can be brought in either jurisdiction. The lawsuit will allege specific FDCPA violations, describe the damages you suffered, and request the relief you are entitled to -- statutory damages, actual damages, emotional distress damages, and attorney fees.

Step 4: Settlement or Trial

Most FDCPA cases settle before trial. Collectors know that the fee-shifting provision means they will pay your attorney's costs regardless of the outcome, so they have a strong incentive to resolve cases quickly. Settlement amounts vary widely depending on the severity and number of violations, but typical individual FDCPA settlements range from $1,000 to $15,000, with more egregious cases resulting in significantly higher payouts.

If the case goes to trial and you win, the judge or jury will determine the amount of damages. Federal courts have consistently upheld emotional distress awards in FDCPA cases, recognizing that the harm from debt collector harassment is real and compensable even without physical injury.

What to Do Right Now: Your Action Plan

If a collection agency is contacting you, here is your immediate step-by-step plan to protect your rights:

  1. Do not panic and do not ignore it. Acknowledge the situation, but do not let fear drive your decisions. Do not ignore the collector completely, because that allows them to pursue legal remedies without resistance. Instead, take control of the situation using your legal rights.
  2. Request debt validation immediately. Within 30 days of the collector's first written contact, send a debt validation letter. This forces the collector to prove that you owe the debt and that they have the legal right to collect it. Until they provide validation, they must stop all collection activity. Use our free debt validation letter generator to create a professional, FDCPA-compliant letter in under 60 seconds.
  3. Start a communication log today. Write down every interaction -- date, time, method, what was said, and who you spoke with. Save all letters and emails. This log is your most powerful evidence if the collector violates the law.
  4. Tell the collector not to call you at work. If they are reaching you at your workplace, inform them immediately -- preferably in writing -- that you cannot receive personal calls there. They must comply.
  5. Check the statute of limitations. If the time limit for suing on your debt has expired in your state, the collector cannot legally force payment through the courts. See our guide on the statute of limitations on debt for state-specific information.
  6. File complaints for any violations. If the collector has called outside permitted hours, threatened you, contacted third parties improperly, or engaged in any other illegal conduct, file complaints with the CFPB, FTC, and your state attorney general.
  7. Consult an FDCPA attorney if violations are severe. If the harassment is ongoing, if the collector has ignored your cease and desist letter, or if you have suffered significant emotional or financial harm, speak with a consumer protection attorney about your options for a lawsuit.

Frequently Asked Questions

What are a collection agency's legal rights?

Collection agencies have the right to contact you by phone, mail, email, and text to request payment; report your debt to credit bureaus; negotiate settlements; and pursue legal action including lawsuits and wage garnishment (with a court order). However, all of these actions are bounded by the Fair Debt Collection Practices Act (FDCPA), which prohibits harassment, deception, and unfair practices. Understanding both sides of this equation -- what they can and cannot do -- is the key to protecting yourself.

Can a debt collector contact me at work?

Yes, but only if you have not told them otherwise. Under the FDCPA, if you inform a debt collector -- orally or in writing -- that you cannot receive personal calls at your workplace, they must stop calling you there immediately. They also cannot contact you at any place or time they know is inconvenient, and never before 8 AM or after 9 PM in your local time zone. We recommend making this request in writing via certified mail so you have a paper trail.

Can a collection agency contact my family or employer about my debt?

Only to locate you. A debt collector can contact third parties such as family members, friends, neighbors, or your employer to find your phone number or address. However, they cannot tell these people that you owe a debt, cannot ask them to pay on your behalf, cannot contact the same person more than once, and cannot use postcards or any mail format that reveals the communication is from a debt collector. Any disclosure of your debt status to a third party is a clear FDCPA violation.

What happens if a debt collector violates the FDCPA?

If a debt collector violates the FDCPA, you can file complaints with the Consumer Financial Protection Bureau (CFPB), the Federal Trade Commission (FTC), and your state attorney general. You also have the right to sue the collector in state or federal court within one year of the violation. You can recover statutory damages of up to $1,000, plus actual damages for things like emotional distress or lost wages, and the collector must pay your attorney fees if you win.

Can I sue a debt collector for harassment?

Yes. Under the FDCPA, you can sue a debt collector for harassment, false statements, unfair practices, and other violations. You can recover up to $1,000 in statutory damages per lawsuit, plus actual damages, attorney fees, and court costs. Many consumer protection attorneys take FDCPA cases on contingency, meaning you pay nothing unless you win. For a comprehensive list of actionable violations, see our guide on FDCPA violations you can sue for.

How do I file a complaint against a debt collector?

You can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint, the Federal Trade Commission at reportfraud.ftc.gov, and your state attorney general's consumer protection division. Each complaint creates an official record and can trigger regulatory action against the collector. The CFPB forwards your complaint to the company and tracks their response, making it the most effective individual complaint channel.

Can a debt collector garnish my wages?

A debt collector cannot garnish your wages on their own. They must first file a lawsuit, win a judgment in court, and then obtain a court order for garnishment. Even then, federal law limits wage garnishment to the lesser of 25% of your disposable earnings or the amount by which your weekly income exceeds 30 times the federal minimum wage. Some states provide even stronger protections, and a few states (including Texas, Pennsylvania, South Carolina, and North Carolina) prohibit wage garnishment for most consumer debts entirely.

How many times can a debt collector legally call me?

The FDCPA does not specify a maximum number of calls. However, the CFPB's 2020 Debt Collection Rule established that calling you seven or more times within seven consecutive days about a particular debt creates a presumption of excessive contact. Even fewer calls can be harassment if the pattern is clearly intended to annoy or intimidate. The key test is intent and effect, not just the raw number.

Related Articles