Funds Transfer Fraud and Social Engineering Questions

This question helps the insurance carrier evaluate your firm's exposure to social engineering and funds transfer fraud. When you have the ability to move client money, you become a target for criminals who use deception (like fake emails) to trick you into sending funds to fraudulent accounts. A "yes" answer indicates a significantly higher risk profile for these types of cybercrime-related E&O claims.

• What does "Disburse or Request Disbursement" mean?
  • To Disburse: You directly initiate the transfer of money out of a client's account to any destination.
  • To Request Disbursement: You instruct or direct a client or their custodian (the bank/brokerage) to transfer money from the account, even if you don't execute the transfer yourself.
• What is "Social Engineering" or "Funds Transfer Fraud"? This is a type of cybercrime where fraudsters manipulate or deceive you into making a mistake. A common example is "Business Email Compromise," where a criminal hacks a client's email and sends you fraudulent instructions to wire money to the criminal's account.

To answer this, you must determine if you are involved in moving client funds in any capacity.

• Direct Disbursement: Do you directly move funds from a client's account to any third party?
• Indirect Requests: Do you send instructions to the client or their custodian to move funds on their behalf?

Note: This is similar to Question 16, but the focus here is specifically on the risk of fraud, not just custody.

If you have the authority to do either of these, you must answer "yes." If you never initiate or request the movement of client funds, you can answer "no."

• Mistake: Believing that because a client authorized a transfer, you are not at risk.
  • Fraudsters rely on impersonating your client. If you act on an emailed instruction that appears to be from your client but is actually from a criminal, your firm could be held liable for the loss.
• Pitfall: Thinking this only applies to wire transfers.
  • This risk applies to any method of moving money, including ACH transfers, checks, and other forms of electronic payment.
• Mistake: Assuming your only risk is losing your own money.
  • The primary risk here is losing your client's money, for which your firm could be held responsible. This can lead to a devastating E&O claim and reputational damage.

This question helps the insurance carrier evaluate your firm's vulnerability to cybercrime. Email is the single most common channel (or "vector") for social engineering and funds transfer fraud attacks. By confirming whether you use this high-risk channel for money movement instructions, the underwriter can assess your firm's exposure to potentially significant fraud-related E&O claims.

• What does "Accept Funds Transfer Requests via Email" mean? This means you receive and act on instructions from a client to move money, where the initial instruction arrives in an email. Even if you perform other verification steps later, using email as the channel for the initial request is what this question is about.
• What is "Business Email Compromise (BEC)"? A sophisticated scam where a criminal hacks into or spoofs a legitimate email account (like a client's) and sends fraudulent instructions to an advisor, tricking them into wiring money to the criminal's account.

To answer this question, you must determine if your firm's procedures allow for a client to initiate a money movement request by sending you an email.

• This is a simple "yes" or "no" question.
• If your policy is to accept such requests, even if you follow up with a phone call, the answer is "yes."
• If your firm has a strict policy to never accept money movement instructions via email and you require clients to use a more secure method (like a phone call or a secure client portal), the answer is "no."

• Mistake: Believing that because you call to verify the request, you can answer "no."
  • The question is about whether you accept the request via email as the first step. If the process starts with an email, you must answer "yes." The verification step is a crucial control, but it doesn't change the fact that you use a high-risk channel.
• Pitfall: Thinking this doesn't apply because it happens rarely.
  • Even one instance of accepting a request via email exposes your firm to this risk. The policy should be consistent.
• Mistake: Assuming your secure email portal is exempt.
  • If the "secure portal" is just an encrypted email system, the risk of the client's own email account being compromised still exists. The answer is likely still "yes."

This question helps the insurance carrier evaluate your firm's specific risk mitigation practices against fraud. Using a callback to a prearranged number is considered a critical and highly effective safeguard against social engineering and funds transfer fraud. A "yes" answer indicates that you have a strong verification process, which can significantly reduce the likelihood of a successful fraud attempt and may be viewed favorably by underwriters.

• What is "Callback Verification"? This is a verification process where you proactively contact a client to confirm that a money movement request is legitimate before you act on it.
• What is a "Prearranged Number"? This is a phone number that you have established with the client ahead of time as a trusted contact number. It should be a number you collected through a secure method (e.g., during the in-person onboarding process), not a number provided in the potentially fraudulent email itself.

To answer this, you need to confirm if your firm's standard procedure includes this specific verification step for money movement requests.

• The Process: When your firm receives a request to transfer funds (especially via an insecure method like email), do you have a mandatory policy to call the client to get verbal confirmation?
• The Number: Do you make this call to a phone number that is already on file and known to be authentic, rather than a number listed in the email making the request?

If this is your firm's standard procedure, you can answer "yes." If you do not perform this specific verification step, you should answer "no."

