Advisors hold sensitive personal and financial information, maintain trusted relationships with clients, and often support high-value transactions.  This makes advisory practices attractive targets for phishing, business email compromise, account takeover, ransomware, and fraudulent transfer attempts.

Why your practice is at risk?

  • High transaction value: Fund transfers, banking instruction changes, and policy withdrawals offer immediate, large payoffs if a fraud attempt succeeds.
  • Rich personal data: SIN numbers, account details, and beneficiary information are valuable for fraud and identity theft.
  • Built-in trust: Clients expect you to contact them about their money and accounts. That expectation makes spoofed emails impersonating you, or fake client messages impersonating them, far more convincing.
  • Limited security infrastructure: Most advisory practices operate without dedicated IT support, often using personal email and consumer-grade tools. Attackers target the path of least resistance.
  • Multiple access points: Carrier portals, CRM systems, MGA portals, and email all represent entry points. Compromising one is enough.
  • Urgency is normalized: Time-sensitive requests are routine in your practice. Cybercriminals exploit that urgency to pressure people into skipping verification steps.

What you should do?
Security Best Practices

 

Action
What it means in practice
Verify before acting Call the client or carrier to confirm any request involving fund transfers, banking changes, or account access – regardless of how the request arrived.
Use multi-factor authentication (MFA) Enable MFA on all business tools: email, CRM, carrier portals, and MGA systems. Have MFA codes sent to a device, other than email.
Recognize phishing and impersonation Treat unexpected or urgent requests with caution, even if they appear to come from a known contact.
Protect client information Use secure, encrypted channels when sharing documents or sensitive personal and financial data.
Keep systems updated Apply security patches promptly, use endpoint protection, and avoid business systems on unsecured public Wi-Fi.
Use strong, unique passwords Use a reputable password manager. Never reuse passwords across personal and business accounts.
Know your escalation path Report suspected cyber incidents, compromised credentials, or potential client fraud immediately. Notify your IT support, E&O, HUB Financial and any applicable insurers, based on potential client impact.

Thank you for making cyber vigilance part of your day-to-day client service. A short pause to verify a request can prevent financial loss, privacy breaches, regulatory issues, and reputational harm.

For additional resources, visit the Cyber Readiness section on HUBLINK.