TCPA, FDCPA, and CFPB Complaints: The Borrower's Playbook

Most borrower complaints in short-term lending sit under three federal frameworks that almost nobody outside the consumer-rights bar uses well. The Telephone Consumer Protection Act pays $500 to $1,500 per illegal call or text. The Fair Debt Collection Practices Act pays up to $1,000 per lawsuit plus attorney's fees against third-party collectors. The CFPB complaint portal is free, public, and gives the company 15 days to acknowledge and up to 60 days to provide a final response. File the CFPB complaint first, build a written evidence kit, and bring in a private attorney for the severe TCPA or FDCPA cases. Both statutes shift legal fees to the defendant, which is the part that makes any of this realistic for borrowers without money to spend.

The screenshot a reader sent me last fall showed 14 calls from the same 800 number over 36 hours. Six of them after 9 p.m. Two on a Sunday morning. She had asked them to stop twice, once by phone and once by email. The collector kept dialing. She wanted to know if there was anything she could actually do, or if "consumer rights" was one of those phrases that sounds nice on a government website and means nothing in practice.

There is something she could do. There are several somethings, actually, and most of them are free. The problem is that the rules sit across three federal statutes, a couple of new FCC orders that took effect in 2025, and a complaint portal most borrowers have never used. This is the playbook.

The Three-Law Map

Most borrower complaints fall under one of three federal frameworks. Knowing which one your situation falls into determines where you file and what you can recover.

TCPA (Telephone Consumer Protection Act). Governs calls and texts, especially anything autodialed or pre-recorded, and anything that uses an artificial or pre-recorded voice. Statutory damages are $500 per violation, up to $1,500 if the violation was willful or knowing, under 47 U.S.C. 227(b)(3). Private right of action. You can sue.

FDCPA (Fair Debt Collection Practices Act). Governs third-party debt collectors, not the original lender. Codified at 15 U.S.C. 1692 et seq. Statutory damages up to $1,000 per lawsuit, plus actual damages and attorney's fees under 15 U.S.C. 1692k. One-year statute of limitations from the date of the violation. Also a private right of action.

CFPB complaint database. The catch-all. Covers original creditors, debt collectors, mortgage servicers, prepaid card issuers, payday and short-term lenders, credit reporting agencies, and basically anything else in consumer financial services. Not a court. It is a complaint pipeline and a public record. The CFPB forwarded over 1.3 million complaints in its most recent reporting year (verify the current figure on the CFPB Annual Report before relying on it in a filing).

State analogs matter too. California's Rosenthal Fair Debt Collection Practices Act extends FDCPA-style rules to original creditors. New York's General Business Law 600 series does similar work. Massachusetts uses Chapter 93A to reach unfair and deceptive practices broadly. If the federal law does not seem to fit your situation, your state attorney general's consumer protection bureau probably has a parallel rule.

The 2025 TCPA Changes That Quietly Rewrote the Game

Two FCC orders changed what counts as legal contact in the last year. Both apply now.

The one-to-one consent rule, effective January 27, 2025. Under updates to 47 CFR 64.1200, a consumer's prior express written consent to receive marketing calls or texts must run to a single seller at a time. The consent must be "logically and topically associated" with the consumer's original interaction. Translation: if you filled out one loan inquiry form, that form cannot legally send your phone number to 30 unrelated lenders for autodialed contact. (Note: the FCC delayed certain implementation pieces during 2025-2026; check the current FCC docket before filing a TCPA case that relies specifically on the one-to-one rule.)

The original docket reference is FCC public attachment DA-25-312 and the underlying Second Report and Order from 2023. This is a real change with real teeth, and the lead-generation industry has been visibly scrambling to comply.

Opt-out updates, effective April 11, 2025. Opt-out requests must be honored within 10 business days. You can revoke consent through "any reasonable means," not just the specific method the company prefers. A "STOP" text counts. A verbal request during a phone call counts. An email reply counts. The company cannot require you to fill out a specific form on a specific portal to opt out.

Both rules sit on top of the existing TCPA framework prohibiting autodialed or pre-recorded calls and texts without prior express written consent for marketing, and prior express consent (without "written") for non-marketing.

The FDCPA, in Plain English

The FDCPA covers third-party debt collectors. If the original lender is calling you about its own loan, the FDCPA does not directly apply at the federal level, although state mini-FDCPAs may. Once the debt is sold or assigned to a collection agency, the FDCPA kicks in fully.

Here are the rules collectors break most often:

• The seven-in-seven rule. Under Regulation F (12 CFR 1006.14), a collector cannot call you more than seven times in seven consecutive days about the same debt. After they have a telephone conversation with you, they cannot call again within seven days.
• The 8 a.m. to 9 p.m. window. Calls outside that window in your local time are presumptively unlawful under 15 U.S.C. 1692c without your consent.
• The mini-Miranda. A collector must identify itself as a debt collector and disclose that the communication is an attempt to collect a debt. Skipping this is a violation.
• Third-party contact. A collector generally cannot tell your mother, neighbor, coworker, or anyone else that you owe a debt. They can call to ask for "location information" only, and only once unless they reasonably believe the earlier answer was wrong.
• Workplace calls after you say no. Once you tell the collector your employer does not allow these calls, calling you at work is a violation.
• Threats of arrest, criminal prosecution, or imaginary lawsuits. A collector cannot threaten action it does not actually intend to take or that it cannot legally take. "If you do not pay today you will be arrested" is a textbook violation. Not paying a consumer debt is not a crime in any U.S. state.
• Validation rights. Within five days of first contacting you, the collector must send a validation notice with the amount of the debt, the creditor's name, and your right to dispute. You can dispute the debt in writing within 30 days and the collector must stop collection until they verify it.