• Mistake: Calling a number listed in the potentially fraudulent email.
  • This is a critical error. Fraudsters will often include their own phone number in a fake email. A proper callback must be to a prearranged number already in your system that you know belongs to the client.
• Pitfall: Only performing callbacks for large transfer amounts.
  • While better than nothing, best practice (and what underwriters look for) is a consistent policy for all transfer requests, regardless of the amount. Criminals often start with small transfers to test a firm's controls.
• Mistake: Thinking that since you "know" your client's voice, you don't need a prearranged number.
  • The principle of a prearranged number is to ensure you are contacting the legitimate client at their known point of contact, bypassing the potentially compromised communication channel.

This question helps the insurance carrier evaluate another layer of your firm's security practices. Using a pre-established password or passphrase is a recognized safeguard against social engineering and funds transfer fraud. While not as robust as a callback verification on its own, it adds a layer of authentication. A "yes" answer can demonstrate a more security-conscious approach to protecting client assets from fraud.

• What is "Password/Passphrase Verification"? This is an authentication method where you require a client to provide a secret word (password) or phrase (passphrase) to confirm their identity before you will act on a money movement request. This secret code should be established securely with the client ahead of time.

To answer this question, you need to confirm if your firm uses a pre-agreed-upon password or passphrase as a step in verifying a client's identity before moving money.

• The Process: When your firm receives a request to transfer funds, do you have a procedure that requires the client to provide a password or passphrase?
• Application: Is this used for all clients and all requests, or only under specific circumstances?

If you use this security measure as part of your process, you can answer "yes." If you do not use passwords or passphrases for this purpose, you should answer "no."

• Mistake: Confusing a client's account password with a specific passphrase for verification.
  • This question is not about the password a client uses to log into their account portal. It's about a separate, specific code used to verbally or otherwise authenticate a money movement request.
• Pitfall: Using easily guessable information as a passphrase.
  • Information like a mother's maiden name or the last four digits of a Social Security number are not secure passphrases, as this data is often compromised in data breaches. The code should be unique and known only to you and the client.
• Mistake: Believing this method is a complete replacement for callback verification.
  • While helpful, this method is not as secure as a callback to a prearranged number. A criminal who has compromised a client's computer could potentially find the password stored in a file. It is best used as a part of a multi-layered security approach, not as the only defense.

This question helps the insurance carrier evaluate another layer of your firm's security practices against fraud. Using text messages (SMS) to verify a transaction is a common authentication method. While it can be an effective part of a multi-layered defense, it also has known vulnerabilities (e.g., SIM swapping). Underwriters want to know if you use this method to understand the specific technologies and risks present in your verification process.

• What is "Text Message Verification"? This is an authentication process where, after receiving a money movement request, you send a text message to a client's prearranged mobile number to confirm the request is legitimate. This might involve the client replying "YES" or you sending a one-time code that the client must provide back to you.
• What is a "Prearranged Number"? As with callback verification, this is a mobile phone number that you have established with the client ahead of time as a trusted contact number through a secure method.

To answer this question, you need to confirm if your firm uses text messaging as a step in verifying a client's identity before moving money.

• The Process: When your firm receives a request to transfer funds, do you have a procedure that involves sending a text message to the client for confirmation?
• Application: Is this used for all clients and all requests, or only under specific circumstances?

If you use this security measure as part of your process, you can answer "yes." If you do not use text messages for this purpose, you should answer "no."

• Mistake: Believing text message verification is foolproof.
  • While useful, SMS verification is vulnerable to "SIM-swapping" attacks, where a criminal tricks a mobile carrier into transferring a client's phone number to a new SIM card controlled by the criminal. This allows them to intercept verification texts. Because of this risk, it should not be the only method of verification.
• Pitfall: Texting a number provided in a potentially fraudulent email.
  • Just like with phone callbacks, the text must be sent to a prearranged number you have on file, not a number provided in the email making the request.
• Mistake: Using text messaging as the primary communication channel for sensitive information.
  • Texting is not a secure channel for discussing detailed financial matters. It should be used for verification purposes only (e.g., sending a code), not for transmitting sensitive client data.

This question helps the insurance carrier evaluate another potential layer of your firm's security practices against fraud. Sending a confirmation to a prearranged email address can serve as a documented step in your verification process. However, because email itself is a vulnerable channel, underwriters assess this practice to understand how it fits into your overall security posture and whether it is a primary control or a supplementary one.

• What is "Email Confirmation"? This is a verification process where you send a message to a client's pre-established email address to confirm that a money movement request is legitimate before you act on it.
• What is a "Prearranged Email Address"? This is an email address that you have securely collected from the client ahead of time and have on file as their official contact email. It should not be an email address that was provided in the transfer request itself.

