An AI voice agent for debt collection must confirm it is speaking to the right person before it mentions the debt at all. Federal law requires that order. The agent then works inside call frequency limits and local calling hours, and it records every step as evidence you can produce later.
Key Takeaways
- The law, not your script, decides when you may name the debt.
- Nearly a third of all collection complaints allege the same failure. Wrong person.
- A policy you cannot evidence is worthless. The recording has to be yours.
Collections teams spend most of their planning on what to say once somebody picks up. The larger risk sits one step earlier, in whether the person who picked up is the right one. We build Dograh, an open source voice agent platform, and collections is where verifying before speaking carries the most legal weight.
What people actually complain about
The largest single complaint category in debt collection is people saying the debt is not theirs.
Between 1 January and 11 September 2026, consumers filed 223,620 debt collection complaints with the CFPB's complaint database. Of those, 101,823 sat under attempts to collect a debt not owed. Inside that group, 66,154 carried the sub-issue "debt is not yours".
It is worth being exact about what that number represents. It records what the consumer said at the moment of filing. Some of those people do owe the money and are disputing it for other reasons. The figure is not a finding that collectors were wrong 66,154 times.
Read conservatively, it still points somewhere useful. Close to three in every ten complaints about collection come from somebody saying you have reached the wrong person. That is a targeting failure sitting upstream of anything the agent says next.
The rest of that category is worth a look as well. Another 26,612 complaints sat under a debt resulting from identity theft, which is a different failure with the same symptom, somebody receiving a call about an obligation they never took on. Put the two together and more than four in every ten debt collection complaints filed this year describe a person who says the account is not theirs.
Why verification has to come first
Section 1692c(b) of the Fair Debt Collection Practices Act sets the order of your call for you.
The statute says a collector may not communicate about a debt with any person other than the consumer, allowing a short list of exceptions that covers their attorney, the creditor, and a consumer reporting agency. You can read the text at Section 1692c.
Put that next to a live phone call and the consequence is blunt. Until your agent knows who is on the line, it cannot say why it is calling. Not the creditor name. Not the balance. Not the word "debt".
This is easy to get wrong, because the natural way to open any call is to explain yourself. An opening like "I am calling from Northgate Recovery about your account ending 4471" has already disclosed the debt if a housemate answered the phone.
In that same 2026 window, 1,083 complaints were filed under talking to a third party about the debt, with a further 250 about contacting an employer. Those counts are small beside 66,154. They are also the ones describing a disclosure that already happened rather than a call that simply reached the wrong number.
What the first twenty seconds have to do
The opening of a collections call has one job, which is establishing identity without leaking the reason for the call.
The agent asks for the consumer by name and stops there. If the person who answered is somebody else, the only safe move is to ask when the consumer is available, then end the call. No callback reason. No company description that gives the game away. Collection agency names are often self-describing, so even the introduction needs care.
Verification itself works better against data you already hold. Asking a consumer to confirm their own date of birth is weak, because anyone in the household might know it. Matching against data you already hold is stronger. Our pre-call fetch pulls the account record before the call connects, so the agent is checking an answer against a field rather than improvising a quiz. That also keeps the exchange short, which matters when you are working inside a latency budget.
Wrong-number branches deserve as much design attention as the successful path. An agent that handles verification well and then fumbles the exit has still created a disclosure risk.
Voicemail deserves the same care, and it is where disclosure happens most easily, because you have no control over who plays the message back.
Regulation F defines a limited-content message for this exact situation. It carries a business name that does not identify you as a collector, a request that the consumer call back, the name of a person they can ask for, and a number to reach. You may add a greeting, the time you called, and suggested times to return the call. Anything past that list turns the message into a communication about a debt.
The rule then does something genuinely useful. A properly formed limited-content message is not treated as conveying information about a debt to anybody, so a family member who hears it has not been told anything. Attempting to leave one still counts as an attempt to communicate, which means it still counts against your call frequency. You get a safe message and you pay for it in cadence.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
The rules your dialer has to respect
Regulation F limits how often you may call and the hours you may call in. Both sound simple and both hide a trap in implementation.
