What happens to my application after I submit it online?

The two very different destinations

The two look the same on a screen. The difference is in the consent text nobody reads.

What to read before you press submit

• Who is the form for? Look for the legal entity name, not the brand. A site that never names the company receiving your data is telling you something.
• The consent to contact. Does it authorise contact by the site, or by its "partners", "affiliates" and "marketing partners"? The second is a distribution list, and it usually includes consent to autodialled calls and texts.
• The submission authorisation. Does it authorise submitting your application to named funders, or to unlimited third parties? This is the clause that turns one application into shotgunning.
• Credit pull consent. How many, and hard or soft. A hard pull from every recipient is a real cost.
• The privacy policy's sharing section. Whether personal data is sold or shared, and whether you can opt out. Several state privacy laws give you rights here, and the policy should tell you how to use them.

How to tell which kind of form you are on

Six signals, all visible before you type anything.

• Is a legal entity named anywhere? Look at the footer, the terms page and the privacy policy for a company name and a registered address. A site with a brand and no entity is not a lender.
• Does the privacy policy have a "sharing" or "sale of information" section, and is it non-empty? A lender's own policy describes servicing. An aggregator's describes distribution.
• What does the consent checkbox actually authorise? Contact "by us" is one thing. Contact "by us, our affiliates, partners and marketing partners, including by automated telephone dialling system and prerecorded message, at the number provided, even if that number is on a do-not-call list" is a distribution agreement.
• Are you asked for a Social Security number before speaking to a person? No lender needs it to tell you whether it serves your industry.
• Is there a phone number that a human answers, and does that human work for the company named on the form? Ask directly.
• Does the page promise offers from "our network of lenders"? That is an accurate description of a distribution model, and it is telling you what happens next.

The consequences of a widely distributed file

• Repeated calls, often for years, from companies you never contacted
• Multiple credit inquiries in a short window
• Your bank statements and Social Security number in the hands of parties you did not select
• A file arriving at the same funder from two sources, which creates a dispute over who owns the deal and can stall or kill it
• Pressure selling, because whoever reaches you first has an advantage and knows it

How to keep control

What to give at each stage

Match the document to the stage and most of this problem disappears on its own.

Most damage happens because stage three documents are handed over at stage one, to a party nobody has identified, on the strength of a form that looked like a lender's.

What bank-data connections actually authorise

An increasingly common step is a prompt to link your bank account so the funder can read statements directly. It is genuinely convenient and it is worth two minutes of attention.

Read what the permission covers: which accounts, which data, for how long, and whether access continues after the application is decided. Read whether the data may be shared onward with other parties, which is the difference between a verification tool and a distribution channel. And find the revocation route before you connect, so you know how to switch it off when the application is over.

Never enter online banking credentials into a form on a funder's own website. Legitimate connections run through a bank login flow, not a text box on an application page.

If it has already happened

Ask each caller how they obtained your details, who sold them, and to be added to their internal do-not-call list — in writing, and keep the reply. Internal lists are the mechanism that applies here; the national registry is a consumer protection and business-to-business calling sits largely outside it, so the request has to go to each company individually.

Change the phone number on any further applications to a dedicated line, so the old distribution and the new one stay separable. Where a state privacy law covers you, use the opt-out described in each company's privacy policy rather than asking on the phone. Report conduct worth reporting — misrepresentation about who the company is, or refusal to stop calling — to the Federal Trade Commission at reportfraud.ftc.gov.

And do not send documents to a company simply because it already knows your revenue. That knowledge came from a list, not from a relationship.