Are trigger leads illegal in 2026?

Mortgage trigger leads are effectively banned. The Homebuyers Privacy Protection Act, Public Law 119-36, amended section 604(c) of the Fair Credit Reporting Act so that a consumer reporting agency may not furnish a report based on a residential mortgage credit inquiry except under one narrow two-part test. The restriction falls on the credit bureau, so it is more accurate to say the bureaus may no longer sell them than to say a loan officer may no longer buy them.

When did the trigger lead ban take effect?

4 March 2026. Section 3 of the Homebuyers Privacy Protection Act says the Act takes effect on the date that is 180 days after enactment, and the Act was approved 5 September 2025. Counting from 6 September 2025, day 180 falls on 4 March 2026. Several widely cited pages, including the National Association of Mortgage Brokers explainer and RISMedia's coverage, give 5 March 2026 instead.

What is the Homebuyers Privacy Protection Act?

It is Public Law 119-36, passed as H.R. 2808 in the 119th Congress and approved 5 September 2025. It adds a new paragraph (4) to section 604(c) of the Fair Credit Reporting Act, 15 U.S.C. 1681b(c), restricting when a consumer reporting agency may furnish a prescreened report triggered by a residential mortgage credit inquiry. It also orders a Government Accountability Office study on trigger leads received by text message.

Can any lender still buy mortgage trigger leads?

Only under a two-part test. The transaction must consist of a firm offer of credit or insurance, and the recipient must also satisfy one of four conditions: it has filed documentation certifying it holds the consumer's authorisation, or it originated that consumer's current residential mortgage loan, or it is the servicer of that loan, or it is an insured depository institution or credit union that holds a current account for the consumer. A firm offer of credit on its own is not enough.

Does the trigger lead ban stop loan officers from cold calling?

No. The Act restricts what a consumer reporting agency may furnish. It says nothing about who a loan officer may call, and it does not touch the Telephone Consumer Protection Act, the Do Not Call rules or state telemarketing statutes, all of which applied before and still apply. One specific list stopped being for sale. The rules on dialing a list are exactly where they were.

What replaces trigger leads for a mortgage desk?

The database the loan officer already owns: past clients, applications that never closed, the servicing portfolio, and realtor and builder referral partners. That list arrives as a spreadsheet, so it wants a dialer with dispositions and callbacks instead of instant lead-to-dial speed. Two loan officers at 120 dials a day place about 5,040 dials a month, enough to work a list of roughly 630 to 840 people at six to eight attempts each.

What does it cost to dial your own database instead?

On DialSheet, $29 a month for a three-seat pack plus about $28 of Twilio at 5,040 dials, so about $57 a month all in for two loan officers. Purchased mortgage leads are advertised at $20 to $100 each for conventional and FHA by the lead platform Phonexa, so the dialing side of the switch costs less than three leads a month. The real cost of the switch is the loan officer's calling time, which the arithmetic above does not price.

Mortgage Trigger Leads: What the 2026 Ban Actually Says

The short answer

Verified 2026-09-08

Mortgage trigger leads are effectively banned in the United States. The Homebuyers Privacy Protection Act, Public Law 119-36, was approved 5 September 2025 and its own effective-date section sets it running 180 days later, which is 4 March 2026. It bars a credit bureau from furnishing a report off the back of a mortgage credit inquiry unless two things are true together: the transaction is a firm offer of credit or insurance, and the recipient has certified the consumer's authorisation, or originated that consumer's current mortgage, or services it, or is an insured depository institution or credit union holding a current account for them. The firm offer alone permits nothing, which is the part most summaries get wrong. The law regulates the bureau rather than the loan officer, so nothing in it stops you calling a database you already own.

This page is orientation, not legal advice. It quotes the enacted text so you can read the statute yourself, and it is written for the person who has to decide what the desk dials on Monday. If you buy consumer lists at volume, take this to counsel.

