Debt collections: what changes when a machine does the chasing

Which federal rules bind an automated collections message, whose name decides it, why what is owed matters, and what a program has to track that a person used to handle by habit.

By the Foxnut team · Updated 14 August 2026

What this page means by “debt collections”

A business chasing its own customers for money already owed is the subject here: reminders, calls, texts and letters about an unpaid invoice or account, sent by the company that is owed the money or by whoever it has authorised to send them. Before any of the rules below, the transfer standard for a system that talks to customers is worth reading first, because a collections build is one of the few processes in this pillar that reaches past the company’s own systems and puts a message in front of a person who never chose the vendor or agreed to the schedule.

What changes when a machine does the sending is not the arithmetic. A computed balance is no harder to work out here than anywhere else in this pillar. What changes is the audience - a robot that texts a customer at 3am about a balance is not a technical achievement, it is a lawsuit that has not been filed yet. Every other process this page’s siblings cover moves a number between systems the company itself operates. This one addresses a person directly, and where that person owes a personal debt rather than a business one, the contact is governed by a body of federal law written specifically for it. The rules that follow bind a script exactly as they bind a person reading from one; automating the process does not automate away the obligation, and for this process in particular, exact compliance is closer to the whole design problem than to a footnote on it.

Who is chasing decides which rules apply

Two facts about a collections message decide which federal regime, if either, governs it, and neither fact is about what the message says.

The first is who is sending it. Regulation F, the CFPB’s rule implementing the Fair Debt Collection Practices Act, defines a “debt collector” as a business whose principal purpose is collecting debts, or anyone who regularly collects debts “owed or due, or asserted to be owed or due, to another.” It specifically excludes “any officer or employee of a creditor while the officer or employee is collecting debts for the creditor in the creditor’s name” - a company reminding its own customer about its own invoice, under its own name, generally sits outside the Act altogether. The exclusion has a named limit: a creditor that, “in the process of collecting its own debts, uses any name other than its own that would indicate that a third person is collecting” is a debt collector regardless of who actually owns the account. The name on the message, not the software behind it, is what moves a build in or out of the Act’s reach.

The second is what is owed. Regulation F defines “debt” as an obligation “primarily for personal, family, or household purposes” - a consumer’s obligation. An invoice one business owes another does not meet that definition on any reading of it, so a business-to-business collections process sits outside the FDCPA and Regulation F entirely, no matter who sends the reminder or how often.

Neither exclusion reaches the Telephone Consumer Protection Act. The FCC’s implementing rule opens with “No person or entity may” place a call using an automatic telephone dialing system or an artificial or prerecorded voice to a cellular number without the called party’s prior express consent - a restriction that attaches to the call itself, regardless of who is calling or what is owed. A build that sits entirely outside Regulation F, because it is a first-party creditor collecting a commercial invoice under its own name, can still sit inside the TCPA the moment its outreach is an autodialer or a synthesized voice reaching a mobile number.

	Regulation F / FDCPA	TCPA
Original creditor, own name, consumer debt	Generally excluded (creditor-in-own-name exclusion)	Applies if the call is autodialed or uses an artificial or prerecorded voice to a cell number
Original creditor, a name suggesting a third party, consumer debt	Applies - treated as a debt collector	Applies under the same condition
Third-party collector or debt buyer, consumer debt	Applies in full	Applies under the same condition
Any of the above, commercial (business-to-business) debt	Excluded - the debt itself is outside the Act’s definition	Applies under the same condition; the TCPA carries no consumer-debt limit

What an automated program has to enforce that a person used to absorb by habit

A person collecting by hand rarely calls the same number eight times in a week. A queue generated by a scheduler will, unless something stops it. Regulation F’s answer is a specific bound: a collector is presumed to comply if it places no more than seven calls about a particular debt in seven consecutive days, and none within seven days of an actual conversation about that debt, with the conversation date restarting the count. A person following a hunch stays inside that bound by accident; a program has to hold the count on purpose, per debt, across channels, and reset it correctly the moment a call connects.

