TL;DR: Trigger leads alerted strangers when ANY consumer had their credit pulled for a mortgage. Credit-pull alerts on a CRM like BNTouch alert you when YOUR past borrowers have their credit pulled. Same data event, completely different consumer relationship — which is why one was banned and the other is explicitly preserved by HBPPA. The economics of the legal version are dramatically better.
Credit Pull Alerts vs. Trigger Leads: same data, different consumer relationship, different legal status
Credit pull alerts vs trigger leads — comparison of the replacement acquisition channel.
Trigger leads were the third-party-broker version of a simple data event: a consumer had their credit pulled for a mortgage. Credit-pull alerts on a CRM are the existing-relationship version of the exact same event. The data flow looks similar from the outside. The legal status, lead quality, and unit economics are fundamentally different. This is the head-to-head.
For the regulatory context (why one was banned and the other wasn’t), see our HBPPA pillar.
How each one worked (or works)
Trigger leads (banned March 4, 2026):
Lender A pulls a consumer’s credit for a mortgage application.
The credit bureau (Equifax, Experian, or TransUnion) records the inquiry.
The bureau sells that consumer’s contact information to Lenders B, C, D, and E (any lender willing to pay) as a “prescreened consumer report.”
Lenders B-E receive contact information within hours and start dialing.
The consumer gets calls from 5-10 lenders they’ve never heard of, often before Lender A has even sent a pre-approval letter.
Credit Pull Alerts (legal under HBPPA’s existing-relationship exemption):
You originated Borrower X’s loan in 2022. Borrower X is in your CRM as a past borrower.
Borrower X decides to refinance and applies with a competitor in 2026. The competitor pulls their credit.
The credit bureau records the inquiry. BNTouch’s Credit Check Alerts (powered by TransUnion data) detects the pull on Borrower X within 24-48 hours.
You — the originator of record — receive an email and dashboard notification: “Borrower X had their credit pulled. Time-stamped. Contact info ready.”
You call Borrower X within an hour and try to keep the loan.
Same underlying data event. Different consumer relationship. Different lender population getting alerted. HBPPA prohibits the first because it sells consumer information to strangers. HBPPA preserves the second because it alerts the lender who already has a documented relationship with that consumer.
Cost comparison
Channel
Cost per lead
Status
Pre-HBPPA trigger leads
$5-15 per lead
Banned
Credit Pull Alerts (BNTouch, on past borrowers)
~$10 per high-intent lead ($0.10/record × ~10 hot pulls/month per 1,000 contacts)
Legal (existing-relationship exemption)
Opt-in cold leads (LendingTree, Bankrate, Zillow)
$80-300+ per lead
Legal (with proper consent)
Realtor referral lead
Variable (relationship cost, often non-cash)
Legal (RESPA-compliant)
Per-lead cost on Credit Pull Alerts is in the same range as the old trigger-lead cost, BUT with much higher conversion (these are people you already have a relationship with) and zero legal risk under HBPPA.
Lead quality comparison
Trigger leads were cold by definition — the consumer had no relationship with the receiving lender. Conversion rates were low (3-8% from contact-to-application, 15-25% application-to-funded). The lender who closed was usually the one who called first, not the one who offered the best rate.
Credit Pull Alerts on past borrowers convert at much higher rates because the relationship already exists. Industry data suggests:
Contact-to-application: 30-50% on past-borrower credit-pull alerts (vs. 3-8% on cold trigger leads)
Application-to-funded: 50-70% (vs. 15-25%)
Net contact-to-funded: 15-30% on alerts (vs. ~1-2% on cold trigger leads)
Same data event drives both, but the relationship layer multiplies conversion by roughly 10x. This is why the unit economics flip even though per-lead cost is similar.
Legal status comparison
This is the part most LOs need to internalize. The two channels look similar but aren’t legally equivalent.
Trigger leads: Banned by HBPPA effective March 4, 2026. Credit bureaus can no longer sell prescreened consumer reports to third-party lenders based on residential mortgage inquiries, except in the two narrow exemptions (documented opt-in or existing relationship). Operating outside those exemptions exposes the lender to FCRA civil penalties and consumer private-action lawsuits.
Credit Pull Alerts (BNTouch’s implementation): Legal under the existing-relationship exemption. The data flow is TransUnion → BNTouch (acting as monitoring agent for the lender) → the lender (who is the originator of record on the monitored borrower). No third-party lender purchases the borrower’s information. The relationship between the alert recipient and the consumer pre-dates the alert and qualifies for the exemption.
This isn’t a workaround. It’s the structural difference HBPPA was written to preserve. The MBA testified in support of HBPPA precisely because it banned the abusive third-party version while leaving the legitimate originator-side recapture intact.
Anyone with a mortgage credit pull (the entire universe)
Your past borrowers only (your existing book)
Legal exposure
Banned; FCRA + private right of action exposure
Compliant under existing-relationship exemption
Follow-up integration
Required external CRM integration
Built into the CRM dashboard with one-tap call/text/drip
Why the BNTouch latency is acceptable (and why fast latency on cold leads was misleading)
Hours-versus-days alert latency sounds like it matters more than it does in practice.
On cold trigger leads, hours-of-latency was the entire game because lender A through E were racing to call a stranger first. The borrower would pick whichever lender was on the phone when they answered. Speed was decisive because relationship didn’t exist.
On past-borrower alerts, the relationship already exists. The borrower knows you. The 1-2 day latency window still leaves 5-10 days before the typical refi locks. As long as you call within 24 hours of the alert, you’re in the race. The relationship advantage compensates for the latency disadvantage. (For more on speed dynamics in mortgage lead conversion, see our 5-minute rule post.)
What replaces the breadth of trigger leads?
Honest answer: nothing fully replaces the breadth, because trigger leads were structurally a third-party data product that HBPPA decided was abusive. The replacements are different in shape:
Database depth replaces breadth. Mining your past-borrower book systematically produces a smaller but higher-converting funnel.
Opt-in capture for new borrowers. Calculator pages, refi tools, rate-watch alerts capture consumer intent and consent in one motion.
Content + SEO. Long build, but the only channel that compounds.
Is BNTouch’s Credit Check Alerts a workaround or actually compliant under HBPPA?
Compliant. The alerts are scoped to borrowers where the BNTouch user has an existing originator-of-record relationship. HBPPA’s existing-relationship exemption applies. BNTouch acts as the monitoring agent for the lender, not as a third-party data broker selling to strangers.
Can I use Credit Pull Alerts on borrowers who haven’t been with me yet?
No. The exemption requires an existing relationship. Credit-pull monitoring on consumers who have not been your past borrowers and have not opted in to solicitation falls outside HBPPA’s exemptions. Use opt-in capture or consumer-direct marketing for prospects you don’t already have a relationship with.
What’s the typical conversion rate on Credit Pull Alert leads?
Industry-typical contact-to-funded conversion on past-borrower credit-pull alerts is 15-30%, depending on speed of follow-up, rate environment, and existing relationship strength. This is roughly 10x the conversion rate of cold opt-in leads at a fraction of the per-lead cost.
How does the BNTouch monitoring detect a credit pull within 1-2 days?
TransUnion notifies BNTouch when a mortgage credit pull is recorded on anyone in the user’s monitored list. The check runs daily, so the alert latency is determined by when in the daily cycle the pull occurred. Most alerts arrive within 24 hours of the pull; worst case is around 48 hours.