What the statute actually says

The Homebuyers Privacy Protection Act is short. It was passed as H.R. 2808 in the 119th Congress, approved 5 September 2025, and published as Public Law 119-36. Section 2 adds a new paragraph (4) to section 604(c) of the Fair Credit Reporting Act, 15 U.S.C. 1681b(c). The operative part is subparagraph (B), and here it is verbatim:

If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless (i) the transaction consists of a firm offer of credit or insurance; and (ii) that other person (I) has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or (II)(aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates; (bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or (cc)(AA) is an insured depository institution or credit union; and (BB) holds a current account for the consumer to whom the consumer report relates.

Read the joining words carefully, because they carry the whole meaning.

Clause (i) and clause (ii) are joined by and. Inside clause (ii), the four routes are joined by or. So the test is: a firm offer of credit or insurance, plus one of four qualifying relationships. Both halves, every time.

The four qualifying relationships are:

The recipient has filed documentation with the bureau certifying it holds the consumer's authorisation under paragraph (1)(A)
It originated that consumer's current residential mortgage loan
It is the servicer of that loan
It is an insured depository institution or credit union and holds a current account for that consumer

The Act also pins three of its terms to other statutes rather than defining them loosely. Servicer takes its meaning from section 6(i) of the Real Estate Settlement Procedures Act, 12 U.S.C. 2605(i). Residential mortgage loan takes its meaning from section 1503 of the S.A.F.E. Mortgage Licensing Act, 12 U.S.C. 5102. Insured depository institution comes from section 3 of the Federal Deposit Insurance Act. Those cross-references are what stop the exceptions drifting outward in practice.

Where the popular summaries go wrong

Two pages rank near the top for this question and both describe the exceptions more loosely than the text allows.

RISMedia presents the firm offer as a standalone exception, alongside a second exception for a lender with a "preexisting banking relationship with the applicant". In the statute the firm offer is clause (i) of a two-part test. A firm offer of credit permits nothing by itself. A lender reading that summary could conclude its prescreened offers still qualify. They do not, unless one of the four relationships in clause (ii) also holds.

The National Association of Mortgage Brokers compresses clause (ii) into "a qualifying existing financial relationship with the consumer (such as a current mortgage or deposit account)". That phrase appears nowhere in the Act. The statute names four specific routes, and the deposit-account route is narrower than it sounds: it requires an insured depository institution or credit union, and it requires a current account. Neither page quotes the text. NAMB links to the bill on Congress.gov without quoting from it.

Neither summary is dishonest and both get the direction right. The looseness matters anyway, because the people reading them are deciding what their compliance department signs off on.

The date is 4 March 2026

Section 3 is one sentence:

This Act, and the amendments made by this Act, shall take effect on the date that is 180 days after the date of enactment of this Act.

The Act was approved 5 September 2025. Count 180 days from 6 September 2025: 25 days left in September, 31 in October, 30 in November, 31 in December, 31 in January, 28 in February 2026. That is 176. Four more days lands on 4 March 2026.

RISMedia and NAMB both say 5 March 2026. So do several of the lender blogs repeating them. One day makes no practical difference to a desk today, and it is a useful test of whether a page counted anything itself or copied the page above it.

The law regulates the bureau, not the loan officer

This is the sentence most often missed, and it is the one that decides what you may still do.

Every prohibition in the Act runs against the consumer reporting agency: that agency "may not ... furnish a consumer report to another person". The Act imposes no duty on a mortgage broker, no calling restriction, and no new consent standard for outbound calls.

So the practical position is narrow. The bureaus may no longer sell the list. Nothing in this statute changed who you may call. The Telephone Consumer Protection Act, the National Do Not Call Registry, state mini-TCPA statutes and the abandonment cap on predictive dialing all applied before 4 March 2026 and all still apply. Our cold calling laws guide covers those.

One consequence worth planning for: if a list vendor offers you something that looks like trigger-lead data after March 2026, the compliance exposure attaches to the vendor's furnishing chain, and your diligence on it is your own problem. Ask for the certification route in writing.

The follow-up study nobody is watching

Section 4 of the Act orders the Comptroller General to study "the value of trigger leads received by text message", taking input from state regulators, mortgage lenders, depository institutions, consumer reporting agencies and consumers. The report is due to Congress "not later than the end of the 12-month period beginning on the date of enactment", which ends 4 September 2026.