The Evidence Kit You Build Today

Before you file anywhere, build a paper trail. This is the part that separates a complaint that gets ignored from one that gets a response.

1. A call log. Date, time, phone number, who you spoke to, what they said. Screenshots of your phone's recent-calls list count. If your state is a one-party consent state for call recording, record the calls. Confirm your state's rule first.
2. Screenshots of every text message. Including the sender's number, the timestamp, and any link or "reply STOP" instruction.
3. Every written communication. Letters, emails, validation notices, account statements. Keep the envelopes.
4. A timeline. A simple chronological list of what happened, written in your own words while it is fresh. This becomes the narrative section of any complaint you file.

If you eventually need an attorney, this evidence kit cuts intake time in half and often determines whether the case is worth taking.

Where to File, in Order

1. CFPB

Start at the CFPB complaint portal for almost any complaint involving a financial product or service. The CFPB forwards the complaint to the company, the company has 15 days to acknowledge and up to 60 days to provide a final response, and your complaint becomes part of the public CFPB Consumer Complaint Database. Companies pay attention to that database. Recurring complaints draw enforcement scrutiny.

The CFPB does not adjudicate your debt or order the company to pay you. It is a pressure tool and a record. Use it.

2. State Attorney General

Find your state AG's consumer protection division and file there too. The AG has authority over state UDAP statutes and state-specific consumer lending laws that the CFPB does not directly enforce. Some state AG offices, like New York and California, are aggressive on unlicensed lending and lead-generation abuse.

3. FCC (for TCPA-specific call and text issues)

For unwanted robocalls, robotexts, or violations of the one-to-one consent rule, file with the FCC at consumercomplaints.fcc.gov. The FCC issues fines and can take licenses. It does not get you a payout, but it creates a public regulatory record.

4. FTC (for general unfair and deceptive practices)

For broader fraud and deceptive-practice complaints, file at ReportFraud.ftc.gov or call 1-877-FTC-HELP. The FTC handles cross-border scams, identity theft, and pattern-of-practice cases.

5. Private Attorney

This is the one most borrowers skip. TCPA and FDCPA both shift attorney's fees to the defendant if you win, which is why many consumer-rights firms take these cases on contingency. You pay nothing up front. The lawyer gets paid out of the recovery. For TCPA cases especially, statutory damages of $500 to $1,500 per violation can add up fast when a collector called you 30 times.

The National Association of Consumer Advocates maintains a free directory of member attorneys by state. Legal aid offices screen FDCPA and TCPA matters in many states. Both are reasonable starting points.

What to Expect After You File

A CFPB complaint typically gets an initial response from the company within 15 days and a final response within 60. Most responses are some version of "we have reviewed your account and the account is accurate." That is normal. The point is to create the record and surface the pattern.

The FCC and FTC rarely respond to individual complainants beyond an acknowledgment. They use the complaints in aggregate to drive enforcement against repeat offenders. Your individual filing is one data point in a much larger investigation.

A private TCPA or FDCPA case moves on the litigation clock, which means months, not days. The attorney will usually send a demand letter first. Many cases settle pre-suit, which is why building the evidence kit early matters.

When to Call a Lawyer

Call if:

• A collector has called more than 10 times in a week despite your request to stop.
• You are getting calls or texts from a lender or lead generator you never applied to.
• A collector threatened arrest, jail, or contacting your employer.
• A collector discussed your debt with a third party (relative, neighbor, coworker).
• You are being sued by a debt collector and you need to respond to a complaint or summons. See our missed-payment timeline for what a real summons looks like.
• The lender violated the Military Lending Act on a loan made to you as an active-duty service member or military dependent. We cover the MAPR cap and remedies in the MLA piece.

The fee-shifting structure of TCPA and FDCPA means a real lawyer is more accessible than most borrowers assume. Statutory damages plus attorney's fees often make a $500 case worth filing.

How to Revoke Consent for Text Messages and Calls

Under the April 2025 FCC opt-out rules, you can revoke consent by any reasonable means. Reply "STOP" to any text. Send an email. Tell the caller verbally. Send a certified letter if you want to nail down the date for evidence. The company has 10 business days to honor the revocation. After that, every call or text is a presumptive TCPA violation.

If the calls keep coming, log every one. Each violation is potentially a separate $500 to $1,500 claim.

What to Do Right Now

Build the evidence kit today. Send a single written revocation of consent (text reply, email, or certified letter) to whichever entity is calling you. File the CFPB complaint within the next 48 hours while the events are fresh. If the conduct is severe (threats, third-party contact, calls after revocation), make the call to a consumer-rights attorney before the one-year FDCPA clock runs out.

The rules exist. The complaint portals work. The fee-shifting statutes are real. The reason most borrowers do not use any of it is that nobody walks them through the steps. Now you have the steps.

Frequently Asked Questions