A text says you owe money and offers a link to pay. The pressure to click is real. Slow down first. Federal guidance gives you ways to check who is asking before any card number leaves your hands.

Start with a short checklist

The Consumer Financial Protection Bureau (CFPB) describes a handful of checks that matter most. They are simple, and they work best in order. Do them before you open a portal, not after.

  1. Get the collector's identity. Ask for the representative's name, the company name, street address, phone number and website.
  2. Ask about a state license. If your state licenses collectors, ask for the license number and check it with your state attorney general or state regulator.
Hands resting beside a printed checklist and an open envelope on a kitchen table in soft morning light, showing careful review of a debt notice.
A clear checklist helps consumers independently verify debt collection notices before sharing financial data.
  1. Read the validation notice. Compare the creditor name, account number and itemized balance with your own records.
  2. Find the dispute date. The notice should state an end date for a 30-day dispute period.

None of this requires a payment link. If a message offers only the link and no way to check the sender, that tells you something.

Confirm who is contacting you

According to the CFPB, a legitimate collector should tell you its name, its company, and the company it works for. It should also give details about the debt it says you owe. Refusing to share that, threatening you, or asking for personal information can signal a scam.

One detail is easy to miss. The CFPB advises confirming a collector's identity through information you gather from the caller, not only through the contact route you were handed. So a number printed in a text or a link in an email is not proof of anything by itself. Write down the name, company, street address and phone number. Then check them with your state attorney general and state regulator.

A consumer rights page from Know My Debt lists the same kinds of questions you can ask: the collector's name, company, address, phone number and state license number where one applies. It also says a legitimate collector will generally confirm your identity before discussing account details. Treat that as a secondary source and lean on the CFPB pages for the rules.

The CFPB also says not to give sensitive financial information to a caller until you have confirmed they are legitimate. That includes a call you did not expect.

Check the debt against the validation notice

The CFPB says a collector generally must provide validation information in its first communication or within five days of it. If it does not or cannot, the CFPB says that could be a scam. The notice can arrive by mail or electronically.

Per the CFPB's list of required information, the notice generally includes:

  • A statement that the message comes from a debt collector
  • Your name, plus the collector's name and mailing information
  • The creditor's name and the account number, if there is one
  • An itemization showing interest, fees, payments and credits
  • The current amount owed
  • How to reply if you dispute the debt or the amount
  • The end date of the 30-day dispute period

Use that list as a scorecard. Pull a bank statement or an old bill and see whether the creditor and the numbers match. If you do not recognize the debt at all, the CFPB flags that as a warning sign too. The notice explains how to reply if you dispute it. Keep copies of any letters you send and records of every call, text and email.

Watch for red flags before you pay

The CFPB names several warning signs. A collector may threaten you, or call late at night or at work. It may refuse to give a mailing address or phone number. It may refuse to explain the debt, or be chasing a debt you do not recognize. Asking for personal information before proving who it is belongs on the same list. The FTC's page on fake and abusive collectors covers similar ground.

Call volume is trickier. Federal call frequency limits took effect in November 2021 under certain circumstances, according to one of our sources. Many calls alone do not prove a collector is fake. Many calls with threats is a reason to stop and verify.

Ignoring a real debt is not a plan either. The CFPB notes that it usually does not make the collector go away, and the collector may turn to other methods, including a lawsuit. A legitimate collector can explain whether the debt is yours and what options exist, even if you cannot pay right away.

What to do about the link itself

Here the published guidance runs thin. The CFPB pages cited here do not explain how to judge a payment link or portal, such as reading the web address or checking the secure connection. They also do not say which payment methods are safer, how to confirm a payment was credited, or what to do if you already paid through a link you now doubt.

So the practical move is to work around the gap. Do not pay through a link you cannot tie to a verified collector. Get the validation notice first. Check the collector with your state attorney general or regulator. Then reach out using contact details you confirmed yourself, and ask how they accept payment. Ask for written confirmation of anything you pay.

State rules vary and some are only proposals. New York's financial regulator announced proposed rules in 2013 aimed at harassing calls, expired debts and collection from the wrong person. Check its current status before relying on it, and see the state's credit and debt page. For recent warnings, the FTC has a consumer alert on debt collection scams.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.