Most payday-loan borrowers don't know the rights they already have. The cluster's pages list "rights" as a footnote in small print. We do the opposite: list them clearly, cite the statute, and explain the remedy. Read this before you sign anything.
Right 1 — A clear disclosure of the loan's total dollar cost
Source: Truth in Lending Act (TILA), 15 U.S.C. § 1601 et seq., and Regulation Z, 12 C.F.R. Part 1026.
Before you sign, the lender must give you a written disclosure of: the amount financed, the finance charge (in dollars), the total of payments, the annual percentage rate (APR), and the payment schedule. This is the "TILA box" — and the law requires it in a specific format, in writing, before you commit. If the lender hands you a quote without the TILA box, walk away. The box is your only honest comparison tool across lenders.
Remedy: a TILA violation entitles you to actual damages, twice the finance charge (capped at $1,000 in individual actions), attorney's fees, and costs. In some cases the loan itself can be rescinded.
Right 2 — Limits on calls and text messages
Source: Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, plus FCC implementing regulations.
The lender or collector can only call or text you if you have given prior express written consent for that specific number, for that specific channel (SMS, voice, both), and not pre-ticked. The new "one-to-one" consent doctrine being clarified by the FCC tightens this further: consent for marketing partner X does not extend to marketing partner Y. You can revoke consent at any time, by any reasonable method ("STOP" text, voicemail, email, letter).
Remedy: $500 per violating call or text, $1,500 if the violation is willful or knowing. There is no cap on accumulated violations. Class-action exposure is significant; many TCPA settlements run into the millions.
Right 3 — Limits on third-party debt collectors
Source: Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq.
If your loan goes to collections — and it's being collected by someone other than the original lender — the collector must obey strict rules:
- No calls before 8 a.m. or after 9 p.m. local time.
- No threats of arrest or violence; no abusive language.
- No threats of wage garnishment without a court judgment.
- No contact at work after written notice that workplace calls are prohibited.
- No disclosure of the debt to third parties (family, neighbors, employer) other than to identify or locate you.
- You can demand written validation within 30 days of first contact; collection must pause until validation arrives.
- You can demand cessation in writing; only specific narrow communications are then allowed.
Remedy: statutory damages up to $1,000 per case, plus actual damages, attorney's fees, and costs. Many borrowers bring successful FDCPA suits with no out-of-pocket cost because the fee-shifting provision pays plaintiff's lawyers.
Important nuance: the FDCPA applies primarily to third-party collectors, not the original lender. However, most state UDAAP statutes apply parallel limits to original creditors. The CFPB also has UDAAP authority over original creditors.
Right 4 — Your credit-report rights
Source: Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.
You have the right to: (a) a free credit report from each of the three bureaus every 12 months at annualcreditreport.com; (b) a free credit freeze and unfreeze in all 50 states; (c) dispute inaccurate entries directly with each bureau, which then has 30 days to investigate; (d) sue for inaccuracies the bureau or furnisher fails to correct after a valid dispute. Many payday lenders don't furnish to the three major bureaus, so a payday-loan delinquency may not affect your score — but if it goes to a collection agency that does furnish, the collection entry will appear and damage your score.
Remedy: actual damages, statutory damages up to $1,000, punitive damages for willful violations, attorney's fees.
Right 5 — Right to revoke ACH authorization
Source: Electronic Fund Transfer Act and Regulation E, 12 C.F.R. Part 1005.
You can revoke ACH (Automated Clearing House) authorization for any recurring preauthorized transfer at any time, in writing. Both the lender and your bank must honor the revocation. Send the revocation to both; a revocation only to the lender is insufficient if you want your bank to block future attempts. Your bank may not charge a fee for honoring the revocation (though some try; push back).
Remedy: if a lender pulls an ACH after you've revoked, that's an unauthorized EFT. You have 60 days to dispute, and the bank must restore funds while investigating.
The full procedure is in our crisis guide, with sample letters.
Right 6 — Military APR cap of 36%
Source: Military Lending Act (MLA), 10 U.S.C. § 987, plus DoD implementing regulation 32 C.F.R. Part 232.
If you are an active-duty service member, or a spouse or dependent of one, the lender is legally barred from charging more than 36% Military APR (MAPR) on most consumer credit, including payday loans. MAPR is broader than TILA APR — it includes most fees and credit insurance. Violations can void the loan, trigger civil penalties, and bar arbitration clauses. Quick Cash screens MLA status at application via the DMDC database.
Remedy: loan voided, statutory damages, actual damages, attorney's fees, possible criminal penalties for knowing violations.
Right 7 — ACH 2-strike rule
Source: CFPB Payday Lending Rule (2017 / payment-provisions effective 2022), 12 C.F.R. § 1041.
After two consecutive failed ACH withdrawal attempts, the lender cannot make further withdrawals without obtaining fresh borrower authorization. This prevents the cascade-of-NSF-fees pattern where a single failed payment becomes a series of failed retries. The lender must also provide written notice before the first attempt of an unusual withdrawal.
Remedy: CFPB enforcement actions; state UDAAP claims; in some cases private claims under TILA's "spreading" doctrine.
Right 8 — No discrimination in credit decisions
Source: Equal Credit Opportunity Act (ECOA), 15 U.S.C. § 1691; Regulation B, 12 C.F.R. Part 1002.
A lender cannot deny or price your loan differently on the basis of race, color, religion, national origin, sex, marital status, age (provided you're old enough to contract), receipt of public assistance income, or your exercise of any right under the Consumer Credit Protection Act. If you're denied, the lender must give you the reasons in writing within 30 days. You can request your specific credit-decision data.
