Quick answer
Usually because the site you used shares or sells enquiries. Its terms probably let it pass your details to 'partners', who then call you. You can ask each caller where they got your details and tell them to stop; under Australian Privacy Principle 7 they must act, generally within 30 days, at no cost. Business phone numbers can't go on the Do Not Call Register, so asking is the tool that works.
Key points
- Several callers after one form usually means the form's operator shared or sold your enquiry; it's rarely a coincidence.
- The permission sits in a 'partners' or 'third parties' clause in the privacy policy or the tick-box beside the submit button.
- Under APP 7 you can ask where an organisation got your details and tell it to stop direct marketing, free of charge.
- Business phone numbers aren't eligible for the Do Not Call Register, so a request to each caller is the practical fix.
- Marketing texts and emails must carry a working unsubscribe, actioned within 5 working days.
You filled in one form. Within the hour a broker rang, then a lender you’ve never heard of, then a number you didn’t recognise left a voicemail about “your business funding”. It feels like someone sold you out, and in a lot of cases someone did.
This guide explains how a single enquiry turns into several calls, what gives the sender permission, and the exact steps that stop it. It also covers the one trap that catches business owners in particular: the Do Not Call Register won’t help you.
Why did one enquiry turn into several calls?
Because the form wasn’t a lender’s form. It was an enquiry collector.
Online business loan forms generally fall into three types:
| Who runs the form | What happens to your details | What you’ll notice |
|---|---|---|
| A lender or broker working your file itself | Stays with that business or its named team | One caller, who knows what you asked for |
| A comparison or “matching” site | Passed to several lenders or brokers, usually named in the terms | A cluster of calls over a few days |
| A lead generator | Sold or auctioned to whoever pays, sometimes more than once | Calls from unfamiliar names, some irrelevant |
The money in the second and third types comes from the handover. Your details are the product, so the form is built to collect them quickly and the permission to pass them on is written into small print. The “AI-powered” label on a site can sit on top of any of these; our guide on AI business loan sites covers how to tell what the technology is doing.
What wording on the form lets them share my details?
Two places, and you’ve probably agreed to both without reading either.
- The line beside the submit button. Look for phrases such as “I agree that my details may be shared with our partners”, “trusted third parties”, “panel of lenders” or “selected providers”. A pre-ticked box is the same thing.
- The privacy policy. A section on disclosure listing “affiliates”, “marketing partners” or “brokers” as recipients.
This matters legally. Under Australian Privacy Principle 7, an organisation can use or disclose your personal information for direct marketing if you’d reasonably expect it, or if you’ve consented. The OAIC says consent has to be informed, voluntary, current and specific. Consent buried in a long document, or bundled with the act of enquiring, is weaker than a clear, separate tick-box, but a clause you actively agreed to is hard to argue against. Reading it first is the cheap option.
How do I find out who sold my details?
Ask the caller. Don’t argue, don’t confirm details, just ask.
The OAIC’s APP 7 guidance says an organisation must, on request, tell you where it got your personal information, unless that’s impracticable or unreasonable, and that this should generally happen within 30 days. Use a short script:
- “Where did you get my name and number?”
- “Which website or business supplied my enquiry, and when?”
- “Please record that I don’t consent to further marketing from you or your partners.”
Then confirm by email and keep it. Each answer gives you a link in the chain. Once you can name the original site, you know whose clause to read and whom to send a stop request to.
If the caller won’t say, that’s information too. A legitimate business can name its source.
Can I put a business number on the Do Not Call Register?
No, and this is where owners lose weeks.
The register’s own page says numbers used mainly for personal or household purposes can be registered, and that “business telephone numbers are not eligible for registration.” Business fax numbers used mainly for faxes are the one exception. So if the loan enquiry used your work mobile or the shopfront line, registering it won’t stop anything. If you used your personal mobile as the contact number, the register is available, but it only blocks callers that need consent from you. A caller you gave consent to through the form’s tick-box can argue it already has it.
That leaves the tool that does work for business numbers: telling each organisation directly to stop.
How do I make the calls stop?
Work in this order.
- Tell each caller to remove you. Say it on the call, then repeat it in writing. Under APP 7 the organisation must give effect to a request to stop using or disclosing your details for direct marketing, and it can’t charge you for that. The OAIC says the reasonable timeframe would generally be no more than 30 days.
- Send a stop request to the original site. Find the privacy contact in its policy. Ask it to stop sharing your details with anyone and to tell you who has them. Ask it to stop facilitating direct marketing by others, which APP 7 also lets you do.
- Unsubscribe from texts and emails. Marketing messages must have a working unsubscribe option, and the ACMA fact sheet says it must be actioned within 5 working days. A message sent after that window without your consent is a breach by the sender.
- Let unknown numbers go to voicemail for a while. Real lenders and brokers leave a name and a reason; scammers and list-buyers usually don’t.
