WASHINGTON–In the wake of passage of the Homebuyers Privacy Protection Act which seeks to crack down on the practice of using so-called “trigger leads” that are created soon after a consumer has applied for a mortgage loan, two regulatory attorneys have offered some insights to provide credit unions with guidance.
In a post on LinkedIn, In-Sung Yoo and Brandy Bruyere of Honigman, LLP explained that the bipartisan legislation updated the Fair Credit Reporting Act (#FCRA) and will place much stricter requirements on lenders’ ability to use such trigger leads to market their products effective March 4, 2026.
Who May be Affected
“This may impact financial institutions if they were using such programs for broad lead generation for prospective mortgage borrowers outside of making firm offers of credit to existing customers,” the blog post states.
As Bruyere and Yoo explain, trigger leads are sold by the credit reporting agencies (CRAs) to third party lenders after a consumer applies for a mortgage elsewhere. Once there is a hard credit pull, the trigger leads are produced, and those third party lenders can purchase and mine the information in those reports to quickly send competing offers to that consumer who they now know is actively in the market, the said.
The Criteria
As the authors noted, effective March 4, 2026, these FCRA amendments will prohibit the provision and use of trigger leads stemming from consumer mortgage applications, unless the third party is making a firm offer of credit, and, only when the requesting third party has certified that meets one of the following criteria:
- The consumer has explicitly consented to such solicitations
- The third party has originated a current mortgage loan of the consumer
- The third party is the servicer of the current mortgage
- The third party is an insured bank/credit union and holds a current account for the consumer.
What Must be Done Now
“While the prior framework relied primarily on the intent to deliver a firm offer of credit to justify the use of trigger leads, some lenders were not complying with this requirement,” the post states. “As of March 6th, lenders looking to market their products on the backs of trigger leads will need to confirm either a preexisting relationship with that consumer, or have obtained explicit documentable consent in order to move forward with their offer. This comes on the heels of state-level efforts to crackdown on these activities, which lenders will also want to keep an eye on for variations on these requirements.”
