Use the lender’s verified website or app, provide only the information needed for your current step, and send documents through its authenticated portal. Before entering a Social Security number, read the privacy notice, check how the company is paid, use a unique password with multifactor authentication, and keep a record of every submission.
These practices reduce unnecessary exposure, but they cannot guarantee that a lender, comparison service, or vendor will never suffer a security incident. The guidance below is for U.S. mortgage applicants.
As an Amazon Associate I earn from qualifying purchases.
Start with the minimum information needed for a Loan Estimate
A lender can issue a Loan Estimate after receiving six key pieces of information identified by the Consumer Financial Protection Bureau (CFPB): your name, income, Social Security number, the property address, an estimate of the property’s value, and the loan amount you want. Supporting documents are not required merely to receive that initial estimate. A lender may request documents later if you decide to proceed and it needs to verify the application.
Recommended Free Tools
This distinction is one of the most useful privacy controls available to a shopper. You can ask several lenders for Loan Estimates without immediately sending tax returns, bank statements, pay stubs, or other records. A website that demands a large document package before explaining why it needs those files deserves extra scrutiny.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Application stage | Information or action | Privacy decision |
|---|---|---|
| Requesting an initial Loan Estimate | Name, income, Social Security number, property address, estimated home value, and desired loan amount | Provide the six items through a verified lender channel; ask why anything additional is required |
| Comparing offers | Loan Estimates from multiple lenders | Compare the documents themselves rather than relying only on a website’s ranking |
| Proceeding with a lender | Verification documents requested by that lender | Send only the files needed for the stated underwriting or closing step |
| Abandoning an application | Your existing account and submitted records | Ask how to close the application, correct inaccurate information, and remove or disable account access under the lender’s policy and applicable law |
When you submit the six items to more than one lender, each recipient gets sensitive financial information. Use separate, direct channels rather than forwarding one lender’s email or upload link to another.
Verify the lender’s site before entering sensitive data
Impostor sites and unexpected messages can look like legitimate mortgage communications. Treat a request for an SSN, income details, or document uploads as a point at which to verify the destination independently.
- Navigate independently. Type the lender’s known web address yourself or use a bookmark you created previously. Do not rely on a link in an unexpected text message or email.
- Check the connection and domain. Confirm that the browser shows an encrypted connection and that the domain is spelled exactly as expected. Encryption alone does not prove that the business is genuine, so check the company through a trusted statement, prior correspondence, or a verified telephone number.
- Call when anything conflicts. If a message asks you to use a new portal, change payment instructions, or send documents to an unfamiliar address, call a verified number and ask the lender to confirm the request.
- Confirm the channel before uploading. Ask whether the lender has an authenticated borrower portal and which file types and size limits it accepts. A representative should be able to explain the normal process without pressuring you to bypass it.
Never treat urgency, a preapproval promise, or a threat that your rate will disappear as proof that a request is authentic. A legitimate application can wait while you verify the destination.
Read the privacy notice for sharing and opt-out details
Information supplied to obtain a mortgage is sensitive financial information. Federal Trade Commission (FTC) guidance explains that the Gramm-Leach-Bliley Act (GLBA) can treat information provided in an application, transaction information, and information obtained while providing a financial service as nonpublic personal information.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A financial institution’s privacy notice should explain categories of information it collects and shares, the types of affiliates or nonaffiliated third parties that may receive it, and choices available to consumers. Read the notice before submitting a full application, not only after an account is opened.
Questions to answer from the notice
- What information is collected during a quote, application, underwriting, and closing?
- Which affiliates, service providers, brokers, or other outside parties may receive it?
- Does the company offer an opt-out for particular disclosures to nonaffiliated third parties, and how must you submit that choice?
- How long does the company describe retaining application records?
- Which disclosures are necessary to process the transaction or comply with law?
- Whom should you contact to correct inaccurate information or ask about an abandoned application?