Searching on 8 September 2026 we could not find a published GAO report on it. Treat that as a negative finding and not a confirmed absence: GAO reports appear on gao.gov and are not always indexed quickly, and the study may be published without a press cycle. It is worth watching, because Congress ordered a study specifically about the text-message channel, which is the channel a restriction on furnishing does not obviously reach.

What replaces the volume, priced

Trigger leads were a speed product. The signal was worth something for a few hours, so the only feature that mattered was how fast the first call fired. That is why the mortgage dialer pages still ranking are built around instant lead-to-dial webhooks, and speed does still matter on any lead you buy: the Lead Response Management study run by James Oldroyd at MIT Sloan with InsideSales.com, across six companies, more than 15,000 leads and over 100,000 call attempts, found the odds of qualifying a lead fall by a factor of 21 at 30 minutes against 5 minutes.

The list that replaced it behaves differently. Past clients, applications that never closed, the servicing portfolio, realtor and builder partners. It arrives as a spreadsheet. It never goes stale in four hours and it never arrives by webhook. What it needs is a dialer that chews through it with dispositions and callbacks.

Here is the size of that job, using benchmarks rather than promises.

Two loan officers at 120 dials each per working day, 21 working days, is 5,040 dials a month. At the 4.8 percent cold call connect rate Cognism reports, that is about 250 conversations. Reaching a given person takes six to eight attempts on average, per the Brevet Group, so those dials are enough to work a list of roughly 630 to 840 people properly, instead of touching several thousand once each.

That number is the one to check your database against. A shop with 400 past borrowers and 200 dead applications has enough list for two people. A shop with 4,000 has plenty of list and too little dialing capacity, and the answer there is more seats or more lines.

Now the bill for that dialing, software and telephony together, at Twilio's published rate of $0.014 a minute outbound and $1.15 a local number:

Team	Dials a month	Software	Telephony	All in
1 loan officer, DialSheet Free	2,520	$0	$14	$14
2 loan officers, DialSheet Pro	5,040	$29	$28	$57
4 loan officers, DialSheet Pro x2	10,080	$58	$57	$115
4 loan officers, PhoneBurner Standard	10,080	$560	included	$560

Set that against the other side of the ledger. Phonexa, a lead-distribution platform quoting its own market, advertises conventional and FHA mortgage leads at $20 to $100 each, VA and reverse at $50 to $150, jumbo at $100 to $200. At two seats the dialing stack costs less than three conventional leads a month.

That comparison flatters the dialer, and it should be read with the obvious caveat attached: the expensive input in a database campaign is the loan officer's calling time, and none of the figures above price it. What the arithmetic does establish is that the software and telephony half of the switch is a rounding error against what the desk was already spending on leads.

What this changes about the dialer purchase

Three things move once the main list is a database you own.

Voicemail drop matters less than it did on purchased leads. On an aged internet lead the drop plus a one-click follow-up email is what lets one person put 200 records through a day. On your own past clients you are usually calling people who will recognise the name, and a live conversation is the point.

Number rotation matters more. Calling a few hundred of your own contacts repeatedly from one number is exactly the pattern carrier analytics engines flag. Buying rotation as an add-on is where bundled platforms get expensive: ten local numbers cost $11.50 a month at Twilio's published $1.15, and materially more on platforms that resell numbers. Aircall, for instance, prices each number beyond the one included at $6 a month, so the same ten numbers are $54.

Dispositions and callbacks became the core feature. A database campaign is a long sequence of "call back in March". A dialer without a callback queue pushes that back into the spreadsheet, which is where follow-up dies.

Our ranking of dialers for mortgage loan officers prices six tools for exactly this job at one seat and at four.

Where the cheap answer is the wrong one

DialSheet is the cheapest way to dial a database you own, and at $115 a month for four loan officers against $560 for PhoneBurner Standard it is not close on price. It has no voicemail drop and no pre-built connector to Encompass, Salesforce or any mortgage CRM, only a REST API and CSV import.

So there is a clear line. If your desk still runs on purchased internet leads, the ones you can legally still buy, and one person is expected to put 200 of them through a day, PhoneBurner at $140 to $183 a seat is the better purchase and the $445 a month gap at four seats is worth paying. Voicemail drop and one-click follow-up email are what make that volume possible, and DialSheet has neither.

