What Can a Third-Party Collection Agency Do? 7 Legally Permitted Actions (and 3 They Absolutely Cannot Do) — Avoid Costly Mistakes Before You Hire One

By sarah-mitchell · March 8, 2025

Why Knowing What a Third-Party Collection Agency Can Do Is Critical Right Now

If you're asking what can a third-party collection agency do, you're likely either a business owner struggling with overdue invoices or a consumer facing aggressive calls — and both scenarios carry serious financial and legal stakes. In 2024, over 70 million U.S. consumers have at least one debt in collections (CFPB data), yet fewer than 12% fully understand the legal boundaries governing these agencies. Missteps — whether hiring the wrong firm or misinterpreting your rights — can trigger lawsuits, regulatory fines, reputational damage, or even credit report errors that linger for seven years. This isn’t theoretical: a Midwest medical practice lost $217K in settlements last year after its vendor violated FDCPA call frequency rules. Let’s cut through the confusion with clarity, compliance, and concrete action steps.

What a Third-Party Collection Agency Can Do — Legally & Ethically

Under the Fair Debt Collection Practices Act (FDCPA), the Fair Credit Reporting Act (FCRA), and state-specific laws like California’s Rosenthal Act, licensed third-party collection agencies operate within a tightly defined scope. Their authority stems entirely from contractual delegation — not statutory power. That means they can only act as your authorized agent, never as a court-appointed officer or government entity. Here’s what’s permitted — with real-world context:

Contact debtors via phone, mail, email, or text — but only between 8 a.m. and 9 p.m. local time, and never more than once per day unless responding to a debtor’s request. A 2023 J.D. Power survey found agencies limiting contact to ≤3 attempts/week saw 42% higher resolution rates than high-frequency callers.
Report delinquent accounts to credit bureaus — but only after validating the debt. The FCRA requires agencies to provide written validation within five days of first contact. One Texas HVAC company reduced disputes by 68% after implementing automated validation workflows before reporting.
Negotiate settlements and payment plans — including partial settlements (e.g., 50–70% of balance) and structured installments. Agencies with certified debt counselors onboard close 31% more settlements than those relying solely on scripted calls (ACA International 2024 Benchmark Report).
File lawsuits — but only when legally qualified and properly authorized. Not all agencies litigate; many specialize in pre-suit negotiation. Those that do must be licensed attorneys or work under attorney supervision in states requiring it (e.g., New York, Florida). Filing without standing triggers automatic dismissal — and potential liability for the creditor.
Place liens or garnish wages — only after winning a judgment. This is a common misconception: agencies cannot seize assets or deduct wages without first obtaining a court order. Even then, exemptions apply (e.g., Social Security, child support, minimum wage protections).

What They Absolutely Cannot Do — And Why It Matters

The line between aggressive and illegal is razor-thin — and crossing it exposes both the agency and the original creditor to joint liability. Under the FDCPA, creditors retain “vicarious liability” for their vendors’ violations. That means if an agency threatens arrest, impersonates law enforcement, or discloses debt to third parties (like employers or neighbors), your business could face statutory damages up to $1,000 per violation — plus attorney fees and class-action exposure.

Consider this case: A Chicago-based SaaS firm terminated its collection partner after learning the agency had emailed debtors’ overdue notices to shared office Gmail accounts — violating FCRA privacy rules. The resulting CFPB investigation led to a $420K consent order — paid jointly by the agency and the client. Prevention starts with knowing the hard limits:

No false representations (e.g., claiming to be IRS agents or saying nonpayment is a crime)
No harassment (repeated calls, abusive language, publishing “deadbeat” lists)
No deception (falsely threatening lawsuits, misrepresenting interest accrual, or hiding settlement options)
No communication with third parties about the debt — except to locate the debtor (and even then, only name and contact info — never the debt amount or nature)
No contacting debtors who’ve sent a written “cease communication” notice (though they may still pursue legal remedies)

How to Vet an Agency: A 5-Step Due Diligence Checklist

Not all agencies are created equal — and choosing the wrong one is far costlier than doing nothing. Use this field-tested framework before signing any agreement:

Verify licensing & bonding: Check your state’s Attorney General database and the National Association of Attorneys General (NAAG) portal. Unlicensed operators account for 22% of FDCPA complaints (CFPB 2023).
Review audit history: Request copies of their most recent third-party compliance audits (e.g., from ACA International or Receivables Management Association). Red flag: refusal or “we don’t share those.”
Test their dispute response protocol: Send a sample validation request. Legitimate agencies respond in writing within 5 days — with account statements, original contract terms, and chain-of-title documentation.
Examine their tech stack: Ask for screenshots of their dialer compliance settings (e.g., TCPA-compliant scrubbing, DNC registry integration) and credit reporting workflows. Outdated systems = higher risk.
Require indemnification clauses: Your contract must explicitly state the agency assumes full liability for FDCPA/FCRA violations — and carries Errors & Omissions insurance ($2M minimum recommended).

