TL;DR: The Homebuyers Privacy Protection Act (HBPPA, Public Law 119-36) took effect March 4, 2026. Credit bureaus can no longer sell mortgage trigger leads except in two narrow cases: documented opt-in consent, or an existing relationship (originator of record, current servicer, or insured depository institution holding a current account). For loan officers, the practical replacement isn’t another lead source. It’s working your past-borrower database harder via credit-pull monitoring, which is explicitly preserved by HBPPA’s existing-relationship exemption.
Trigger leads are dead. Your database is the replacement.
For roughly two decades, mortgage credit pulls were a lead-gen industry unto themselves. Pull a borrower’s credit, and within hours, three to seven competing lenders would buy that “trigger lead” from the credit bureaus and start dialing. Direct-to-consumer shops and call centers built whole books off it. According to HousingWire, trigger leads represented anywhere from 10% to more than 30% of total lead volume for those operations.
That ended on March 4, 2026.
The Homebuyers Privacy Protection Act (HBPPA, H.R. 2808 in the 119th Congress) amended Section 604(c) of the Fair Credit Reporting Act to restrict consumer reporting agencies from selling those leads. Two narrow exemptions. Everyone else gets cut off.
Most of the industry’s response has been one of three things: complain about it, scramble to buy expensive opt-in lead lists, or quietly try to keep doing what they were doing through workarounds. The actual answer is sitting in the CRM most loan officers already pay for. Your past-borrower database is the new trigger lead. Working it correctly is the entire game.
This is the operating guide. For a quick read on how trigger leads actually work and why they were valuable, see our primer on mortgage trigger leads.
What HBPPA actually says
The full citation: Public Law 119-36, the Homebuyers Privacy Protection Act, signed September 5, 2025, effective March 4, 2026. It runs about a page of statutory text. Short bill, big consequences.
What’s prohibited: Consumer reporting agencies (Equifax, Experian, TransUnion) can no longer sell prescreened consumer reports, the data product called a “trigger lead,” to third-party lenders based on a residential mortgage credit inquiry. Before HBPPA, any time a lender pulled credit for a mortgage, the bureaus could sell that consumer’s contact information to other lenders for solicitation purposes. After HBPPA, that pipe is closed by default.
Two exemptions (this is where most of the misunderstanding lives):
- Documented opt-in consent. If the consumer has provided documented authorization for solicitation, a lender can still receive the trigger lead. In practice, this means the consumer affirmatively checked a box, signed a form, or otherwise consented to receive offers. The consent has to be on file. This is rarely going to be the case for a random pre-approval applicant.
- Existing relationship. A lender qualifies if it is one of:
- The consumer’s current mortgage originator (the LO of record on an active application or recent loan)
- The consumer’s current mortgage loan servicer (whoever the borrower currently sends payments to)
- An insured depository institution or credit union that holds a current account for the consumer (their bank or credit union of record)
Source: legal analysis from Hunton Andrews Kurth, the law firm whose privacy-and-cybersecurity practice has tracked HBPPA since the 118th Congress version (H.R. 7297). The Mortgage Bankers Association supported the bill; CEO Bob Broeksmit went on record with HousingWire that “MBA continues to be a fierce proponent for legislative reforms that stop the abusive use of mortgage trigger leads while preserving their value in appropriately limited circumstances during a real estate transaction.”
What this means in plain English: If you have a banking relationship with the borrower, or you’re the LO who originated their last loan, or you’re servicing their current loan, you can still be alerted to their credit pull. Everyone else is cut off.
What this changes for loan officers
Three operational shifts. None of them subtle.
1. Cold-pipe acquisition just got more expensive.
If a meaningful chunk of your pipeline came through trigger leads (your own or a partner’s), that channel is gone. The replacement options are all more expensive per lead. Opt-in lead aggregators (LendingTree, Bankrate, Zillow Mortgage Marketplace) charge $40-$300+ per consumer, depending on intent score and exclusivity. The unit economics that worked at $5-$15 per trigger lead don’t work at $80+ per opt-in.
2. The competitive moat shifted from speed-of-the-bureau to depth-of-the-relationship.
Before HBPPA, every mortgage credit pull triggered a competitive auction. The lender who paid most, dialed fastest, and had the best follow-up cadence won. After HBPPA, the only lenders who get the alert are the ones who already have a relationship with the borrower. The competition is now whether your relationship signals beat the borrower’s bank’s relationship signals.
If you’re not the LO of record, the servicer, or the borrower’s bank, you don’t even know they’re shopping until they’re already gone. (For more on speed-to-lead in mortgage and why hours, not days, decide the deal, see the 5-minute rule.)
3. Database recapture went from “nice-to-have” to “the only thing left.”
Every loan officer’s past-borrower database (the people who closed with them in the last 1-7 years) just became the most valuable asset on their desk. Those past borrowers, when they shop for a new mortgage, will trigger credit pulls. As the originator of record, the LO is the lender entitled under HBPPA to know about those credit pulls. If you have systems to detect and act on them, you’re in the game. If you don’t, you’re flying blind on your own existing relationships.
