The Week in Consumer Protection

New FCC Rules on Opting Out of Robocalls and Robotexts Take Effect November 25

On September 30, 2026, the Federal Communications Commission adopted a Report and Order, FCC 26-67 (released October 1), changing how consumers revoke consent to robocalls and robotexts. The final rule was published in the Federal Register on October 26, 2026, at 91 FR 67214, and takes effect November 25, 2026. It applies to calls and texts made under 47 C.F.R. § 64.1200(a)(1) through (3) and (c)(2), meaning those using an autodialer or an artificial or prerecorded voice, not every call. This follows our April 23 story on the consent revocation rule. According to the order, the change will “supersede the delayed effective date of the relevant portion of that rule that was previously extended to January 31, 2027,” referring to the 2024 provision on how far a single revocation reaches. The FCC said it concluded “that this requirement is overinclusive and may lead to unintended consequences that do not align with the consumer’s actual intent.”

Under amended § 64.1200(a)(10), “Callers may designate any of the following methods as the exclusive means to revoke consent”: an automated, interactive voice or key press-activated opt-out mechanism on a call; a reply text using one of seven standardized words (“stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe”); or a website or telephone number the caller designates. “The caller must clearly and conspicuously disclose the designated method to revoke consent on the call or in the text.” A text sender relying on reply texts may show one standardized word in each message, so long as it recognizes all seven. A caller that designates an exclusive method “is not required to process revocation requests made by any other means.” Under amended paragraph (a)(11), callers that designate no exclusive method “must process revocation requests made by any reasonable means.”

On scope, callers “may interpret” a revocation sent in response to an informational message “as applying only to the specific category of informational robocalls and text messages to which the revocation was directed and not to all communications.” A revocation sent in response to telemarketing revokes consent to “all future calls or text messages containing an advertisement or constitute telemarketing from that caller.” Two provisions carried over from the 2024 rules remain: revocations must be honored “within a reasonable time not to exceed ten business days from receipt,” and a confirmation text that merely confirms the request, with no marketing, sent within five minutes “will be presumed to fall within the consumer’s prior express consent.” The rule also allows a financial institution’s fraud alert calls and texts to go to a wireless number “obtained from a reliable source,” as the rule defines it. Separately, the FCC published a proposed rule at 91 FR 67239 asking for comment on “reducing the timeframe callers must honor revocation requests, requirements for two-way texting functionality, requiring a revoke all method, and the treatment of affiliates.” Comments are due November 25, 2026, and reply comments December 28, 2026. These are questions, not adopted rules.

Attorney General Settles With Debt Buyers Over Foreclosure Demands for Payments More Than Six Years Old

On October 23, 2026, the Office of the New York State Attorney General announced Assurance of Discontinuance No. 26-061, effective October 22, 2026, with a group of debt buyers and their affiliated entities. We covered zombie second mortgages on March 27; this is a new enforcement development. According to the AOD, one of the companies acquired more than 3,000 defaulted New York residential mortgage loans in February 2019, almost all of which had been “in a junior priority lien position.” The OAG’s release describes them as mostly second mortgages originated before the 2008 financial crisis. The AOD states: “Since 2020, Respondents and Signatory Entities have brought more than 140 foreclosure actions to enforce mortgages within New York State.” According to the OAG, some of those suits sought “interest going back as far as 12 years.”

The OAG states its position in the AOD: “The statute of limitations on foreclosure debt in New York is six years. N.Y. C.P.L.R. Rule 213. The statute of limitations runs from each installment payment due on the loan.” CPLR 213(4) includes, among actions that must be commenced within six years, an action “upon a mortgage of real property.” The OAG finds that the conduct it describes constitutes “repeated violations” of the federal Fair Debt Collection Practices Act, General Business Law § 349, and General Business Law § 601. These are the OAG’s findings in a negotiated assurance, not a court ruling, and “Respondents and Signatory Entities neither admit nor deny the OAG’s Findings.” The OAG accepted the AOD under Executive Law § 63(15) in lieu of starting a court proceeding, so no court approval is involved.

Under the terms, the companies “shall cease any collection activities that seek to recover time-barred debt,” which the AOD defines to include “both the principal and interest portion” of payments due before the limitations period. In pending foreclosures, within 30 days of the effective date, they must amend the complaint or file a notice informing the homeowner and the court. They must also move to vacate or amend judgments based on sworn statements that time-barred debt is owed. They may not charge fees or costs for this work, or enter loan modifications that “re-amortize time-barred debt.” The companies will pay the State “$240,000 in penalties and costs.” According to the release, they will also provide more than $242,000 in restitution, paid as account credits or checks to the specific consumers listed in the AOD’s exhibits.

