Trigger Leads, Explained: How They Work and What's Legal After the HPPA

If you have ever applied for a mortgage and had your phone start ringing within about 24 hours, you have met a trigger lead. It is not a coincidence, it is not a data breach, and until March 2026 it was almost entirely legal.

This is an operator's read, not legal advice.

How a trigger lead actually gets created

The mechanism is simpler and more mundane than most people assume. When a lender pulls your credit to underwrite a mortgage application, that pull is recorded as a hard inquiry on your file, and it is coded to indicate what kind of credit was sought. The credit reporting agency can see, in near real time, that a specific consumer is shopping for a mortgage right now.

That inquiry code is the trigger. The bureau assembles consumers who generated a mortgage inquiry into a prescreened list and sells that list to other lenders, who call and try to win the loan away from whoever pulled first.

Speed is the whole business model. A trigger lead is worth something on day one and close to nothing on day ten, which is why the calls arrive so fast and so relentlessly.

Why does the credit bureau get to sell that?

Because the Fair Credit Reporting Act has always permitted a narrow form of it. Under 15 U.S.C. § 1681b(c), a consumer reporting agency may furnish a report in connection with a credit transaction that the consumer did not initiate, provided the transaction is a firm offer of credit or insurance and the consumer has not opted out.

That "firm offer" requirement is doing real work. A firm offer has to be an actual offer of credit, honored if the consumer meets pre-established criteria — not a bare invitation to talk. In exchange for that discipline, the recipient gets only limited information: name and address, an identifier that is not unique to the consumer, and other data that does not reveal the consumer's relationship or experience with any particular creditor.

So prescreening itself is old, deliberate, and lawful. What changed in 2026 is not prescreening in general. It is prescreening triggered specifically by a mortgage inquiry.

What does the law actually say now?

The Homebuyers Privacy Protection Act was signed on September 5, 2025 as Public Law 119-36, and it amends FCRA § 604(c) by adding a new paragraph on the treatment of prescreening report requests. By its own terms it took effect 180 days after enactment — March 4, 2026.

The operative language is a two-part test. Where a person requests a consumer report in connection with a credit transaction involving a residential mortgage loan, the agency may not furnish a report to another person based on that request unless:

1. the transaction consists of a firm offer of credit or insurance; and
2. that other person either has certified to the agency that it has the consumer's authorization, or stands in one of three defined relationships to the consumer.

There is also a structural point that operators routinely miss.

Who can still legally receive a trigger lead?

Two doors remain open, and they are narrower than the industry chatter suggests.

The consent door. The recipient must have submitted documentation to the credit reporting agency certifying that it has the consumer's authorization. Note what that requires: not a claim of consent, but documentation submitted to the bureau. This is a paperwork obligation with a named counterparty, and it is not satisfied by a checkbox buried in a lead form.

The relationship door. Alternatively, the recipient must be one of exactly three things — the originator of a current residential mortgage loan of that consumer, the servicer of a current residential mortgage loan of that consumer, or an insured depository institution or credit union that holds a current account for that consumer.

The statute also imports precise definitions rather than leaving these terms to ordinary meaning: residential mortgage loan follows the S.A.F.E. Mortgage Licensing Act, servicer follows RESPA, and insured depository institution follows the Federal Deposit Insurance Act. If you are arguing you fit a prong, you are arguing under those definitions.

For the two exceptions worked through in detail, see who can still buy a trigger lead after the HPPA. For the before-and-after of the rule change itself, see what the Homebuyers Privacy Protection Act actually changed.

Can a consumer stop trigger leads themselves?

Yes, and this predates the HPPA entirely. The FCRA has long let consumers elect to be excluded from prescreened lists.

The official mechanism is optoutprescreen.com or 1-888-5-OPT-OUT (1-888-567-8688), operated jointly by the nationwide credit reporting agencies. An election made online or by phone lasts five years. A permanent opt-out is available, but it has to be completed by signing and returning a written Permanent Opt-Out Election form — starting it online is not enough to make it permanent.

Separately, FCRA § 615(d) and its implementing rule at 16 CFR Part 642 require anyone making a written firm offer based on a prescreened list to include a clear opt-out notice. That obligation is unchanged.

Does the new law cover text messages?

Not yet, and Congress said so explicitly. Section 4 of the Act directs the Comptroller General to study the value of trigger leads received by text message, with input from state regulators, lenders, depository institutions, credit reporting agencies, and consumers, and to report findings to Congress within the 12-month period beginning on enactment.

That is a strong signal that the text-message channel was recognized as an open question rather than settled. Treat SMS outreach off mortgage-triggered data as an area where the rules may tighten, not as a loophole with a long life expectancy. Note also that texting has its own independent consent regime under the TCPA regardless of how the underlying data was sourced.

What should an operator do now?

If any part of your acquisition depends on mortgage-triggered prescreen data:

• Re-qualify your access at the source. The bureaus enforce this. Confirm which prong you actually qualify under, in writing, rather than assuming your existing agreement survived March 4.
• Audit "current" against your own records. If you are relying on the originator, servicer, or account-holder prong, you need a defensible definition of current and data that supports it.
• Treat the certification as a real document. The consent prong requires submitting documentation to the agency. Build that artifact deliberately and keep it with your other proof-of-consent records.
• Do not assume the firm offer is optional. Both prongs are required. Whatever you send has to be a genuine firm offer of credit, honored on pre-established criteria.
• Watch the GAO report. The text-message question is live, and the findings are due within a year of enactment.

The honest summary: trigger leads are not banned, but the cold mortgage-triggered call to a stranger is effectively over. What survives is either a relationship you already have or a consent you can document to the bureau — which, not coincidentally, is the same direction almost every other lead-gen rule has moved.