Time zone is the same problem in a different shape. The rule presumes any contact before 8 a.m. or after 9 p.m. “at the consumer’s location” to be inconvenient, which makes the sender’s own working hours irrelevant - what governs is the recipient’s clock. The CFPB’s 2025 supervisory findings describe exactly the failure this produces at scale: examiners found that collectors “sent payment reminder emails to the consumer before 8 a.m. in the consumer’s time zone,” the specific mistake a system makes when it schedules from the sender’s calendar instead of resolving each recipient’s local time first.

Consent and disclosure carry the same per-message weight rather than a one-time one. Every communication after the first has to disclose that it is from a debt collector; the same 2025 findings note this failed specifically at “service providers” acting on collectors’ behalf sending confirmations by text - the vendor layer failing a disclosure rule a trained human agent repeats by rote. A request to stop using one channel binds only that channel under the rule, so a system needs a channel-level opt-out per account rather than one blanket flag, and a request to stop entirely triggers a near-total halt with a short, named list of exceptions. None of this is a judgment call once it is written down. All of it is state that has to stay correct, per account, per channel, continuously.

What the decision turns on

Six structural dimensions decide whether a process is worth automating. Debt collections reads unusually on most of them, because the thing being measured is not a transaction error but a communication rule, and the rule is written down to a level of specificity most of this pillar never receives.

Debt collections: process profile
Dimension	What it reads on debt collections	Source
Exception variance	Defined by channel and pace, not by the amount owed. The exception a system throws here is rarely a wrong balance; it is a cadence or consent rule crossed - more than seven calls about one debt inside seven days, contact before 8 a.m. or after 9 p.m. at the recipient's own clock, or a message sent through a channel the customer already asked the company not to use. A 2025 supervisory review found this exact failure already occurring at scale: collectors' own emailed reminders going out before 8 a.m. in the recipient's time zone.	12 CFR 1006.6(b)(1), 1006.14(b)(2); CFPB, Fair Debt Collection Practices Act CFPB Annual Report 2025
Volume	High by design, and the design goal is also the risk. The CFPB received about 207,800 debt collection complaints in 2024, seven percent of every complaint it received that year. Among complaints naming a communication problem, the largest single sub-issue by a wide margin was frequent or repeated contact - 51% of communication-tactics complaints and 58% of electronic-communication complaints. A program built to raise the number of touches per account is tuning the exact variable most complaints describe.	CFPB, Fair Debt Collection Practices Act CFPB Annual Report 2025
Cost of an error	Priced per communication rather than per account. FDCPA civil liability runs to actual damages plus up to $1,000 in an individual action, or the lesser of $500,000 or one percent of the collector's net worth in a class action, within a one-year limitations period. A bona fide error defense exists, but only where the collector maintained procedures reasonably adapted to avoid the violation - documented automation is the shield the statute itself describes. The TCPA prices an unauthorised autodialed or prerecorded call to a mobile number separately, at $500 per violation, trebled to a court's discretion up to $1,500 if willful - by the call, not by the campaign.	15 U.S.C. 1692k(a)-(d); 47 U.S.C. 227(b)(3)
Reversibility	A sent message cannot be unsent, and the law treats a written dispute as a hard stop rather than a note to fix later. Once the validation notice is sent, a 30-day validation period runs, and a dispute lodged in writing within it requires the collector to cease collection until it sends verification. An automated program has to be able to halt itself on that one written signal, mid-sequence, for that one account, immediately - the fix is not a better message next time, it is nothing further until a document exists.	12 CFR 1006.34(b)(5), (c)
Regulatory exposure	Depends on who is calling and what is owed, more sharply than elsewhere in this pillar. Regulation F binds only a defined 'debt collector,' and that definition excludes a creditor collecting its own debt in its own name; it also covers only debt owed for personal, family or household purposes, so a business-to-business invoice is outside the Act regardless of who calls. The TCPA carries neither carve-out - its restriction on autodialed or artificial-voice calls to a cell number applies to any person or entity, consumer debt or not, the instant the call reaches a mobile number. The same automated dialer can be fully outside one regime and fully inside the other, on the same call.	12 CFR 1006.2(g)-(i); 47 CFR 64.1200(a)(1)
Vendor market maturity	Regulator-shaped rather than market-shaped, unusually for this pillar. Regulation F does not merely tolerate automated contact, it specifies the shape it must take: a fixed, closed list of what a compliant voicemail may say, called a limited-content message, and documented safe-harbor procedures for exactly when a collector may text or email an address without a live, channel-specific consent record. A regulator writing down the permitted content of an automated voicemail is a level of specificity most processes in this pillar never receive. The 2025 supervisory findings treat vendors acting 'on behalf of' collectors as an established, examined layer of that market, not a novelty.	12 CFR 1006.6(j), 1006.6(d)(3)-(5); CFPB, Fair Debt Collection Practices Act CFPB Annual Report 2025

