I'm just guessing, but they could be using info that was obtained when a user was trying to get a loan. Typically, your info is sent to multiple lenders so you can get the best rate. Somebody could be collecting the info somewhere along the line.