The headlines said mortgage spam calls were banned this year. You applied for a refinance anyway — and your phone rang nine times before dinner.

The 2026 law stopped credit bureaus from selling your mortgage application to strangers in most cases — but it didn’t stop companies you already do business with, companies you gave permission to, marketers using public property records, or scammers who ignore the rules to begin with.

Not sure which pipeline your specific call, text, or letter is coming from? Jump straight to the checker.

Here’s what most people miss: the law closed one pipeline. Your number still travels through at least four others.

What the 2026 Law Actually Banned

The law is the Homebuyers Privacy Protection Act (H.R. 2808, now Public Law 119-36). It’s a genuinely bipartisan bill — sponsored by Reps. John Rose (R-TN) and Ritchie Torres (D-NY) in the House, and Sens. Jack Reed (D-RI) and Bill Hagerty (R-TN) in the Senate — and President Trump signed it on September 5, 2025. It amends the Fair Credit Reporting Act (FCRA), which is the same federal law that already governed how your credit report could be used and shared.

Before this law, applying for a mortgage triggered something the industry calls a trigger lead: the moment a lender pulled your credit for a mortgage application, the credit bureau that processed that pull could sell a list containing your name, address, phone number, and basic credit profile to other lenders and brokers — companies you’d never contacted. Those companies would then call, text, and mail you, sometimes within minutes of your original application, often positioning themselves as if they already knew your business. That’s the “deluge of calls right after a credit pull” experience most people associate with mortgage shopping.

The Homebuyers Privacy Protection Act narrows that specific practice. Under the amended FCRA, a credit reporting agency can now only furnish a mortgage-related consumer report to a third party if the offer is a firm offer of credit or insurance, and the requesting party meets one of two conditions:

• Documented consent — the company has your authorization on file and can show it to the credit bureau, or
• An existing relationship — the company originated your current mortgage, currently services it, or is a bank or credit union where you already hold an account.

That’s a real, meaningful restriction on one specific data pipeline. It is not, however, a ban on mortgage marketing as a category — and it never touches several other ways your information can end up in front of lenders, insurers, and marketers, which is the part this guide focuses on.

March 4 or March 5? The Effective Date, Precisely

The statute itself says the Act “shall take effect on the date that is 180 days after the date of enactment.” The Act was signed on September 5, 2025. Counted out on a calendar, 180 days after September 5, 2025 lands on March 4, 2026. A lot of trade coverage — including some law-firm client alerts — reports the effective date as March 5, 2026 instead, apparently counting inclusively from the signing date rather than strictly adding 180 days to it. If you’re trying to pin down exactly when your own application would have been covered, treat March 4, 2026 as the more literal reading of the statute’s own language, and March 5, 2026 as the figure you’ll most often see repeated.

Five Reasons Your Phone Is Still Ringing

1. You have — or recently had — an existing relationship

This is the law’s own exception, working exactly as written. Your current mortgage originator, your current servicer, and any bank or credit union where you hold an account are all allowed to make you a firm offer using your mortgage-related data. If the calls are coming from the company that’s actually holding your loan right now, or from your everyday bank, that’s not a loophole — it’s the deal Congress wrote into the statute.

2. You already said yes — consent buried in a comparison form

Rate-comparison sites and mortgage lead-generation pages routinely include consent language in their terms — sometimes above the submit button, sometimes several scrolls down in a privacy policy. Submitting one form can authorize several partner lenders to contact you, and each of those lenders is operating entirely within the law’s consent exception. This is one of the most common reasons people who never had a trigger-lead problem still get flooded with calls: they consented to it, just not knowingly.

3. Prescreened offers run through a completely separate channel

“Prescreened” credit and insurance offers are a different FCRA mechanism than trigger leads, built for general marketing rather than mortgage-application response. Credit bureaus compile lists of consumers who meet a lender’s criteria — good credit, a certain income bracket, homeownership — and sell access to firms making firm offers. This channel existed before the Homebuyers Privacy Protection Act and isn’t mentioned anywhere in it. If you’re getting mailers or calls that reference your good credit or homeowner status but don’t seem tied to a specific mortgage application, this is probably the source.

4. The Do Not Call Registry has limits most people don’t know about

Registering at DoNotCall.gov is worth doing, but it doesn’t create a total shield. The registry’s “established business relationship” exception lets a company call you for up to 18 months after your last purchase, payment, or transaction with them, and for up to 3 months after you make an inquiry or submit an application — even if your number is registered. A mortgage application is exactly the kind of inquiry that opens that 3-month window with the company you applied to.

5. Not every caller is following any rules at all

Scam operations impersonating mortgage lenders and servicers ignore the trigger-lead law, the Do Not Call Registry, and every other rule in this guide simultaneously, because ignoring the rules is the entire business model. A caller who already knows you recently applied for a mortgage isn’t necessarily proof of a trigger-lead violation — it can just as easily mean a scammer is fishing with a guess that’s statistically likely to land, or working from a data breach unrelated to any of the channels above.

The Mail That Starts After Closing

Marketing companies — and, less charitably, list brokers — routinely scrape county recording offices for newly recorded mortgages, then sell that list to whoever wants to reach new homeowners. That’s how a stack of unfamiliar mail can start showing up within a week or two of closing, addressed by name, sometimes referencing your loan amount or lender.

The most common category is mortgage protection insurance — life insurance products marketed specifically to new homeowners, sold by independent agents and marketing firms rather than your actual lender. To be clear, being marketed to isn’t the same as being scammed: many of these mailers are ordinary, legitimate solicitations from real insurance agencies, even when the product itself may or may not be a good fit for your situation. The problem is presentation, not legality — some mailers are deliberately designed to resemble an official notice from your lender or loan servicer, using similar colors, urgent language, or a reference number formatted to look like a loan number.