- Complain if they ignore you. The Do Not Call Register runs a complaints process for registered personal numbers. For ignored privacy requests, the OAIC normally expects you to have complained to the organisation first and given it time to respond.
If a business tells you it’s exempt from privacy law because it’s small, check. The OAIC’s small business guidance says businesses that disclose personal information for a benefit, service or advantage are covered regardless of turnover. That describes a lead seller.
(Illustrative example) One form, five calls
An owner of a small landscaping business needs $60k to buy a second truck. They search “business loan quote”, pick the first result and type their name, work mobile and a rough amount. The small print beside the button says details may be shared with “selected finance partners”.
By the next afternoon they’ve had calls from two brokers, an equipment finance salesperson, a number that hung up, and a caller offering “guaranteed approval” for an upfront fee.
They ask each real caller where the details came from. Three name the same comparison site. They email that site’s privacy contact asking to stop sharing and for a list of recipients. They put the fee-asking caller down as a scam and block the number. Over the next few weeks the calls drop off. When one more caller appears, they repeat the same request with that business too.
The business still needs the truck. They decide the next form will name who will contact them, and how many.
How can I tell if a call is a scam, not a lender?
Check three things before you say anything about your business:
- Fees up front. A real lender or broker doesn’t need you to pay before a decision.
- Pressure. “Approved today, sign now” is a sales tactic, not a credit decision.
- Requests for logins or codes. Never give an internet banking password or a one-time code to a caller.
If you’re unsure, end the call and look the organisation up yourself on ABN Lookup and ASIC’s registers. The Scamwatch site lists current loan scams. We’ve covered the wider research habits in using AI to research business loans.
What should I check before filling in the next form?
Ten seconds of reading saves a week of calls.
- Who is the operator? A lender, a broker or a collector of enquiries?
- Does it say who will receive your details, by name or by number?
- Is sharing a separate, unticked box, or part of the submit action?
- Does the privacy policy list “marketing partners” or “affiliates”?
- Is there a named privacy contact you could write to?
- Does the form ask for your bank login or statements before saying who you’re dealing with?
Also give a contact number you can afford to be called on. And what comes after the form is worth knowing in advance. We explain it in what happens after you enquire, and in whether enquiring affects your credit score.
If you want to see how a different approach looks, you can check your options with us. Having been through the question yourself, you’ll know what to look for.
Ready to enquire without the follow-up calls?
If your phone has been busy since your last form, you’ve probably already learned the lesson: where an enquiry goes matters as much as the loan it’s for.
Here’s how ours works. The form takes about 60 seconds. There’s no credit check when you enquire, so asking doesn’t put a mark on your credit file. We don’t send your details to a pile of lenders. They stay with one team, so your phone shouldn’t light up with strangers. A real person reads your individual situation and calls you.
One request: please fill in the form accurately. The amount, purpose, turnover, property and any credit or tax history are what let us match the right option the first time rather than the third.
Frequently asked questions
Why did I get so many calls after one loan enquiry form?
The site probably shares or sells enquiries. Some forms are run by lead generators or comparison sites that pass your details to several brokers or lenders, often by a consent clause that mentions 'partners'. Each recipient then calls independently.
Can I put my business number on the Do Not Call Register?
No. The register says business telephone numbers aren't eligible. A number used mainly for personal or household purposes can be registered, and that's the exception. For a business line, ask each caller to remove you.
How do I find out where a caller got my details?
Ask them directly. Under APP 7, an organisation must tell you its source on request unless that's impracticable or unreasonable, and the OAIC says this should generally happen within 30 days. Ask in writing and keep a copy so you can trace the chain back.
Do they have to stop if I ask?
Organisations covered by the Privacy Act must give effect to a request to stop direct marketing, and can't charge for it. The OAIC says that would generally be no more than 30 days. For texts and emails, the Spam Act requires unsubscribe requests to be actioned within 5 working days.
Is it illegal for a loan site to share my details?
Not automatically. It depends on what you consented to and what you'd reasonably expect. Sharing for marketing without a valid basis, or ignoring an opt-out, can breach the Privacy Act. A clear consent clause you ticked usually makes the sharing lawful, which is why reading it matters.
Does the Privacy Act even apply to a small business?
Many small businesses are exempt, but not those that disclose personal information to someone else in return for a benefit, service or advantage. A lead seller fits that description, so the rules generally apply to it whatever its turnover.
Could the call be a scam instead of a lender?
Yes. Treat any caller who asks for an upfront fee, your banking logins or a code sent to your phone as a scam. Hang up and ring the organisation back on a number you looked up yourself.
How can I avoid this next time?
Before you submit, read the line beside the button and the privacy policy. Look for 'partners', 'affiliates' or 'third parties' and whether the form says how many parties will contact you. If it doesn't say, assume the details will travel.