Apply for a mortgage on a Tuesday and by Thursday your phone is ringing with lenders you have never heard of. That is not a coincidence and it is not a leak. Prescreened credit offers run on a specific, deliberate exception written into federal law, and the exception has been there since 1970. What most people get wrong is assuming a credit freeze closes it. A freeze does not touch it. They are two different switches, and in March 2026 Congress reached in and flipped one of them for the first time in decades.
Nobody sold your name. A lender rented a filter.
The mental picture most people carry is a list of names being sold. That is not what happens, and the real mechanism is stranger.
A bank goes to Experian, Equifax, or TransUnion and describes a customer: score above 700, no bankruptcy in seven years, at least $5,000 in revolving balances, living in these ZIP codes. The bureau runs that filter across its own files and hands back a list of names and addresses that match. The bank never sees your report. It sees that you cleared the bar it set.
This is why the offers feel eerily well-targeted without ever mentioning anything specific. The lender knows exactly one thing about you: you passed. Everything else in the envelope is a guess dressed up as personalization. And the inquiry that produced the list is a soft one, invisible to other lenders and harmless to your score, which is a different animal from the hard inquiry that appears when you apply.
A firm offer of credit is an obligation, not a slogan
So what does the bureau get in return for opening that keyhole, and what do you get? The phrase “firm offer of credit” buried in that mail is the answer to both. Section 604(c) of the Fair Credit Reporting Act permits a bureau to release your information for a transaction you did not initiate only when the result is a genuine firm offer. In exchange for reaching into your file uninvited, the lender takes on a duty: if you respond and still meet the criteria they used to build the list, they have to honor the offer.
There are outs, and lenders use them. The criteria can include collateral requirements and a verification step, so an offer can evaporate legally if your situation changed between the pull and your reply. But the structure is a real trade. Congress decided that giving lenders a keyhole into your file was acceptable as long as something concrete came back through it. Every prescreened envelope also has to carry a plain notice telling you your report was used and that you can opt out, which is the small-print paragraph almost everyone throws away.
How prescreened credit offers survive a credit freeze
Here is where careful people go wrong. A security freeze under FCRA Section 605A locks your file so that new creditors cannot pull it, which is exactly what stops most identity theft in its tracks. It also carries an explicit exception for prescreening under Section 604(c).
So a frozen file still produces prescreened credit offers. The freeze protects you from someone opening an account in your name. It was never designed to stop the mail, and a lot of otherwise well-informed people believe they have handled both problems with one action. They have handled one. We covered what a credit freeze does and does not cover in more detail, and this is the most commonly missed item on the list.
The second switch is separate and takes about two minutes. The nationwide bureaus jointly run an opt-out service reachable at optoutprescreen.com or 1-888-5-OPT-OUT, and the Federal Trade Commission points consumers there. Opting out online lasts five years. Making it permanent requires printing and mailing a form, which is a friction point that clearly did not happen by accident.
In March, Congress switched one of these off
For most of the FCRA’s history, the prescreening carve-out was treated as settled. Then came trigger leads.
A trigger lead is prescreening aimed at a moment rather than a profile. When you apply for a mortgage and the lender pulls your credit, that pull itself becomes a filterable event, and bureaus sold lists of “people who just applied for a mortgage” to competing lenders and brokers within hours. It was Section 604(c) working exactly as written, aimed at the most stressful financial week of a person’s life.
The Homebuyers Privacy Protection Act, signed in September 2025, amended the FCRA to shut that down. Effective March 5, 2026, a bureau may furnish a mortgage trigger lead only to a narrow set of parties: the lender the consumer actually applied with, the servicer of their current mortgage, a bank or credit union where they already hold an account, or someone the consumer specifically opted in to hear from. The general market for those leads is closed.
Notice what the law did not do. It carved out mortgages and left everything else in place. Credit card, auto, and insurance prescreening all continue under the same rules as before. Which tells you the important thing about this whole system: the carve-out is a policy choice, revisable, and Congress has now demonstrated it will revise it.
The reason trigger leads existed is why the ban is a real tradeoff
It is tempting to file the trigger-lead ban as an obvious win, and mostly it is. But the industry defense was not entirely empty, and the numbers behind it are worth seeing.
Freddie Mac’s research found that borrowers who collected quotes from a second lender got an average rate reduction of 20 basis points in 2022, double the 10 basis points those borrowers averaged from 2010 through 2021, and that in higher-rate environments comparison shopping was worth roughly $600 to $1,200 a year.
Put that on a real loan. Take a $350,000 thirty-year fixed mortgage at 6.50%, which runs about $2,212 a month in principal and interest. Shave the rate to 6.30% and the payment falls to roughly $2,166. That is about $46 a month, near $548 a year, and something close to $16,400 across the full term for the work of taking one more phone call. Trigger leads were a crude, invasive way of generating that phone call, and now the call has to come from you. The savings did not disappear along with the leads. The responsibility for capturing them just moved onto the borrower.
What the mail is actually telling you
A pile of prescreened credit offers works as a crude signal about your own file. It means you currently clear the filters lenders are running, and issuers have been widening those filters as delinquencies stabilize. A sudden stop can mean something in your report changed, which is a reason to pull it rather than to feel relieved.
The opt-out decision itself is genuinely close. Prescreened mail is where balance-transfer and sign-up-bonus offers usually surface first, and some of those are priced better than anything on a comparison page, because the issuer is paying for the privilege of having found you. The cost is a steady flow of preapproved paper sitting in an unsecured mailbox, which is the oldest identity-theft supply chain there is.
What is not close is the distinction underneath it. A freeze governs who can open credit in your name. Prescreened credit offers are governed by a separate opt-out that decides who can look at your file well enough to ask. Most people have set one of those switches and believe they set both, and the two minutes it takes to check is the only action item here.