Equifax trigger leads were mortgage-shopper records the credit bureau sold to competing lenders within minutes of a loan officer pulling a borrower’s credit — but the practice is now banned nationwide. The Homebuyers Privacy Protection Act, signed into law September 5, 2025 and in force since March 4, 2026, amended the Fair Credit Reporting Act to stop Equifax, Experian, and TransUnion from selling trigger leads to third parties except in a few narrow, documented cases. If you’re still budgeting for trigger leads in your 2026 marketing plan, you’re planning around a lead source the bureaus can no longer legally sell you outside those exceptions.
What Were Equifax Trigger Leads, Exactly?
A trigger lead fired the moment a lender pulled a consumer’s credit report to process a mortgage application. That credit pull “triggered” an alert inside the bureau’s system, and Equifax (along with Experian and TransUnion) packaged the borrower’s name, address, contact details, and credit profile — FICO score, existing balances, loan type inquired about — and sold it to other lenders and brokers who’d prequalified to buy the list. Competing loan officers could then start calling before the original lender finished underwriting the file.
It was legal under the old version of the FCRA because bureaus can furnish credit information for a “firm offer of credit,” and trigger leads were sold on that basis. The result: borrowers who’d just applied for a mortgage commonly reported 5–15 calls and dozens of texts and emails within 72 hours of their credit being pulled, often before they’d even heard back from the lender they applied with — the exact pattern the industry press covered on the run-up to the ban.
Are Equifax Trigger Leads Still Legal in 2026?
No — not for the general marketing use they were sold for. The Homebuyers Privacy Protection Act (H.R. 2808 / S. 1467, 119th Congress) amended the FCRA to prohibit a consumer reporting agency from furnishing a credit report to a third party in connection with a residential mortgage transaction unless that transaction is a genuine firm offer of credit and one of the exceptions below applies. Equifax can no longer sell a cold trigger lead to a competing loan officer who has no relationship with that borrower. The law took effect 180 days after signing — March 4, 2026 — so as of this post it has been federal law for nearly six months.
What Are the Narrow Exceptions Under the New Law?
Equifax (and the other bureaus) can still furnish credit data connected to a mortgage inquiry when one of these applies:
- The consumer has given documented consent to the specific third party.
- The third party originated the consumer’s current mortgage.
- The third party is the consumer’s current mortgage loan servicer.
- The third party is a bank or credit union with a current, specified account relationship with the consumer (e.g., their depository institution).
In practice, that means your own past clients and your own servicing book are still fair game for retention marketing — the law targets cold, unconsented sales to strangers, not communication with borrowers you already have a relationship with.
Why Did Equifax Sell Trigger Leads in the First Place?
Selling trigger leads was a revenue line for the bureaus and a volume-lead source for lenders willing to buy in bulk and dial fast. For loan officers with a large call team, trigger leads could produce volume cheaply per record. The catch was always contact rate: a borrower fielding a dozen calls in two days answers fewer of them, and the ones who do answer are often annoyed rather than receptive. Trigger leads were never the cheapest lead when you ran the true cost per funded loan — and now, for most loan officers, they’re not a legally available option at all.
What Should Loan Officers Do Instead of Buying Trigger Leads?
The ban doesn’t shrink the market for mortgages — it shifts where new business has to come from. Three sources are still fully legal and, for most LOs, were already outperforming trigger leads on cost per funded loan:
- Your own database. Past clients and current servicing relationships are explicitly exempt — reactivating them is now relatively more valuable, not less.
- Exclusive, consented leads you generate yourself. Ads, landing pages, and referral funnels where the borrower opts in directly to you sidestep the FCRA issue entirely because the consumer consented to being contacted by you specifically. See how top LOs get mortgage leads without buying lists for the full playbook.
- Realtor and referral partnerships. Referral leads were never trigger leads — they were always relationship-based, and that channel gets relatively stronger now that a major volume source disappeared for everyone at once.
Speed still matters on whichever source you use — see the 5-minute speed-to-lead rule for what “fast” needs to mean once a lead does come in, and an AI chat and voice agent that answers instantly closes more of the gap that trigger-lead buyers used to try to win with volume alone. A mortgage-specific CRM that routes and reactivates your own database automatically is what makes the exempt channel — your past clients — actually work at scale.
Trigger Leads vs. Exclusive Self-Generated Leads
| Factor | Trigger Leads (pre-ban) | Exclusive Self-Generated Leads |
|---|---|---|
| Legal status (2026) | Banned outside narrow exceptions | Fully legal — consumer opts in to you |
| Consumer consent | None — triggered by a credit pull elsewhere | Direct — consumer submits their info to you |
| Competition on the lead | Sold to multiple lenders simultaneously | Yours alone |
| Borrower receptiveness | Low — one of many callers within 72 hours | Higher — expects your call |
| Where it fits now | Only past clients / current servicer / consented | Any new prospect |
Key Takeaways
- Equifax trigger leads let lenders buy contact info the moment a competitor pulled a borrower’s credit — legal until the Homebuyers Privacy Protection Act.
- The Act took effect March 4, 2026 and amended the FCRA to ban cold trigger-lead sales to third parties.
- Exceptions cover only documented consent, the borrower’s current lender/servicer, or their existing bank/credit union relationship.
- Marketing to your own past clients and servicing book is unaffected — and now relatively more valuable.
- Exclusive, consented lead generation and referral partnerships are the legally durable alternatives going forward.
FAQ
Can Equifax still sell my mortgage inquiry data to other lenders?
Only if one of the FCRA exceptions applies — the requesting party is your current lender or servicer, your bank/credit union, or you gave documented consent. Cold sales to unrelated lenders are banned as of March 4, 2026.
Is the trigger lead ban federal or state-by-state?
It’s federal — the Homebuyers Privacy Protection Act amends the FCRA nationwide. Several states had already passed their own restrictions before the federal law took effect.
Can I still buy leads from Experian or TransUnion the same way?
No — the law applies to all nationwide consumer reporting agencies, not just Equifax. The same exceptions and restrictions apply across all three bureaus.
What happens if a vendor still offers to sell me trigger leads?
Treat that as a compliance red flag. Ask exactly which exception they’re relying on and get it in writing before you use the list — the liability for using an improperly furnished report can fall on the buyer too.
Does this affect leads I generate through my own website or ads?
No. Leads that opt in directly to you through your own site, forms, or ad campaigns were never trigger leads and aren’t affected by this law.
Where can I read the actual law?
The bill text is public on Congress.gov under H.R. 2808 / S. 1467, “Homebuyers Privacy Protection Act,” 119th Congress.