Action	Permitted?	Key Legal Requirement	Risk if Done Improperly
Calling a debtor at work after being told “don’t call here”	No	FDCPA § 805(c): Must cease upon oral or written notice	Statutory damages + attorney fees; employer complaints
Reporting a disputed debt to credit bureaus	No	FCRA § 607(b): Must mark as “disputed” and investigate	Credit bureau removal + $1,000+ penalties per bureau
Sending settlement offers via unencrypted email	Yes — but risky	GLBA/FTC Safeguards Rule: Requires reasonable data security	Breach notification costs; FTC enforcement action
Using AI voice bots for initial contact	Yes — with strict limits	TCPA: Requires prior express consent for autodialed calls/texts	$500–$1,500 per violation (class actions common)
Charging “collection fees” beyond contract terms	No — unless explicitly allowed	FDCPA § 805(f): Fees must be expressly authorized by law or agreement	Refund demands + reputational harm

Frequently Asked Questions

Can a third-party collection agency sue me?

Yes — but only if they own the debt (through assignment) and have standing to sue in your jurisdiction. Most agencies act as agents for the original creditor and cannot file suit unless authorized by contract and state law. If sued, always verify the plaintiff’s legal capacity and request debt validation before responding. Over 40% of collection lawsuits are dismissed due to lack of standing or missing documentation.

Will paying a collection agency improve my credit score immediately?

No. Paying a collection doesn’t remove it from your credit report — it updates status to “paid collection,” which still hurts your score. However, newer FICO® 9 and VantageScore 4.0 models exclude paid collections from scoring calculations. Note: Most lenders still review full reports manually. For maximum impact, negotiate a “pay-for-delete” agreement in writing before payment — though agencies aren’t required to agree.

Do I have to talk to a third-party collection agency?

No. You have the right to send a written “cease communication” letter under FDCPA § 805(c). Once received, they can only contact you to confirm cessation or notify of specific actions (e.g., lawsuit filing). However, ceasing contact doesn’t eliminate the debt or stop litigation — it only stops non-legal outreach. Many consumers mistakenly believe silence resolves the issue; it does not.

Can a collection agency report to credit bureaus without my Social Security number?

Yes — but accuracy drops sharply. Credit bureaus match accounts using name, address, DOB, and SSN. Without SSN, mismatches occur: 1 in 5 “SSN-less” tradelines get assigned to the wrong consumer (Consumer Financial Protection Bureau study, 2022). Always dispute inaccurate reporting — and demand proof of identity verification before validation is accepted.

What’s the difference between a first-party and third-party collection agency?

A first-party agency is your internal team or a department acting directly for your business — subject to fewer FDCPA restrictions (since they’re not “debt collectors” under the law). A third-party agency is an external vendor hired to collect — and thus fully bound by FDCPA, FCRA, and state laws. First-party teams can’t threaten lawsuits or report without validation; third-party firms face stricter oversight and higher penalties for violations.

Common Myths About Third-Party Collection Agencies

Myth #1: “They can call me anytime — it’s my debt, so I have to answer.”
False. FDCPA strictly limits call times (8 a.m.–9 p.m.), prohibits repeated harassment, and requires honoring “do not call” requests — even if made verbally. Recording calls (where legal) often reveals violations.

Myth #2: “If they say they’re attorneys, they must be lawyers.”
False. Many agencies use “attorney review” disclaimers or “legal department” titles without employing actual attorneys. Only licensed attorneys can file suits or give legal advice. Verify bar membership via your state’s bar association website — not the agency’s letterhead.

Take Control — Not Just Compliance

Knowing what can a third-party collection agency do isn’t about memorizing statutes — it’s about wielding informed leverage. Whether you’re a creditor protecting your revenue stream or a consumer defending your rights, clarity prevents crisis. Start today: pull your last three collection agreements and audit them against the FDCPA checklist above. If you lack in-house compliance expertise, engage a qualified collections attorney for a 90-minute contract review — it typically costs less than one month’s agency fee and prevents six-figure liabilities. Your next step isn’t panic — it’s precision.