Before responding to anything that arrives after closing:

• Compare any account or loan number referenced against your actual mortgage statement.
• Look for your lender’s real name and logo — a generic name like “Homeowner Services Division” with no lender name attached is a signal to slow down.
• Call your servicer directly, using the number on your statement, if anything claims to require immediate action on your loan.
• Remember that legitimate offers from unrelated companies don’t disappear if you ignore them for a week to verify.

How to Shut Down Each Source

Opt out of prescreened offers

Go to OptOutPrescreen.com, the official site run jointly by Equifax, Experian, TransUnion, and Innovis. You can opt out electronically for five years in about a minute, or start a permanent opt-out online and confirm it by mailing in a signed form — permanent opt-out can’t be completed online alone. Expect prescreened mail that was already in the pipeline to keep arriving for a few weeks after you opt out.

Withdraw consent from comparison and lead-gen sites

If a rate-comparison form is the source, contact both the original site and every lender that reached out because of it. A short, direct message works:

Report persistent or deceptive contact

For suspected trigger-lead violations or credit-reporting misuse, file a complaint with the CFPB. For Do Not Call violations, robocalls, and general fraud, use the FTC’s complaint site. For deceptive mailers designed to look official, your state attorney general’s consumer protection office is also worth a call.

Side Effects: Higher Credit Report Costs and the GAO Study

One reported side effect worth noting — and worth taking as a single data point rather than an industry-wide statistic — is a cost increase on the lender side. One loan officer reported that the three-bureau mortgage credit report their company purchases rose from about $78 in 2025 to about $108 in 2026. That’s one lender’s account, not a verified national figure, and it isn’t something that shows up on a borrower’s bill directly, though costs like this can eventually work their way into fees elsewhere.

The Act also directs the Government Accountability Office (GAO) to study the value of trigger leads specifically received by text message, with input from state regulators, lenders, depository institutions, and consumer reporting agencies. The statute requires that report within 12 months of enactment — on or before September 5, 2026. As of this article’s last update, we could not find a published version of that report in GAO’s public listings; if it’s been released since, GAO’s housing topics page is the place to check.

What This Isn’t

This guide is about a specific, narrow slice of mortgage privacy law. A few related topics deserve their own space:

• The calls in this guide typically trace back to the moment a lender first pulls your credit — if you haven’t gotten that far yet, see How to Get Preapproved for a Mortgage for what that process actually involves.
• Everything above applies equally if you’re refinancing rather than buying — the law covers residential mortgage transactions broadly. See Refinancing Your Mortgage: When It Actually Makes Sense for the bigger picture on whether refinancing is worth it right now.
• Checking your own credit score is a soft inquiry and doesn’t create a trigger lead or any of the exposure described here — see How to Check Your Credit Score Free if you want to monitor your credit without opening any of these pipelines.

FAQ

Why am I still getting mortgage calls if trigger leads are banned?

Trigger leads sold on the open market to companies with no relationship to you and no consent from you are what the law restricts. Calls from your current lender, your bank, companies you gave consent to, or through prescreened-offer and public-records channels aren’t affected by this law at all.

Does the 2026 law stop all mortgage-related marketing?

No. It restricts one specific data pipeline — the sale of mortgage-inquiry trigger leads to unrelated third parties. It doesn’t touch prescreened offers, public property records, or marketing to people who’ve given consent.

How do companies know I bought or refinanced a house?

Most commonly through your county’s public property records, which record every deed and mortgage as a matter of law. This has nothing to do with your credit report and isn’t covered by the trigger-lead ban.

Does the Do Not Call Registry stop mortgage calls?

It stops most cold telemarketing, but companies with an “established business relationship” — including a lender you recently applied to — can still call for up to 3 months after your inquiry or 18 months after a transaction, even if you’re registered.

How long does OptOutPrescreen.com take to work?

The bureaus typically begin processing within about five business days, but offers already printed and mailed before your request won’t be recalled, so expect prescreened mail to taper off over several weeks rather than stop immediately.

Can my current lender or servicer still contact me?

Yes. That’s one of the law’s built-in exceptions. If you don’t want the contact anyway, you can ask that specific company, in writing, to stop.

Are “mortgage protection insurance” letters from my bank?

Usually not. Most come from independent insurance agencies marketing to new homeowners using public property records, not from your actual lender or servicer. Verify against your real mortgage statement before responding to anything that looks official.

What exactly is a trigger lead?

A trigger lead is generated when a lender pulls your credit report for a mortgage application; historically, the credit bureau could then sell that “triggering” event — your name, contact details, and basic credit profile — to other lenders as a marketing list.

Does checking my own credit score trigger these calls?

No. Checking your own score is a soft inquiry, which doesn’t generate a trigger lead under either the old or new rules. Trigger leads come from hard inquiries tied to an actual application.

Does the law apply to refinances, not just home purchases?

Yes. The Act covers “residential mortgage transactions” broadly, which includes refinances and home equity transactions, not only initial purchases.

What should I do if a caller says they’re my lender?

Don’t confirm any personal or loan details on that call. Hang up and call your lender back using the number printed on your mortgage statement or closing documents — never a number the caller provides.

Can I take legal action if a company violates the law?

The FCRA generally allows for statutory and, in cases of willful violations, punitive damages and attorney’s fees, but whether a specific situation qualifies is a legal question. This isn’t legal advice — a consumer protection attorney or your state attorney general’s office can evaluate a specific case.

This article is for general education and isn’t legal advice. Exceptions, effective dates, and opt-out procedures can change — verify current details directly at Congress.gov, FTC.gov, and ConsumerFinance.gov before relying on anything here for a specific situation.

Last updated: September 25, 2026