By Halo Programs
For years, a borrower who applied for a mortgage could expect calls and texts from lenders they had never contacted. Those calls came from trigger leads: a credit bureau saw the mortgage inquiry and sold that signal to other lenders.
Federal law now restricts that sale. The Homebuyers Privacy Protection Act (Public Law 119-36) was enacted on September 5, 2025, and by its own terms took effect 180 days later, in early March 2026. If you run mortgage lending or marketing at a bank, a credit union, or an independent lender, the practical question is no longer whether trigger leads are fair. It is which side of the new line your institution is on, and what you do about it.
This is a plain-language summary for lenders, not legal advice. Check your own program with counsel and with your credit bureau.
What a mortgage trigger lead is
When a consumer applies for a mortgage, the lender pulls credit. That inquiry tells the credit bureau the consumer is shopping for a home loan. A trigger lead is the bureau passing that fact, with contact details, to another company that asked for a list of people who meet its criteria.
The practice was legal under the prescreening rules of the Fair Credit Reporting Act as long as the buyer made a firm offer of credit. The complaint from borrowers and from many lenders was the unsolicited contact itself, arriving in the middle of someone else’s loan process.
What changed in 2026
The Act added a paragraph to section 604(c) of the Fair Credit Reporting Act, the section that governs prescreened offers. When a credit report is requested in connection with a residential mortgage loan, a credit bureau may no longer use that request as the reason to furnish the consumer’s report to another company, unless two conditions are both met.
First, the transaction must be a firm offer of credit or insurance. Second, the company receiving the report must fit one of four descriptions. They are set out in 15 U.S.C. 1681b(c)(4), and in the enrolled text of the Act:
| Who may still receive the report | What the law requires |
|---|---|
| A company the consumer authorized | Documentation certifying the consumer’s authorization, submitted to the credit bureau |
| The originator | It originated the consumer’s current residential mortgage loan |
| The servicer | It services the consumer’s current residential mortgage loan |
| A bank or credit union | It is an insured depository institution or credit union and holds a current account for the consumer |
A lender that fits none of the four can no longer receive a report on the strength of the borrower’s application somewhere else.
The Act also directs the Government Accountability Office to study trigger leads received by text message. Expect that subject to come back.
The exceptions all describe a relationship
Read the four descriptions again. Each one is a relationship that already exists: the consumer said yes, or you made their current loan, or you service it, or you hold their account.
That is the part of the law worth planning around. Congress did not end the trigger. It reserved the trigger for the institutions a borrower already knows. Whether that helps you depends on whether you act like one of them.
Three points follow from a plain reading of the wording. They are our reading, not a regulator’s, and each is worth confirming with counsel.
An originator can qualify after selling servicing. The originator description turns on having originated the consumer’s current loan. A lender that sells servicing at closing has still originated that loan. The word doing the work is “current”: once the borrower refinances with someone else, you did not originate their current loan any more.
A depository relationship counts on its own. An insured bank or credit union that holds a current account for the consumer fits the fourth description even if it never made that person a mortgage. For most community institutions, deposit customers are a much larger group than the mortgage portfolio. Which kinds of account qualify is a question for counsel.
The firm offer requirement did not go away. Fitting an exception lets you receive the report. The transaction still has to be a firm offer of credit, and the Fair Credit Reporting Act’s existing prescreening rules still apply to it.
What banks and credit unions should check now
Ask your vendors which exception they rely on. If you buy any alert or list that is driven by a mortgage credit inquiry, ask the provider in writing which of the four descriptions covers each record it sends you, and how it proves that to the credit bureau.
Find out whether you are using the access you have. Many depositories qualify for a large share of their customers and receive nothing, because nobody set it up or nobody owns the follow-up. Eligibility is not a program.
Decide who calls, and what they say. A member who applied elsewhere yesterday does not want to hear that you saw their credit file. They may want to hear from the loan officer they know, with a real offer, promptly. Write that script before you turn anything on.
Have compliance confirm the rest. This summary covers one federal provision. State law, your regulator’s expectations, and the telemarketing and texting rules that apply to any outreach are for your compliance team.
If you bought trigger leads to grow, that source is gone
Lenders that relied on purchased triggers for volume now have to replace them. The Act addresses what a credit bureau may furnish. It does not address borrowers who contact you, referrals from real estate agents, or marketing to people who asked to hear from you.
So is the cheapest source of all: people who already closed a loan with you. A past borrower who hears from you a few times a year is far more likely to call you first, before a credit inquiry exists for anyone to sell. Our guide to mortgage past client marketing covers what that contact looks like in practice.
The trigger is the last line of defense, not the first
Halo has run retention programs since 1973, and for mortgage lenders since the late 1980s. The logic of a trigger has not changed in that time. By the time a trigger fires, the borrower has already chosen to start with someone else. You are calling to win back a decision, not to earn one.
The better position is to be the lender the borrower thinks of before applying. That comes from ordinary, consistent contact after closing: a thank-you, a note on the loan anniversary, useful homeowner information, and a loan officer whose name is still on the message. The new law makes that work more valuable, because it took away the shortcut for everyone who skipped it.
If you want to measure how well this is working today, start with your mortgage recapture rate. If your team is still sorting out which system owns the borrower relationship after funding, see mortgage CRM vs. LOS.
Where MortgageHalo fits
MortgageHalo runs lifecycle communication for mortgage lenders, banks, and credit unions: the contact before, during, and after the loan that keeps a relationship current. We set it up, produce the content, and send it, so it keeps running when your loan officers are busy.
Schedule a MortgageHalo Demo and bring one question: of the borrowers who closed with you three years ago, how many have heard from you this year?
Sources: Homebuyers Privacy Protection Act, Public Law 119-36 (H.R. 2808), enacted September 5, 2025; Fair Credit Reporting Act section 604(c)(4), 15 U.S.C. 1681b(c)(4). This article is general information, not legal advice.
