Mortgage Trigger Leads and H.R. 2808
The Homebuyers Privacy Protection Act (H.R. 2808) was passed in the House via voice vote on June 23, 2025. The purpose of the bill is to amend the Fair Credit Reporting Act (FCRA) in order to curtail the abuse of mortgage trigger leads by limiting who can access this information.
Before we get into it, let's quickly note what a "trigger lead" is. Essentially, when a member applies for a mortgage, credit bureaus are notified and may sell that information (known as a "trigger lead") to other lenders. This often results in the member receiving a flood of inquiries from competing lenders.
It's important to note that the FCRA requires a lender or credit union to have a permissible purpose before obtaining or using a member's consumer report information. The FCRA permissible purpose rule states, in part, the following:
"(a) In general: Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:
[…]
(2) In accordance with the written instructions of the consumer to whom it relates.
(3) To a person which it has reason to believe-
(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer;
[…]
(F) otherwise has a legitimate business need for the information-
(i) in connection with a business transaction that is initiated by the consumer; or
(ii) to review an account to determine whether the consumer continues to meet the terms of the account." (Emphasis added).
The rule does include other permissible purposes (which you can find here), however, these are the most commonly relied upon by credit unions when offering products and services to members.
So, how does all of this relate to H.R. 2808? Well, H.R. 2808 aims to modify FCRA to restrict the use of consumer reports in residential mortgage transactions, particularly targeting the practice of trigger leads (as mentioned earlier). H.R. 2808 essentially narrows the scope of permissible purposes by requiring more stringent conditions before a consumer report can be shared.
Specifically, as of the date of this blog's publication, H.R. 2808 includes the following provision:
""(B) LIMITATION.-If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless-
"(i) the transaction consists of a firm offer of credit or insurance; and
"(ii) that other person-
"(I) has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or
"(II) (aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates;
"(bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or
"(cc)(AA) is an insured depository institution or credit union; and
"(BB) holds a current account for the consumer to whom the consumer report relates." (Emphasis added).
In simple terms, credit reporting agencies would be prohibited from sharing consumer credit reports with third parties in connection with a credit transaction that involves a residential mortgage loan -unless the report is for a firm offer of credit or insurance and the third party either has the consumer's explicit consent, is already involved in the mortgage as the originator or servicer, or is a credit union or insured depository institution that currently holds an account for the consumer.
Please note, under FCRA, a "firm offer of credit or insurance" is defined as "any offer of credit or insurance to a consumer that will be honored if the consumer is determined, based on information in a consumer report on the consumer, to meet the specific criteria used to select the consumer for the offer…" The full definition can be found here. The FTC's 40 Years of Experience with the FCRA is also a helpful guide that discusses firm offers of credit. It notes that "[i]n general, once a consumer accepts such an offer, the entity making the offer cannot condition it on further consumer report information, except that it can verify that the consumer continues to meet the criteria established before the firm offer is extended."
So, why would the proposed guardrails in H.R. 2808 be beneficial to members? Ultimately, they would help prevent third parties, such as unrelated lenders and brokers, from buying credit inquiries and bombarding members with unsolicited offers - a practice often seen as invasive by consumers. They would also help empower consumers to control who can access and use their credit inquiry data and would help prevent potential misuse of consumers' financial information by unknown third parties.
America's Credit Unions' President/CEO, Jim Nussle, offered this statement of support for the bill that further reiterates its benefits:
"Consumers looking to purchase a home deserve to have their privacy respected and their data secured. We thank the House of Representatives for protecting the privacy of homebuyers by passing the Homebuyers Privacy Protection Act (H.R. 2808). Stopping the abusive use of trigger leads will allow consumers to seek lending from their trusted credit unions without the fear of their data being sold off or receiving unsolicited calls seeking to lure them away from their trusted lender. We urge Congress to quickly reconcile the House and Senate versions and get the bill to the President to sign into law and further protect consumers seeking their American Dream."
The Senate passed its version of the bill by unanimous consent on June 12, 2025 (which can be found here). With both chambers having approved similar versions (note: the House version includes a provision that calls for a Government Accountability Office (GAO) study on the "value of trigger leads received by text message"), the next step is for the House and Senate to reconcile any remaining differences before the bill can move forward to the President's desk.
We will be sure to keep our members informed of any updates!
