Advisors hold sensitive personal and financial information, maintain trusted relationships with clients, and often support high-value transactions. This makes advisory practices attractive targets for phishing, business email compromise, account takeover, ransomware, and fraudulent transfer attempts.
Why your practice is at risk?
- High transaction value: Fund transfers, banking instruction changes, and policy withdrawals offer immediate, large payoffs if a fraud attempt succeeds.
- Rich personal data: SIN numbers, account details, and beneficiary information are valuable for fraud and identity theft.
- Built-in trust: Clients expect you to contact them about their money and accounts. That expectation makes spoofed emails impersonating you, or fake client messages impersonating them, far more convincing.
- Limited security infrastructure: Most advisory practices operate without dedicated IT support, often using personal email and consumer-grade tools. Attackers target the path of least resistance.
- Multiple access points: Carrier portals, CRM systems, MGA portals, and email all represent entry points. Compromising one is enough.
- Urgency is normalized: Time-sensitive requests are routine in your practice. Cybercriminals exploit that urgency to pressure people into skipping verification steps.
What you should do?
Action |
What it means in practice |
|---|---|
| Verify before acting | Call the client or carrier to confirm any request involving fund transfers, banking changes, or account access – regardless of how the request arrived. |
| Use multi-factor authentication (MFA) | Enable MFA on all business tools: email, CRM, carrier portals, and MGA systems. Have MFA codes sent to a device, other than email. |
| Recognize phishing and impersonation | Treat unexpected or urgent requests with caution, even if they appear to come from a known contact. |
| Protect client information | Use secure, encrypted channels when sharing documents or sensitive personal and financial data. |
| Keep systems updated | Apply security patches promptly, use endpoint protection, and avoid business systems on unsecured public Wi-Fi. |
| Use strong, unique passwords | Use a reputable password manager. Never reuse passwords across personal and business accounts. |
| Know your escalation path | Report suspected cyber incidents, compromised credentials, or potential client fraud immediately. Notify your IT support, E&O, HUB Financial and any applicable insurers, based on potential client impact. |
Thank you for making cyber vigilance part of your day-to-day client service. A short pause to verify a request can prevent financial loss, privacy breaches, regulatory issues, and reputational harm.
For additional resources, visit the Cyber Readiness section on HUBLINK.