Mortgage trigger leads: what they are and what the 2026 ban restricts
The Homebuyers Privacy Protection Act (Public Law 119-36), signed on September 5, 2025, limits when a credit bureau may sell a mortgage trigger lead: the list of consumers whose credit was just pulled for a mortgage. It took effect 180 days after signing, in early March 2026, and allows trigger leads only for a firm offer, to a company the consumer authorized or already has a mortgage, servicing or account relationship with.
Updated
The law at a glance
- Law
- Homebuyers Privacy Protection Act, Public Law 119-36 (H.R. 2808)
- Signed
- September 5, 2025
- In effect
- 180 days after signing: early March 2026
- Amends
- Fair Credit Reporting Act section 604(c), 15 U.S.C. 1681b(c), new paragraph (4)
- Applies to
- Credit bureaus furnishing reports after a residential mortgage credit pull
What is a mortgage trigger lead?
A mortgage trigger lead is a consumer report a credit bureau sells to other lenders because a consumer's credit was just pulled for a mortgage. The consumer applies with one lender, that lender pulls credit, and the pull "triggers" a prescreened list that other companies buy to call, text or mail the same consumer while they are shopping.
What does the Homebuyers Privacy Protection Act change?
Section 2 adds paragraph (4) to section 604(c) of the Fair Credit Reporting Act.
When someone requests a consumer report in connection with a residential mortgage credit transaction, the credit bureau may not use that request, in whole or in part, as the basis for furnishing a prescreened report to another company, unless both conditions below are met.
"(B) Limitation. If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless (i) the transaction consists of a firm offer of credit or insurance; and (ii) that other person (I) has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or (II)(aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates; (bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or (cc)(AA) is an insured depository institution or credit union; and (BB) holds a current account for the consumer to whom the consumer report relates."
Public Law 119-36, section 2, 139 Stat. 493 to 494. Line breaks and dashes from the enacted text are run together here.
Who can still receive a mortgage trigger lead?
Only a company that meets both conditions.
First, the transaction must be a firm offer of credit or insurance.
Second, the company receiving it must be one of these:
- A company that has certified to the credit bureau that it has the consumer's authorization.
- The originator of the consumer's current residential mortgage loan.
- The servicer of the consumer's current residential mortgage loan.
- An insured depository institution or credit union that holds a current account for the consumer.
The Act took effect 180 days after it was signed on September 5, 2025, which puts the start of these limits in early March 2026.
How is an opt-in LenderMatch request different?
A LenderMatch request is not a report from a credit bureau. It starts when a homeowner fills out a HELOC, refinance or VA cash-out form on lendermatch.io and agrees, in writing, to be contacted by LenderMatch and up to four participating lenders and partner companies named on the partner network page. LenderMatch never pulls the homeowner's credit.
A TrustedForm certificate and a Jornaya LeadiD are captured on every form submission, and the exact consent text is published on how requests are generated. How the Act or any other rule applies to a program you run is a question for your own counsel; this page summarizes the enacted text and is not legal advice.
What can lenders use instead of trigger leads?
Four routes are left: trigger leads on your own customers, which the Act still allows; opt-in request leads from homeowners who filled out a form; referral partners, within RESPA section 8; and prescreened firm offers that are not based on a mortgage inquiry. Each one, with its rules, is on trigger lead alternatives.
What else do lenders ask about the trigger leads ban?
Are mortgage trigger leads now illegal?
Not outright. Since the Homebuyers Privacy Protection Act took effect in early March 2026, a credit bureau may furnish a mortgage trigger lead only for a firm offer of credit or insurance, and only to a company the consumer authorized or that already has a qualifying relationship with them.
When did the trigger leads ban take effect?
The Act was signed on September 5, 2025, and took effect 180 days later, in early March 2026.
Which law restricts mortgage trigger leads?
The Homebuyers Privacy Protection Act, Public Law 119-36 (H.R. 2808). It adds paragraph (4) to section 604(c) of the Fair Credit Reporting Act, 15 U.S.C. 1681b(c).
How can consumers opt out of trigger leads and other prescreened offers?
At optoutprescreen.com or by calling 1-888-5-OPT-OUT (1-888-567-8688), the opt-out run by the major credit bureaus. The FTC describes a five-year and a permanent option.
What is the GAO studying?
Section 4 of the Act directs the Comptroller General to study the value of trigger leads received by text message, with input from state regulators, lenders, depository institutions, credit bureaus and consumers, and to report to Congress within 12 months of enactment.
Which sources is this page based on?
Read on October 27, 2026.
- Public Law 119-36, Homebuyers Privacy Protection Act, 139 Stat. 493, approved September 5, 2025 (H.R. 2808; S. 1467). U.S. Government Publishing Office, GovInfo. Sections 2 (the limitation), 3 (effective date) and 4 (GAO study).
- Prescreened Credit and Insurance Offers, Federal Trade Commission consumer advice, last updated November 2023. The optoutprescreen.com and 1-888-5-OPT-OUT opt-out.
More for lenders
Every page in this section, plus the public partner network page borrowers see before they submit.
- Join our networkProducts, delivery, filters, pricing model and the test program form
- HELOC leadsHome equity line of credit requests
- Refinance and cash-out leadsRate-and-term and cash-out refinance requests
- VA cash-out refinance leadsRequests from the VA cash-out form
- Sample leadEvery field on a HELOC request, with sample values
- CRM integrationsVelocify, Insellerate, LeadMailbox, Bonzo and direct post
- How requests are generatedConsent text, TrustedForm, Jornaya, opt-outs, records
- The trigger leads banYou are on this page
- Lender FAQEvery question lenders ask before buying
Guides for buying leads
- How to buy mortgage leadsWhat to check before you pay for a lead
- Mortgage lead generation companiesThe kinds of lead companies and how to compare them
- Exclusive vs shared mortgage leadsWhat each means and when each fits
- Real-time vs aged mortgage leadsPlus live transfers, and how to test each
- How to get mortgage leadsEvery channel for loan officers and brokers
- Speed to leadHow fast to call and what to say
- TCPA rules for mortgage leadsConsent, Do Not Call and revocation in 2026
- Trigger lead alternativesWhere lenders find borrowers after the ban
- Mortgage lead calculatorCost per funded loan and break-even lead price
Start with a test program.
Tell us your products, states and filters. We reply within one business day to talk through pricing and a test insertion order, and a test post reaches your system before any live request does.
Prefer email? Write to contact@lendermatch.io.