What's more, the credit union also cut off members' electronic access to their accounts and bank cards for failing to pay overdue loans. Hundreds of thousands of members were affected by these practices, which occurred from January 2013 to July 2015, according to the CFPB.

Because financial institutions are so focused on generating revenue, debt collection practices have taken a back seat.

What has changed, however, is that the CFPB is taking a closer look at these debt collection practices, which makes it important, even for small organizations, to make sure they have appropriate policies and procedures in place.

Although Navy Federal became the first credit union to be hit with a consent order that shocked the industry, other financial institutions such as Discover, Chase, Citi and other banks were slapped with consent orders for their debt collection issues.

Joann Needleman said one of the obstacles that may have tripped up Navy Federal, and may also affect many credit unions, is that it's using standard industry loan forms and contracts that don't specifically address default remedies.

Needleman, who serves credit union clients, is the past president of the board of directors of the National Creditors Bar Association and serves on the CFPB's Consumer Advisory Board. She is also the leader of consumer financial services regulatory and compliance group for the national law firm Clark Hill.

Needleman said credit unions need to review loan contracts and understand what limitations they have at the time of default.

“The contracts do not speak to what are the remedies of the credit union in event of default, other than writing off the loan,” Needleman said. “That's what happened to Navy. I have to tell you, other credit unions that I have worked with, we go through their processes and they say, 'If they default, we're going to freeze their account,' and I ask, 'Where does it say that you can do that?' Because there are a lot of assumptions being made by credit unions about what they can do that are well outside the [loan] contracts, I think the CFPB clearly has a big problem with that.”

It also important, she said, that credit unions understand the nuances of the Fair Debt Collection Practices Act.

Although the FDCPA regulates third-party debt collectors, not first-party collectors, the CFPB is using the debt collection practices that are prohibited in FDCPA as a framework to enforce the Consumer Protection Financial Act of 2010 that also prohibits unfair, deceptive or abusive acts or practices.

Matt Moskowitz, owner and partner of American Profit Recovery in Farmington Hills, Mich., said there are probably a lot of organizations that fall into the gray area of what is legal and what is not legal in debt collection.

For example, the CFPB consent order showed Navy Federal used several letter templates that threatened legal action against 193,000 members. But the credit union filed fewer than 5,000 debt collection lawsuits. Because Navy Federal sued only 2.5% of members, the CFPB deemed it a deceptive practice to coerce them to pay delinquent accounts.

However, had the CFPB found Navy Federal sued 97% of its members, then the federal agency could not have cited the credit union for using deception.

“If it's something to psychologically coerce consumers to pay their debts because of a stated consequence, then that's not legal,” Moskovitz said. “For our clients, we look at their collections letter, and if it says anywhere that they are going to send this debt to collections or if they are going to file suit, then the next question we have is, are you? If they say no, then we say you have to eliminate this immediately, or you have to sue them or send the debts to collections.”

For Needleman, Navy Federal's debt collection issues signaled it either didn't have good written policies and procedures or no one was monitoring employees to ensure they were following policies and procedures.

“What I think a lot of credit unions, especially smaller ones, don't have is a compliance management system, which includes the overall framework so that your staff knows what the policies and procedures are and how are they engaging with your consumers. It also can establish a good line of communication between your top people and the people in the trenches who are working with consumers,” Needleman explained. “The compliance management system doesn't have to eat up all of your resources but there has to be good working technology that can process and document all of this information.”

It's also important that employees receive sufficient training on all policies and procedures and that managers monitor that the policies and procedures are being followed.

However, Ohad Samet, co-founder and CEO of TrueAccord, said the traditional debt collection procedures have become antiquated and created compliance challenges for organizations. “Collections departments are pressured to reach higher recovery goals with less investments in human resources,” Samet said. “Organizations are forced to use their call center staff that is not highly qualified and that is making a commission on every dollar collected, in most cases. Let's face it, debt collection is not a fun process. Consumers who owe debts are often themselves a little abusive. It's a difficult time for them. Sometimes they're angry. It's hard not to be influenced emotionally. It's a really bad proposition, and this is where [compliance] violations come from.”

He sees more first-party debt collectors moving toward automation solutions that can enhance the consumer experience and increase recovery rates.

Samet's company, a debt collections firm based in San Francisco, uses technology that leverages consumer behavioral analytics, machine learning algorithms, and other data-driven techniques. Those solutions automate targeted messages via email, text, letter, call and social media to engage consumers that can lead them to respond and make payments.

Targeted email messages carry a friendlier or humanistic tone in stark contrast to typical debt collection messages with terse words that demand immediate payment.

For example, a TrueAccord email message reads: “How are you? Hope your day is going well. We're sorry to have to do this, but we're emailing you because of your outstanding balance of $972.67 with us. We would love to help you resolve this and make this process as stress free as possible. Click below to begin the process of settling this debt and don't hesitate to reach out with any questions (just respond to this email).” The last sentence thanks the consumer with a smiley face emoji.

TrueAccord said its technology learns from every action. Every email, click-thru and website visit teaches its data engine about the customer's frame of mind, which triggers intelligently placed outbound communications to the consumer to accept a payment option, according to the company.

How TrueAccord's solutions determine the customer's frame of mind is what Samet said is his company's proprietary “secret sauce.”

“You want to draw the consumer's attention [at the time] they're ready to think about their obligations,” he explained. “You want to put in front of them a payment option that they feel like they can afford. You can do it via human [debt collectors], which may feel judgmental and stresses consumers out, or you can put it in an email in an online experience that responds to their feedback. That proves more efficient and more effective.”

Some of TrueAccords's 60 clients are financial institutions.