Bureaucracy Times

When you apply for a mortgage, your lender pulls your credit report, and the credit bureau that supplied it may then sell your name, phone number and credit score to anyone willing to make you a firm offer of credit. The result, familiar to every recent homebuyer, is a telephone that will not stop. On October 6 the Government Accountability Office published its verdict on whether this arrangement ever did anyone any good, and on whether the 2025 law meant to restrain it will help. Its answers were barely and possibly, which is honest, and which is cold comfort to anyone whose phone is still buzzing.

The Three Percent Solution

The industry’s defense of the trigger lead was always that it promotes comparison shopping, and comparison shopping is genuinely worth having. The CFPB has found that borrowers can save $100 or more a month by choosing a cheaper lender, and Freddie Mac estimated that two rate quotes could have saved borrowers $600 a year in two high-rate months of 2022, with four quotes saving more than $1,200. GAO, drawing on the National Survey of Mortgage Originations, estimates that 45.0 percent of homebuyers from 2022 to 2024 seriously considered only one lender. The gap was real.

The remedy was not. For a trigger lead to help, a borrower must apply to more than one lender and then take the loan from the stranger who called first. GAO estimates that at most 3.5 percent of homebuyers did so (the point estimate is 3.0 percent). A large lender told GAO that such offers tend to arrive after the price and closing date are settled, when switching risks delaying the move, and some lenders and consumer advocates doubted that trigger leads beat the research a borrower can do before applying at all. An industry that interrupts everyone in order to reach, at the very best, a small fraction of them is not running a comparison shopping service. It is running a lottery whose tickets are other people’s attention.

Thirty Texts Before the Ink Dries

The cost of that lottery was borne by the ticket holders. According to the CFPB, a borrower could receive 30 or more messages after applying, and a mortgage lender told GAO the count sometimes reached 100. GAO had a large language model comb the CFPB complaint database from January 2020 through March 5, 2026 and identified more than 100 complaints likely traceable to trigger leads. In one, a borrower who replied STOP received another text within about 15 minutes, followed by 54 calls.

Volume was the lesser sin. CFPB officials said some loan officers may quote a rate in the first message and decline to honor it once the borrower applies, and every lender GAO interviewed said marketers at times misrepresented who they were; some impersonated the lender the borrower had actually chosen. Two lenders said the confusion damaged their reputations, since borrowers assumed their own lender had sold them out. One complainant, identifying as a veteran and VA loan holder, described a high-pressure text from a sender who gave no name or verifiable contact details as a predatory attempt to extract sensitive information under cover of a federal benefit.

The escape routes were a joke at the borrower’s expense. As GAO recounts, the industry-sponsored OptOutPrescreen.com asks for a Social Security number and can take weeks to work, by which time the calls have come and gone, and the Do Not Call Registry tells telemarketers whom to avoid without stopping the bureaus from selling the data. States tried to ban the practice outright. Minnesota and New Jersey did, and federal courts blocked both laws as preempted by the Fair Credit Reporting Act, which is why the job fell to Congress.

The Exceptions Have Customers

Congress obliged with the Homebuyers Privacy Protection Act, signed September 5, 2025 and effective 180 days later. The text bars a bureau from furnishing a report generated by a residential mortgage credit request unless the transaction is a firm offer of credit and the recipient either filed documentation certifying the consumer’s authorization, originated or services the consumer’s current mortgage, or is an insured bank or credit union holding the consumer’s current account. Strangers are out. Acquaintances are in.

GAO reports what the acquaintances did next. Some lenders now send lists of their customers to the credit bureaus and pay them to watch for the moment a customer applies for a new loan. Equifax markets exactly this. Its TargetPoint Alerts page says lenders can hand over lists of their deposit customers so that Equifax can alert them when those customers seek loans at competitors, pitched openly at cross-selling and retention. The alerts cover mortgage inquiries, include soft prequalification pulls as well as hard ones, and are declared subject to the Act. The price is not published; prospects are directed to a sales team. Experian, for its part, has put it to lenders that they should ask whether they are monitoring their portfolios closely enough to catch retention risk.

Two inferences follow, and they are only inferences. First, this looks less like a loophole than like the statute working as written. The Equifax page and GAO’s account show the bureaus selling alerts the Act permits, and a Mortgage News Daily article that appears to be about two decades old describes the bureaus offering the same watch-and-alert service to mortgage servicers for retention, so this publication’s reading is that Congress narrowed the market to a lane that already existed. Second, there is the matter of soft pulls. The Act reaches a report requested in connection with a credit transaction involving a residential mortgage loan, while Equifax’s product also fires on soft prequalification inquiries. Whether those fall inside the statute cannot be settled from the text alone, GAO does not address it, and a lawyer might.

Nobody Has Checked

Whether any of this is working is, by GAO’s own admission, unknown. The restrictions took effect in March 2026, and GAO says not enough time has passed to measure their effects, so the report’s hopeful headline is a forecast. The forecast leans on thin support. GAO’s own key defines some stakeholders as one to three and many as four or five, and its claims that the law could greatly cut solicitations and that homebuyers may now respond better to known lenders are attributed to some industry stakeholders. Its lender sample was five firms, described as nongeneralizable. The survey response rate fell to 17.3 percent in recent waves, and GAO says it cannot definitively assess its nonresponse adjustment without a bias analysis it did not perform. The CFPB offered no comments on the draft.

Nor has anyone been seen enforcing the law. This publication found no public CFPB or FTC enforcement action under the new provision (a search that comes up empty is not proof, and readers with contrary examples are invited to send them). The FTC updated its published copy of the Fair Credit Reporting Act to include the Act, and in April the Community Home Lenders of America wrote to both agencies asking for guidance on compliant opt-in language; no reply turned up. The CFPB, for context, dismissed six credit reporting enforcement matters after the change in administration, according to one regulatory tracker. One consumer law firm notes that the statute’s private right of action means lawsuits may end up doing the work.

A smaller oddity. The Act gave GAO twelve months from enactment to report, a period that expired in early September, and the report is dated October 6. There may be an agreed extension; the document does not mention one.

Congress asked whether the trigger lead was worth the trouble and was told, in effect, that it barely paid for itself. Whether the cure is working it was told to wait and see. In the meantime the valve remains open for those with a relationship, the bureaus remain paid to watch, and a homebuyer’s phone may well be quieter. Whether it is quiet because the law works, or merely because the list of people entitled to ring has grown shorter and more familiar, is the one question nobody has yet been paid to answer.