The first is call frequency. A collector is presumed to comply if it places no more than seven calls in seven consecutive days to a person about a particular debt, and places no call within seven days of actually speaking with them about it. That second clause catches teams out. A successful conversation starts a fresh seven-day clock.
The second is timing. Calls belong between 8 a.m. and 9 p.m. in the consumer's local time, which is a harder problem than it sounds. Area code is not location. A number issued in Denver may belong to somebody who moved to Frankfurt four years ago. If your dialer reasons about time zones from the phone number alone, it will eventually place a call at the wrong hour and the log will prove it.
The fix is to treat location as account data rather than something you infer. If you hold a billing address, that is a better time zone signal than the number you are dialing. When the two disagree, the safe move is to take the overlap of both windows rather than backing one of them. That costs a little reach and removes an entire category of violation from your logs.
Both limits are per person and per debt, so the counter has to live at that granularity. Attempts count, not just conversations, which is why the voicemail behaviour described earlier feeds straight into this ceiling. Teams already thinking about what the opening seconds of an outbound call have to accomplish tend to find this easier, since the same discipline applies.
An audit trail only helps if you can produce it
Regulation F gives you a defence for honest mistakes, and that defence runs on evidence.
The bona fide error provisions in Regulation F's communication rules ask you to show procedures reasonably adapted to avoid the specific error that occurred. Saying you had a verification policy is not the same as showing what the agent did on the call in question.
That evidence is the recording, the transcript, and the decision trace showing which branch the agent took and why. Dograh keeps full call traces visible to whoever builds the agent, which is useful for debugging and turns out to matter far more when a complaint arrives eleven months later.
The practical question is whether you can produce all three on demand, in a format a regulator or opposing counsel will accept, without filing a support ticket. Complaints do not arrive the week of the call. They arrive after the account has moved on, sometimes after your contract with a vendor has ended, and the request is usually for one specific call among millions. Retrieval at that granularity is a design decision you make early or regret later. For teams that decide the answer has to be yes, the reasoning usually leads to keeping the stack on your own infrastructure.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Where the recording lives decides who can defend you
The compliance logic is the same whichever way you deploy, so the real difference is custody.
Every serious platform implements the same rules, because the rules are not optional. Where the models diverge is what happens to the consumer data those calls generate, and who holds the evidence you will need later.
| Hosted platform | Self-hosted | |
|---|---|---|
| Where recordings live | Vendor infrastructure | Infrastructure you control |
| Producing the audit trail | Request it, wait for export | Query it directly |
| Data residency | Whatever regions the vendor offers | Whichever jurisdiction you choose |
| On exit | Retention and export depend on contract | Data already sits with you |
| Verification logic | Configured within the vendor's model | Inspectable and modifiable in full |
Self-hosting is sometimes described as the riskier option for regulated work. Our standing view is the opposite for finance and healthcare, where firms often cannot send call data to third-party software at all, which makes self-hosting a compliance requirement rather than a preference. For consumer financial data the argument runs the other way. Sending recordings of identity verification exchanges to a third party adds a party to the chain of custody, and every added party is one more place a disclosure can occur and one more contract standing between you and your own evidence. Dograh is open source and self-hostable, so the verification logic is inspectable rather than described in a datasheet, and the recordings never leave your infrastructure. The same principles that make outbound calling actually connect apply here, with a legal record attached.
Build the verification gate first, then the conversation behind it. Teams that reverse that order tend to discover the problem through a complaint rather than a design review, and by then the recording either helps them or it does not.
Glossary
- Right-party contact
- Confirming that the person who answered is the consumer who owes the debt, before saying anything about the debt itself.
- Third-party disclosure
- Revealing that a debt exists, or any detail of it, to somebody who is not the consumer or on the statute's short list of permitted recipients.
- Bona fide error defence
- The statutory defence that requires evidence of procedures reasonably adapted to avoid the specific error that actually occurred.
- Call cadence cap
- Regulation F's presumption of compliance at no more than seven calls in seven consecutive days to a person about a particular debt.