Privacy rights have limits. Under Regulation P, certain disclosures needed to process a requested transaction or satisfy legal obligations can be permitted even when an opt-out exists. An opt-out is not a promise that no information will ever leave the lender, and you should not assume that every sharing practice can be blocked.
The CFPB’s electronic presentation of Regulation P is a convenience for readers, not an official legal edition. If a specific legal question affects your decision, consult the current official regulation or a qualified professional.
Be selective with mortgage comparison and lead-generation sites
Comparison services can help you find lenders, but some collect personal data before showing results and may steer shoppers toward lenders that pay referral fees. CFPB materials describe platforms that can appear objective while using compensation arrangements to influence which lenders are displayed or emphasized.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the business model before submitting data
- Look for an explanation of how the site makes money, including referral, advertising, or placement payments.
- Check whether rankings, “top” labels, or recommendations disclose sponsorship or referral relationships.
- Find out whether the site sells or transfers your contact information to multiple lenders or other marketers.
- Ask what information is needed to produce a basic comparison and whether the site can show results without a document upload.
If the explanation is vague, treat the results as a list of leads to investigate, not as an objective recommendation. You can contact lenders directly and request Loan Estimates using the six-item threshold. CFPB Director Rohit Chopra said on February 7, 2023, “Given the rise in mortgage interest rates, it is even more important for homebuyers to shop and compare loan offers.” Shopping does not require surrendering more data than the lenders need to prepare those offers.
Secure the mortgage account itself
Use a unique password
Create a password that you do not use for email, banking, shopping, or any other account. A password manager can generate and store a long, unique password. If the lender offers a password reset, make sure the recovery email account is also protected with a unique password and multifactor authentication.
Turn on multifactor authentication
Enable MFA as soon as the lender makes it available. CFPB guidance identifies phishing-resistant methods, including WebAuthn, as especially important. Depending on the lender, this may appear as a passkey, a security key, or another sign-in option. A FIDO2/WebAuthn hardware security key is useful only if that particular lender’s portal supports it; confirm compatibility before buying one.
A security key protects the sign-in step. It does not protect documents after the lender receives them, secure the lender’s internal systems, or prevent a separate breach. If phishing-resistant MFA is unavailable, use the strongest alternative the portal offers and avoid approving unexpected login prompts.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect recovery and notification channels
- Use an email account with its own MFA for application notices.
- Review phone numbers and email addresses listed for account recovery.
- Do not share one-time codes with a caller or message sender. A person who has a code may be trying to take over the account.
- Review login alerts and contact the lender through a verified channel when a sign-in was not yours.
Upload documents through an authenticated portal
Tax returns, pay stubs, bank statements, identification, and other underwriting records can reveal more than the six items needed for an initial Loan Estimate. Use the lender’s authenticated upload portal when one is offered. Ordinary email is not automatically a secure document channel; if the process is unclear, ask the lender for its approved upload method.
Prepare files before uploading
- Confirm the exact document and date range requested. Do not send extra pages merely because they are easy to attach.
- Review each file for unrelated account numbers, medical information, or other details that are not needed for the stated mortgage step. Ask the lender before redacting anything that might be required for verification.
- Use a trusted device with current operating-system and browser security updates. Avoid public computers and unsecured public Wi-Fi for uploads.
- Check the recipient and application number inside the authenticated portal before selecting files.
- After the upload completes, save the portal’s confirmation or note the date and file names in your records.
