BCFP: Fix the Authentication Dance Between Consumers and Collectors

Yesterday the Bureau of Consumer Financial Protection (BCFP or Bureau) posted advice to consumers regarding how to tell the difference between a legitimate debt collector and a scammer. This is important, and I support all efforts to make this distinction. The problem is, the advice and the law don't exactly match up.

Another insideARM article published today highlights two recent court cases that address the beginning of an interaction between a debt collector and a consumer, and describes the gauntlet created by the Fair Debt Collection Practices Act (FDCPA) prohibition against communicating with a third party about a person's debt. (I suggest readers check out that one first, for background, then follow the link at the end back to this one.)

While much of the Bureau's advice is good, it makes no mention of the collector’s responsiblity to confirm they are speaking with the "right party" before providing any information. This is misleading and, in my opinion, it causes confusion for consumers and an untenable situation for creditors and their legitimate collectors. The following are among the listed warning signs of debt collection scams:

Withholds information from you

A debt collector must tell you information such as the name of the creditor, the amount owed, and that if you dispute the debt the debt collector will have to obtain verification of the debt. If the debt collector does not provide this information during the initial contact with you, they are required to send you a written notice within five days of that initial contact.

This is the first item on the list. As a consumer, I would assume this means that the collector would start by giving me the creditor’s name, amount owed, etc. No mention is made of the fact that they can give this information only after they have confirmed they are speaking with the right person. And no mention is made about what this "confirmation" will involve.

Asks you for sensitive personal financial information

Such as your bank account, routing numbers, or Social Security numbers. You should never provide anyone with your personal financial information unless you are sure they’re legitimate. Scammers can use your information to commit identity theft.

And, here's what that confirmation involves. While this is excellent advice in today’s world, it’s exactly what creditor clients require their collection agencies to ask for in order to confirm they are speaking with the right party (not bank account, but other sensitive information).

Ask for a callback number

If you’re uncomfortable providing any information, you can request the caller’s name, company name, street address, and a callback number. You can use this information to verify that they are not a scammer before providing any personal information. Also, if you call back and the business doesn’t answer as the name they provided to you or it’s a nonfunctioning number, it could be a scam.

Again, great advice, but until a collector can verify they are speaking to the right party, they can only provide this information if asked. This makes them seem evasive, which is exactly the kind of behavior that may cause a consumer to feel uncomfortable.

So, what often happens is that the call ends with no information being exchanged. When collectors cannot reach consumers in any meaningful way, additional adverse consequences may result. Many accounts which would otherwise be resolved are instead escalated, resulting in unnecessary credit reporting, garnishments, repossessions, and litigation against consumers.

How can this catch-22 situation be resolved?

I have a few suggestions. 

Clearly authorize and enable debt collectors to initiate communication through digital channels

A rule that clearly authorizes and enables debt collectors to initiate communication through digital channels would make it possible to employ the dozens of more advanced ways to authenticate the consumer; these very same channels are already in wide use by banks and other financial institutions – those businesses that require the very tightest security and privacy measures. Enabling use of these channels would greatly benefit the consumer from the very beginning of the collection cycle by making communication far less awkward and frightening, more immediate, more likely to be addressed and not ignored – and thus less likely that an account would escalate unnecessarily.

Contact which is initiated digitally rather than via phone call would also give the consumer the opportunity to independently check out the organization that is contacting them before they engage in a live discussion. In fact, it might even remove the interaction from the phone entirely, if that’s what the consumer chooses. 

Affirmatively provide that, for purposes of FDCPA compliance, disclosure of the debt collector’s true identity does not constitute an unauthorized disclosure of the debt.

Do this by clarifying in §1692c. Communication in connection with debt collection, section (b) Communication with third parties by that "Mere disclosure of the true identity of the collector does not constitute a communication." This would provide a measure of transparency to the consumer, it would reduce the amount of friction at the beginning of an interaction, it would allow a consumer to check out the caller before engaging, and it would establish a modicum of trust between collector and consumer. 

Finally, I will digress for a moment. In the event that another of my suggestions -- the handshake communication -- catches on, this addition to the FDCPA would create a sorely needed closed loop of information between creditor, collector and consumer. The handshake communication is like the letter (regardless of the channel of delivery) sent by a mortgage lender when the loan is sold; "We've sold your mortgage. This is who we've sold it to. This is who you'll be making your payments to." If such a communication were sent by a creditor when placing a consumer's account with a third party agency, the consumer would be able to recognize the name of the agency contacting them, and would be expecting the outreach. I get that there may be current limitations to the ability to send such a communication. But, isn't it the right thing to do?

The good news is that the Bureau has the authority to act on these recommendations, and in fact remains on track to release a Notice of Proposed Rulemaking in March 2019 addressing issues such as communication practices and consumer disclosures.