Trigger leads

This is general background, not legal advice. When a lender pulls credit for a mortgage, the inquiry itself has historically been usable as a trigger: bureaus could sell the borrower's contact information to other firms as a prescreened marketing list. Borrowers frequently reported a flood of calls and texts right after applying, sometimes from companies that implied they were connected to the original lender.

The Homebuyers Privacy Protection Act, signed into law in 2025, restricts the sale of mortgage trigger leads. In general terms, it limits when credit bureaus can provide this information to third parties, with narrow exceptions, such as where the consumer has opted in or already has a relationship with the firm. The details, including effective dates and how exceptions apply, matter, so loan officers should confirm current requirements with their compliance team or counsel rather than relying on a summary.

Example. Before the law, a borrower who applied with Lender A might receive many calls from unrelated lenders within a day. Under the new restrictions, an unrelated lender buying such a list faces far tighter limits on doing so.

The practical shift is away from bought lists and toward first-party leads: borrowers who come to a loan officer directly, with consent, through their own website and marketing.