If you’re benchmarking your current recapture rate against industry peers, our 2026 LO recapture rate benchmark covers what top performers are hitting and how the spread has widened since rates moved.
This is the whole reframe. HBPPA doesn’t kill mortgage acquisition. It just rewards the lenders who treat their existing customer relationships like a portfolio asset and punishes the ones who treat them like a closed-deal archive.
The replacement stack
Five practical replacements for trigger leads, ranked by how legitimate they are under HBPPA and how well they actually work.
1. Database credit-pull monitoring (legal, recommended)
If you originated their loan, you can be alerted when they get their credit pulled by another lender. This is the direct, in-bounds replacement for trigger leads, except scoped to your own past borrowers instead of the entire credit-pulling universe.
Vendors that do this: BNTouch’s Credit Check Alerts (built into the CRM, TransUnion-powered, $0.10 per record monitored per month), MonitorBase (standalone, broader feature set, higher per-record cost), Optimal Blue Capture (servicer-side recapture). The economics are dramatically better than buying replacement leads. A 1,000-borrower database produces roughly 10 hot credit-pull signals per month at $100/month total cost, or $10 per high-intent lead. Compare to $80-$300+ for an opt-in cold lead.
The math works because you already paid the acquisition cost on these borrowers. You earned the relationship. HBPPA explicitly preserved your right to act on it. For the long-form version of how to mine your database systematically, see the annual mortgage review playbook.
2. Servicer recapture campaigns (legal, requires servicing rights)
If the lender retained servicing rights on the loans they originated, they can build recapture campaigns directly to those borrowers. Statement messaging, in-app notifications, refi-opportunity alerts, behavioral triggers based on payment patterns. Servicer-of-record exemption applies. Vendors: Optimal Blue, Sales Boomerang, Total Expert.
Caveat: most independent mortgage banks don’t retain servicing rights. They sell the servicing to aggregators (Rocket, NRZ, Mr. Cooper, etc.) post-close. If you sold the servicing, you don’t get this exemption. The servicer does.
3. Opt-in lead capture (legal, expensive, high-friction)
If you can get a consumer to affirmatively opt into solicitation, you can purchase trigger leads on them. The challenge: most consumers won’t opt in unless there’s a strong incentive. Refi calculators, rate alerts, and home value tools are the typical mechanisms. The opt-in conversion rate is low. The ones who do opt in are usually serious shoppers, but you’re competing with every other lender they opt into for.
4. SEO and content (legal, slow, compounding)
Build the kind of content that mortgage shoppers actually search for, get them to your site, capture them as your own first-party database, and work them. This is a 6-12 month build. It’s also the only acquisition channel that compounds rather than depreciates. The lenders who started this work pre-HBPPA are now positioned to absorb the disruption. (For practical steps, our guide to picking a mortgage CRM covers what features actually matter for content-led acquisition vs. cold-channel acquisition.)
5. Borrower-facing technology that creates the relationship (legal, the real moat)
Borrower portal access, document upload tools, loan progress trackers, post-close dashboards. Anything that gets the borrower into a logged-in product experience with the LO becomes the relationship signal that survives the loan close. Once they’re in your portal, you’re the LO of record. You stay the LO of record. You get the credit-pull alert when they shop next time.
This is the hardest replacement to build but the longest-lasting. It’s also why mortgage CRMs that handle the borrower-facing layer end up being more valuable than the ones that only handle the LO-facing layer.
How BNTouch’s Credit Check Alerts work, specifically
This section is for loan officers and ops directors who want to understand the mechanics before they pick a tool.
What it is: A feature inside the BNTouch CRM that monitors a list of borrowers (you choose which: full database, just funded clients, just leads from the last 6 months, segmented groups) for mortgage credit pulls. When TransUnion records a credit pull on someone in your monitored list, BNTouch alerts you within 1-2 days via email and dashboard notification. The alert includes the borrower’s name, when the pull occurred, and one-tap follow-up actions (call, text, drip campaign).
The HBPPA legitimacy: Because BNTouch’s monitoring is scoped to borrowers you originated or have an existing relationship with, the lender (you) qualifies under the existing-relationship exemption in HBPPA. The data flow is TransUnion → BNTouch (acting as your monitoring agent) → you, the LO of record. No third-party lender is purchasing your borrower’s information. The exempt-relationship structure is preserved.
The cost structure:
- $0.10 per record per month
- 1,000 contacts on monitoring = $100/month
- Approximately 10 hot credit-pull signals per month from a 1,000-contact database (rough industry baseline; varies with database age and economic conditions)
- Effective cost: ~$10 per hot lead
Why the math beats the alternatives: A 1,000-borrower database costs $100/month to monitor. That same $100 buys you about one to two opt-in cold leads from a major aggregator. The hot leads from credit-pull monitoring are people who literally just had their credit pulled for a mortgage. They are actively shopping right now. The aggregator leads are people who filled out a form, possibly weeks ago, possibly because they were curious. Different intent levels. Different conversion rates.