Federal Court Lets Negligence Claim Proceed Over Alleged Unauthorized Home Equity Line Draws

A federal court in the Eastern District of New York issued a Memorandum and Order in No. 2:24-cv-05836 (E.D.N.Y.), a homeowner’s suit against the bank that holds his home equity line of credit. U.S. District Judge Eric N. Vitaliano signed it on October 12, 2026, and it was filed October 26, 2026. The plaintiff sued in New York State Supreme Court in July 2024, and the bank removed the case to federal court in August 2024. According to the complaint, seven cash advances totaling $156,850 were taken on his home equity line of credit between January 8 and January 26, 2024. He says he did not make or authorize them and that they resulted from a cybersecurity breach of the bank’s system. He alleges that the bank denied his fraud claim and that the debt remains on his account. The court ruled on a motion to dismiss, where the facts are “taken as true, with all reasonable inferences drawn in the plaintiff’s favor.” These are allegations, not findings.

The court allowed the negligence claim to proceed: “[The bank] had an independent duty imposed by tort law to take reasonable care to prevent unauthorized access to its customers’ HELOC accounts and the borrowing of funds against their collateral. [The plaintiff] has sufficiently pled a breach of that duty, which caused significant cash advances pending against his account. Therefore, the motion to dismiss his negligence claim is denied.” The court tied that duty to situations where a third party obtains access to an account without the customer’s knowledge, and contrasted cases where the fraudster was authorized or the customer started the transfers. It noted that this account’s agreement “says nothing about unauthorized access to the account and contains no clause shifting the risk of cyberbreach onto accountholders.” Because the contract contained no such obligation, the court dismissed the breach of contract claims. It also dismissed the fiduciary duty claim and a claim under unspecified New York laws and public policy. The court found only that a breach was sufficiently pleaded; it made no finding of liability.

The court dismissed the federal Fair Credit Reporting Act claim under 15 U.S.C. § 1681s-2(b), explaining that “a plaintiff must show that the furnisher received notice of the dispute from the CRA, and not only from the consumer.” Here, the plaintiff had disputed with the bank, and the court said it could not consider his assertion, made for the first time in his opposition papers, that he had reported to the credit bureaus. This is a narrow point about the private claim under § 1681s-2(b). Lenders have separate duties for certain disputes sent directly to them; under 12 C.F.R. § 1022.43, “a furnisher must conduct a reasonable investigation of a direct dispute” on specified topics. The court also dismissed a New York FCRA claim, reasoning that federal law preempts state law “relating to the responsibilities of persons who furnish information to consumer reporting agencies.” All dismissals were without prejudice, with 20 days’ leave to amend from the date the order is entered on the docket. The case is ongoing.

FTC Refunds Are Arriving With Deadlines to Cash or Accept, and Scammers Impersonate the FTC

The Federal Trade Commission is sending refunds in several of its matters this fall. On October 15, 2026, the FTC announced more than $9.8 million in payments to consumers who, according to the FTC, were harmed by a large retailer’s alleged failure to stop scammers who used its money transfer services. Its refund page states: “If you get a check, please cash it within 90 days.” On October 8, 2026, the FTC announced more than $15.8 million in electronic payments to people who paid a cash advance app for eligible instant advances. In its March 2025 complaint, the FTC alleged that the company misled consumers with promises of fast money, charged hidden fees, and made it difficult to cancel. The refund page for that program asks recipients to accept their payment within 30 days. A third FTC refund page, dated November 2026, says the FTC is sending 204,408 checks totaling more than $4.4 million “to people who accepted their first payment,” also to be cashed within 90 days.

None of these programs asks people to file a claim; the FTC is sending the payments, but they must be cashed or accepted by the deadline. The FTC’s FAQ notes that “Most FTC cases do not require you to file a claim.” The FTC also warns: “Scammers are impersonating the FTC.” According to the FTC, “The Commission never requires people to pay money or provide account information to get a payment,” and “You can find and verify the phone numbers for FTC refund programs at ftc.gov/refunds.” The FTC says its email notice before a payment will come from an address ending in .gov.