Collecting a debt from people who owe money is one thing. Collecting a debt from people who don’t legally owe because those loans should never have been written in the first place? That’s another problem altogether, and the Consumer Financial Protection Bureau is very upset with one company .

A lawsuit (PDF) the CFPB filed yesterday alleges that online lender CashCall, its subsidiary WS Funding Inc, and its affiliate Delbert Services Corporation, violated the laws of at least eight separate states. Because of these violations, CashCall and the others were not legally entitled to collect money from borrowers in those states, and therefore people are being targeted for collections on debts they do not actually owe.

Here’s how that works: CashCall makes payday-style short-term, “small-dollar” loans to individuals. These loans are often extremely disadvantageous to consumers, filled with fees and extremely high interest rates that trap borrowers in a cycle of debt.

In spite of this, these loans are still legal in most states. However, the states involved in the CFPB action — Arizona, Arkansas, Colorado, Indiana, Massachusetts, New Hampshire, New York, and North Carolina — all have laws in place that either outlaw payday loans altogether, place caps on loans that discourage short-term, high-interest lending, or require particular licensure.

To keep lenders in compliance, the eight states all have statutes stating that loans made in violation of either the interest rate caps, license requirements, or both (depending on state) do not actually have to be repaid. Legally speaking, “Loans that do not comply with those restrictions are void, and the lender has no right to collect any principal, charges, or recompense.” In other words, if a lender ignores the law, they don’t get to make any money — and the borrowers having their accounts automatically debited are entitled to keep their cash.

According to the complaint, CashCall and its affiliates had working with online lender Western Sky, a company that had claimed exemption from states’ regulations because it was operated on a Native American tribal reservation. Various state regulators and the CFPB disagreed with Western Sky’s stance that it could offer online payday loans in states where they were not allowed, and Western Sky stopped funding new loans in September of this year.

As the lawsuit explains:

WS Loans, though made in Western Sky’s name, were marketed by CashCall, financed by WS Funding, almost immediately sold and assigned to WS Funding, and then serviced and collected by CashCall and/or Delbert.

Between early 2010 and late 2013, hundreds of thousands of WS Loans were made to consumers nationwide, including to consumers in the Subject States.

WS Loans ranged from $850 to $10,000. They carried upfront fees, lengthy repayment terms, and annual percentage rates (APRs) ranging from 89.68% to 342.86%.

The lawsuit, filed in federal court in Boston, is the first legal action the relatively new agency has taken against an online lending operation. It asks for the court to require that CashCall provide refunds to borrowers in states where the loans should never have been made, or to nullify any financial obligations of affected borrowers in these states. The complaint also seeks additional damages and civil penalties.

“Today we are taking action against CashCall for collecting money it had no right to take from consumers,” explains CFPB Director Richard Cordray in a statement. “Online lending is rapidly growing and deserves ample regulatory attention. The Consumer Financial Protection Bureau will take action against online lenders and servicers that engage in unfair, deceptive, or abusive practices.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.