The regulatory-exposure row is the one that reframes the rest. It says the same automated dialer can be lawful under one regime and unlawful under another on the same call, because Regulation F and the TCPA are triggered by different, independent facts - who is collecting and what is owed, against how the call is placed and where it lands. The vendor-maturity row says the regulator has already done unusually specific design work on the automation question itself, down to what an automated voicemail is permitted to say. Between them, they describe a process where the compliance boundary is not a matter of interpretation once the three triggering facts are known, and most of the engineering is keeping the system honest about which of those facts is true for any given account.

What this usually gets wrong

The first error is reading the frequency and timing rules as a ceiling on effectiveness rather than as the actual design brief. Seven contacts a week is not a target to approach; the CFPB’s own complaint data names frequent or repeated contact as the largest single communication complaint by a wide margin, so the rule and the most common complaint describe the same behaviour from opposite sides. A program tuned to maximise touches per account is optimising the variable customers complain about most.

The second error is treating automation as a way to shrink the disclosure and consent burden rather than a way to multiply it. Every message a program sends after the first one still needs the debt collector disclosure attached; every autodialed or synthesized-voice call to a mobile number still needs consent captured and kept, per number. A build that sends ten times as many messages needs the same compliance check run ten times as often, not once at the top of the design.

The third error is assuming the FDCPA’s protections travel with the word “collections” rather than with the debt. A business-to-business collections process, chasing one company’s unpaid invoice from another, sits outside the Act’s definition of debt entirely; borrowing Regulation F’s rules there answers a question nobody asked, and the actual design problem for that case sits closer to a receivables and cash-application question than to a communications-compliance one.

The fourth error is treating the bona fide error defense as something a business already has rather than something a system has to earn. The defense does not forgive a mistake; it forgives a mistake made despite procedures reasonably adapted to avoid it. That makes the documentation of the automated program’s rules, its logs and its overrides the difference between an error and a court finding intent, not a compliance afterthought layered on top of the build.

The verdict

The evidence supports automating the sending and the tracking, with a person kept in the loop for exactly the two moments the law treats as hard stops: a written dispute, and any request to stop using a channel or to stop entirely. Everything between those two moments - the count, the clock, the disclosure line, the consent record - is a rule with a stated boundary rather than a judgment call, and a rule with a stated boundary is what software enforces more reliably than a rota of people working from memory and a spreadsheet.

The regulatory-exposure row should set the design before any other row is considered. Whether Regulation F attaches at all turns on two facts fixed before the first message is drafted: whose name is on the communication, and whether the amount owed is a consumer’s personal debt or one business’s invoice to another. The TCPA attaches or does not on a third, independent fact - whether the outreach is an autodialed or synthesized-voice call to a mobile number - that is indifferent to either of the first two. A design built against only one of the three questions will pass its own tests and still be wrong on the ones it never asked.

For a team weighing this, the cheap check is a count rather than a demonstration. Pull the messages sent to one account in its worst week of contact and set them against the actual rule: no more than seven calls in seven days about that debt, nothing before 8 a.m. or after 9 p.m. at the recipient’s own clock, the collector disclosure present on every message after the first, and a record of consent behind every autodialed or synthesized call to a mobile number. An account that fails any one of those on paper says more about what an automated program has actually been doing than any dashboard will. We would rather help you build the version that passes that check than watch you find out the hard way it did not - tell us where your program stands.

Sources

Foxnut Studios works on briefs like this one from Bengaluru and Paris. If you want the shape of that before you talk to anyone, here is how an AI engagement is scoped and priced.