If the file lives inside a loan origination system and your team works records rather than lists, Kixie or Close will fit the workflow better than either, at $260 and about $470 a month for four seats respectively.

The switch the March 2026 law forced is a switch of list. Which dialer wins depends on which of those two desks you are running, and after 4 March 2026 more of them are the first kind than were before.

Sources

Public Law 119-36, the Homebuyers Privacy Protection Act, enacted text at the U.S. Government Publishing Office
National Association of Mortgage Brokers, Understanding the Trigger Leads Ban, read 8 September 2026
RISMedia, Law Effectively Banning Trigger Leads in Mortgage Applications Takes Effect, read 8 September 2026

Frequently asked questions

Are trigger leads illegal in 2026?: Mortgage trigger leads are effectively banned. The Homebuyers Privacy Protection Act, Public Law 119-36, amended section 604(c) of the Fair Credit Reporting Act so that a consumer reporting agency may not furnish a report based on a residential mortgage credit inquiry except under one narrow two-part test. The restriction falls on the credit bureau, so it is more accurate to say the bureaus may no longer sell them than to say a loan officer may no longer buy them.
When did the trigger lead ban take effect?: 4 March 2026. Section 3 of the Homebuyers Privacy Protection Act says the Act takes effect on the date that is 180 days after enactment, and the Act was approved 5 September 2025. Counting from 6 September 2025, day 180 falls on 4 March 2026. Several widely cited pages, including the National Association of Mortgage Brokers explainer and RISMedia's coverage, give 5 March 2026 instead.
What is the Homebuyers Privacy Protection Act?: It is Public Law 119-36, passed as H.R. 2808 in the 119th Congress and approved 5 September 2025. It adds a new paragraph (4) to section 604(c) of the Fair Credit Reporting Act, 15 U.S.C. 1681b(c), restricting when a consumer reporting agency may furnish a prescreened report triggered by a residential mortgage credit inquiry. It also orders a Government Accountability Office study on trigger leads received by text message.
Can any lender still buy mortgage trigger leads?: Only under a two-part test. The transaction must consist of a firm offer of credit or insurance, and the recipient must also satisfy one of four conditions: it has filed documentation certifying it holds the consumer's authorisation, or it originated that consumer's current residential mortgage loan, or it is the servicer of that loan, or it is an insured depository institution or credit union that holds a current account for the consumer. A firm offer of credit on its own is not enough.
Does the trigger lead ban stop loan officers from cold calling?: No. The Act restricts what a consumer reporting agency may furnish. It says nothing about who a loan officer may call, and it does not touch the Telephone Consumer Protection Act, the Do Not Call rules or state telemarketing statutes, all of which applied before and still apply. One specific list stopped being for sale. The rules on dialing a list are exactly where they were.
What replaces trigger leads for a mortgage desk?: The database the loan officer already owns: past clients, applications that never closed, the servicing portfolio, and realtor and builder referral partners. That list arrives as a spreadsheet, so it wants a dialer with dispositions and callbacks instead of instant lead-to-dial speed. Two loan officers at 120 dials a day place about 5,040 dials a month, enough to work a list of roughly 630 to 840 people at six to eight attempts each.
What does it cost to dial your own database instead?: On DialSheet, $29 a month for a three-seat pack plus about $28 of Twilio at 5,040 dials, so about $57 a month all in for two loan officers. Purchased mortgage leads are advertised at $20 to $100 each for conventional and FHA by the lead platform Phonexa, so the dialing side of the switch costs less than three leads a month. The real cost of the switch is the loan officer's calling time, which the arithmetic above does not price.

How to cite this page

Abhi Chawla. "Mortgage trigger leads after the 2026 ban, and what replaces the volume." MRR Nerds, 2026-09-08. https://www.mrrnerds.com/guides/mortgage-trigger-leads. Accessed 2026-09-08.

The underlying vendor data is published at /data under CC BY 4.0. Cite the dataset for numbers, this page for the analysis.

Mortgage trigger leads after the 2026 ban, and what replaces the volume