What it doesn’t do (be honest about this): Credit-pull monitoring is not a magic acquisition channel. It still requires the LO to call within hours, have the right pitch, run an actual rate quote, and follow through. The alert is a starting gun. The race still has to be run.
Speed is decisive in mortgage credit-pull recapture. Once a borrower’s credit gets pulled by another lender, that lender is calling them within 24 hours. If you don’t reach the borrower first, you’re competing against an active conversation. The lenders who win these recaptures consistently call inside the first business day after the alert.
For BNTouch users specifically, the right tier depends on team size. Individual works for solo LOs with their own database. Team handles branch-level deployments with shared monitoring queues and lead routing. Enterprise handles IMB-scale deployments with custom integrations and dedicated support.
Considerations for IMB lenders
Eight items worth pressure-testing your stack against before you find out you have a problem. None of these are legal advice. Run them past counsel.
- Are you still buying trigger leads from any third-party data broker? If yes, those agreements deserve a fresh review. The bureau-direct trigger lead pipe closed March 4, 2026. Some broker repackagers may still try to sell what they’ve already collected; the legal status of those is uncertain.
- Do your existing opt-in lead capture forms collect documented authorization that meets HBPPA’s “documented opt-in” standard? If the consent language is generic, audit and rewrite with counsel.
- For each borrower in your active book, can you document which exemption applies? (Originator of record, servicer, depository institution with current account, or documented opt-in.) The exemption documentation is what protects you if a borrower disputes contact.
- If you sold servicing rights, does your originator-of-record claim still hold? Most legal commentary suggests yes (the originator-of-record relationship doesn’t terminate just because servicing was sold), but the answer depends on your specific portfolio and contracts.
- Do your text and call scripts comply with TCPA prior-express-written-consent requirements? HBPPA doesn’t change TCPA. The FCC reinstated the prior-express-written-consent (PEWC) standard on August 29, 2025, and pushed the revoke-all rule to January 31, 2027. Your scripts and consent records still need to be TCPA-clean. We covered the related 10DLC registration requirements in detail.
- Are your lead-vendor SOWs renegotiated for the post-HBPPA volume drop? Vendors that were charging based on volume may need new terms.
- Is your database clean and segmented? Credit-pull monitoring only works if your database is current. Bad email addresses and stale phone numbers turn alerts into dead-ends.
- Do you have an incident-response plan if a borrower complains about being contacted post-pull? HBPPA enforcement is FCRA-based. Civil penalties exist. Document your exemption-eligibility for every contact.
If your team is handling co-marketing relationships with realtors as part of your acquisition mix, our RESPA Section 8 explainer covers the related compliance perimeter.
Common questions
Did HBPPA kill all trigger leads or just some of them?
HBPPA restricted the pipe at the credit bureau level. Bureaus can no longer sell trigger leads except in the two exempted scenarios (opt-in consent or existing relationship). Whether downstream data brokers can repackage older data is legally murky and worth a counsel review.
When did HBPPA take effect?
March 4, 2026. The bill was signed by President Trump on September 5, 2025. The effective date was 180 days after enactment.
Can I still call my own past borrowers?
Yes. As the originator of record, you qualify for the existing-relationship exemption. The credit pull alerts on your past borrowers, scoped through a tool like BNTouch’s Credit Check Alerts, are explicitly preserved by HBPPA.
Does HBPPA apply to commercial mortgages or only residential?
HBPPA’s restrictions are tied to residential mortgage credit inquiries. Commercial mortgage transactions are outside its scope.
What about consumer-direct opt-ins via my website?
If the opt-in language meets the documented-authorization standard (clear consumer authorization to receive solicitations from third parties, on file), the consumer’s credit pull can still be furnished to opted-in lenders. Audit the language with counsel.
Is BNTouch’s Credit Check Alerts a workaround or actually compliant?
Compliant. The alerts are scoped to borrowers where the BNTouch user has an existing originator relationship. The HBPPA exemption applies directly. BNTouch acts as the monitoring agent for the lender (you), not as a data broker selling to third parties.
What replaces trigger leads for lenders without a database?
Newer lenders without a past-borrower database are the most exposed by HBPPA. The honest answer is: you build the database faster. SEO content, opt-in lead capture, partnership channels with realtors and financial advisors, and content-led nurture become the only paths. The first-party database is no longer optional.
Bottom line
HBPPA closed the door on the trigger-lead industry on March 4, 2026. The lenders who built their business on cheap trigger-lead acquisition are scrambling. The lenders who treated their past-borrower database as a strategic asset are accelerating.
Your CRM either does credit-pull monitoring on your existing database or it doesn’t. If it does, every past borrower you originated becomes a recurring source of high-intent leads that competitors can’t see and can’t bid on. If it doesn’t, you’re paying $80-$300+ per cold lead while the LOs with monitoring tools are paying $10 per hot lead.
The replacement for trigger leads is the database you already have. The question is whether you’re working it.
See how Credit Check Alerts work →
Book a Demo →
Looking for the broader picture on what mortgage CRM features matter most in a post-HBPPA market? See our 2026 mortgage CRM buyer’s guide.
Sources