Remedy: actual damages, punitive damages up to $10,000 for individual actions and the lesser of $500,000 or 1% of net worth for class actions, attorney's fees.
Right 9 — Extended Payment Plan (EPP)
Source: state statute (varies); industry self-regulation under OLA Best Practices.
In 23 of the 23 states that allow payday lending, the lender must offer at least one free EPP per 12-month period on borrower request before default. The EPP converts a single-payment loan into a 60–90 day installment at no extra fee. Request must usually be in writing before the due date.
This is the most under-used borrower protection in the industry. We have a script in the crisis guide.
Right 10 — State rollover bans and cooling-off periods
Source: state statute (varies by state).
Many states ban or limit rollovers (renewals) of payday loans, and require a cooling-off period between consecutive loans. Examples: Illinois prohibits a new loan within 30 days for repeat-borrower status; Florida requires a 24-hour cooling-off; Ohio (post-2018) abolished the single-payment model entirely. Check your state hub for the exact rules.
Remedy: state regulator complaints can trigger license revocation; private UDAAP claims often allow individual damages and attorney's fees.
Right 11 — State UDAAP claims
Source: state "Unfair, Deceptive, or Abusive Acts or Practices" statutes; the CFPB has parallel federal authority under 12 U.S.C. § 5531.
Most states have UDAAP-style laws that bar unfair, deceptive, or abusive practices in consumer credit. Examples include misleading APR disclosure, undisclosed fees, harassment, fraudulent collection practices, and offers that violate state license law. Many state UDAAP statutes have a private right of action — meaning you can sue on your own behalf, often for treble damages and attorney's fees. The state AG also enforces.
Remedy: varies by state; commonly actual damages × 2 or × 3, civil penalties, attorney's fees, costs.
How to use these rights — quick playbook
- Before signing: verify TILA box exists; verify lender is licensed in your state (use our scam-spotter / license lookup); verify the offer doesn't exceed 36% MAPR if you're military.
- While the loan is performing: if marketing calls or texts annoy you, send a written TCPA revocation. If you anticipate trouble repaying, request the EPP in writing before the due date.
- If you can't repay: follow the 72-hour crisis plan. Revoke ACH if the cascade is imminent. Document everything.
- If collectors get nasty: send a written FDCPA cease-and-desist (with the exception language for legal-action notifications). Document each call. File a CFPB complaint at consumerfinance.gov/complaint.
- If you've been wronged: file complaints with the CFPB, your state AG, your state department of financial institutions, and the FTC at ReportFraud.ftc.gov. Find a consumer-protection attorney; many take FDCPA and TCPA cases on contingency because the fee-shifting provisions pay them.
Who actually enforces these rights?
Multiple agencies, often overlapping. The CFPB (Consumer Financial Protection Bureau) has UDAAP authority over consumer credit, oversees TILA, FDCPA, FCRA, the Payday Rule, and ECOA. The FTC shares enforcement on some statutes (FDCPA, TCPA). The FCC regulates TCPA. The DoD writes MLA rules. State AGs enforce state UDAAP, license, and rate-cap statutes. State DFIs license lenders and can revoke licenses.
The most effective path for a single borrower is often: file the CFPB complaint (15-day response window for the company), file the state AG complaint in parallel, and consult a consumer-protection attorney before signing any "settlement" the lender or collector offers.
Compliance note: Quick Cash is a lead-generation service, not a lender or law firm. This page is general consumer information based on federal and state law as of May 2026. It is not legal advice. For case-specific guidance, consult a licensed attorney, your state attorney general's consumer-protection office, or a CFP®/AFC®.
FAQ
Are these rights different for installment loans than payday loans?
Mostly the same. TILA, TCPA, FDCPA, FCRA, Reg E, MLA, ECOA all apply to consumer credit broadly. The CFPB Payday Rule and EPP rules are specific to payday loans; the rest carry over to installment.
Can I sue a payday lender personally?
Yes, for violations of TILA, TCPA (very common in payday-loan litigation), FDCPA (against third-party collectors), FCRA, ECOA, MLA, and state UDAAP. Many of these statutes shift attorney's fees to the lender if you win, so plaintiff's lawyers often take these cases on contingency.
Does a forced arbitration clause kill these rights?
No — but it can change the forum. The MLA bars arbitration for covered borrowers. The CFPB attempted to bar mandatory arbitration in 2017; Congress overturned it via the Congressional Review Act. Many TCPA and FDCPA claims have proceeded in arbitration successfully. Read the clause carefully and consult counsel.
What's the statute of limitations on these claims?
Varies: FDCPA is 1 year from violation; TCPA is 4 years; TILA is 1 year for damages, 3 years for rescission; FCRA is 2 years from discovery, 5 years from violation, whichever is earlier. Move fast.
Where can I read the laws themselves?
The CFPB consumer-finance regulations are at consumerfinance.gov/rules-policy/regulations/. TILA: 15 U.S.C. § 1601. FDCPA: § 1692. TCPA: 47 U.S.C. § 227. FCRA: 15 U.S.C. § 1681. MLA: 10 U.S.C. § 987. ECOA: 15 U.S.C. § 1691.
Where to go next
If a loan is already hurting you, the 72-hour crisis plan walks through what to do. If you want to verify a specific lender's license before transacting, the scam-spotter / license lookup covers it. State-specific protections: Texas, California, Florida, Illinois, Ohio.