Do not leave an authenticated application open on a shared device. Sign out, close the browser window, and remove downloaded copies from a shared computer. Keep your own records in a protected location rather than repeatedly downloading documents from the portal.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare the actual Loan Estimates, not just advertised rankings
Once you have offers, use the Loan Estimate forms to make the comparison. A site’s monthly-payment display may omit costs or rely on assumptions that differ from one lender to another. Review the same fields on each document and ask a lender to explain a material difference.
| Loan Estimate item | What to examine |
|---|---|
| Interest rate | Whether the quoted rate is fixed or adjustable and under what conditions it can change |
| Annual percentage rate (APR) | The APR shown on each estimate, which incorporates the rate and certain finance charges |
| Estimated monthly payment | Principal and interest plus the other components shown on the form, such as estimated taxes, insurance, or mortgage insurance where applicable |
| Closing costs | Origination, services, recording, and other charges itemized on the estimate |
| Cash to close | The estimated amount you would need at closing, including required adjustments and credits shown on the form |
| Rate-lock terms | Whether the rate is locked, the lock period, and what happens if the period expires |
| Loan type | The program, term, and any adjustable-rate features |
| Points or lender credits | Whether you pay upfront points for a lower rate or receive credits that may correspond to a higher rate or different fees |
These comparisons help you evaluate offers; they do not establish that one lender is best for every borrower. Ask each lender to identify assumptions, timing requirements, and conditions that could change the figures before you decide to proceed.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep a privacy record while the application moves forward
Maintain a simple log for every lender or platform. Record the company name, the date and channel used, the information supplied, documents uploaded, the person or team contacted, and any stated sharing or retention explanation. This makes it easier to spot an unexpected request and to ask for a correction.
If you stop an application
Tell the lender that you are no longer proceeding and ask how to close the application. Ask whether your portal access can be disabled, how to correct inaccurate information, and what the company’s policy says about retaining submitted records. Do not assume that every record can be deleted: retention duties, transaction processing, or other legal requirements may apply.
If information is wrong
Use the lender’s documented contact method and identify the specific field or document that is inaccurate. Keep a copy of your request and any response. Avoid sending a second complete document package when a corrected page or explanation is sufficient.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUnderstand what lenders must do—and what that does not guarantee
FTC Safeguards Rule guidance identifies mortgage lenders and mortgage brokers among covered financial institutions. Covered institutions must maintain a written information-security program with administrative, technical, and physical safeguards appropriate to their business and data. A 2023 amendment also requires covered entities to report certain data breaches and security incidents.
These are institutional duties, not proof that a particular portal is risk-free or that an incident cannot occur. Ask practical questions about the secure upload process, MFA, and who receives your documents, but recognize that you cannot personally control the lender’s entire technology environment.
What to do if a message or portal seems compromised
- Stop uploading or replying until you verify the request through a known lender channel.
- Change the mortgage-account password from a trusted device if you suspect that it was exposed, and change it anywhere else you reused it.
- Review account activity, recovery details, and MFA settings for unauthorized changes.
- Tell the lender exactly what you sent, when you sent it, and which message or portal appeared suspicious.
- Preserve emails, texts, screenshots, upload confirmations, and call details. They can help the lender investigate.
- Follow the lender’s instructions for account protection and any legally required incident notice. Do not assume that deleting a local copy resolves a breach on the recipient’s systems.
A practical privacy checklist
- Verify the lender’s website or app independently before entering an SSN or uploading a file.
- Request initial Loan Estimates with the six CFPB-listed items before sending supporting documents.
- Read the privacy notice for collection, affiliates, outside parties, opt-outs, and transaction or legal exceptions.
- Ask comparison sites how they are compensated and whether referral payments affect rankings.
- Use a unique mortgage-account password and enable MFA.
- Use passkeys or a WebAuthn/FIDO2 security key only when the lender confirms support.
- Upload documents through the authenticated portal, not ordinary email, unless the lender explicitly directs another secure method.
- Use a trusted, updated device; avoid shared computers; sign out when finished.
- Log each submission and ask how to correct or close an abandoned application.
- Compare the Loan Estimates themselves, including rate, APR, payment, closing costs, cash to close, lock terms, loan type, points, and credits.
No privacy measure eliminates all risk. The goal is to limit the information exposed at each stage, understand who may receive it, and maintain control of the accounts and channels you can protect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