To answer this question, you need to confirm if your firm uses email confirmation as a step in verifying a client's identity before moving money.

• The Process: When your firm receives a request to transfer funds, do you have a procedure that involves sending a confirmation to a known client email address?
• Application: Is this used for all clients and all requests, or only under specific circumstances?

If you use this security measure as part of your process, you can answer "yes." If you do not use email confirmation for this purpose, you should answer "no."

• Mistake: Using email confirmation as your only verification method.
  • This is a critical error. If a criminal has compromised your client's email account, they can both send the fraudulent request and reply to your confirmation email, making the control useless. Email confirmation is one of the weakest forms of verification when used alone.
• Pitfall: Replying to the same email that made the request.
  • A proper confirmation should be sent by starting a new email thread to the prearranged address on file, not by simply hitting "reply." This helps defeat certain email-forwarding scams.
• Mistake: Believing this makes your process secure.
  • While better than nothing, email confirmation is not a robust security control against a determined fraudster. It should only be used as a supplementary step in a process that includes stronger methods like a phone callback.

This question gives you an opportunity to describe any unique or alternative verification methods your firm uses that were not covered in the previous, specific questions. Insurers recognize that firms may have innovative or customized security controls. This question allows the underwriter to get a complete picture of all your safeguards against funds transfer fraud and to give you credit for any additional robust procedures you have in place.

• What is a "Different Method"? This refers to any verification process your firm uses that is not a phone callback, a password/passphrase, a text message, or an email confirmation. This is a "catch-all" to describe any other security step you take. Common examples include:
  • In-person verification (client must come to the office).
  • Video call confirmation.
  • Secure client portal authentication (requiring the client to log in to approve a transfer).
  • Use of a third-party authentication app.

To answer this, you need to consider if you use any other verification methods not previously discussed.

• Review your Process: Think through your entire funds transfer verification process. Is there any other step you take?
• Describe the Method: If you answer "yes," you must be prepared to describe the method in detail in a type-in field on the application.

If you do not use any other methods beyond what has already been covered, you can answer "no."

• Mistake: Re-listing a method that was already covered.
  • Do not answer "yes" and then describe your callback procedure again. This question is only for different methods.
• Pitfall: Being too vague in your description.
  • If you answer "yes," a vague description like "we use other checks" is not helpful. You need to be specific, for example: "For all transfers over $50,000, we require the client to approve the transfer request through their secure, multi-factor authenticated client portal."

This question helps the insurance carrier evaluate your firm's vulnerability to a specific type of social engineering attack. When you send pre-filled wire instructions to a client (especially via email), you create a document that a criminal can intercept and alter. A fraudster could change the account and routing numbers to their own, and then send the altered document to your client, tricking them into wiring money to a fraudulent account. This practice creates a significant liability risk for your firm.

• What are "Pre-Filled Wire Instructions"? This refers to any document or template (digital or paper) that you provide to a client that already contains specific banking details for a wire transfer, such as the recipient's name, bank, account number, and routing number. You might send this to make it easier for a client to fund their account with you.

To answer this, you must determine if your firm ever provides clients with wire instruction forms where the banking details are already filled in.

• This includes sending PDFs via email, providing templates on your website, or handing out physical copies.
• The key is whether you are the source of the document containing the sensitive banking information.

If you engage in this practice, you must answer "yes." If you never provide pre-filled instructions and instead have clients obtain wiring details directly from the source (e.g., from the custodian's secure website), you can answer "no."

• Mistake: Believing that sending instructions via encrypted email is safe.
  • Even if your email is secure, the client's email account can be compromised. A criminal can intercept the document, alter it, and send it to the client from a spoofed or hacked account. The secure channel does not eliminate the risk.
• Pitfall: Thinking this is the client's risk, not yours.
  • If a client loses money after acting on fraudulent instructions that originated from your firm (even if they were altered later), your firm will almost certainly be involved in the dispute and may be held partially or fully liable.
• Mistake: Assuming that because it's convenient for the client, it's a good practice.
  • While convenient, it is a high-risk practice from a cybersecurity perspective. The convenience does not outweigh the potential for catastrophic fraud.

This question helps the insurance carrier evaluate your firm's internal risk of social engineering and funds transfer fraud. The more individuals who have the authority to initiate money movement, the more potential targets a criminal has for an attack. By understanding how many staff members have this critical ability, an underwriter can assess the scale of your firm's internal control risk.

• What is the "Ability to Send Transfer Requests"? This refers to the authority or system access that allows a staff member to initiate a funds transfer instruction to a custodian (e.g., Schwab, Fidelity) or a bank. This includes any employee who can directly submit wire instructions, authorize an ACH transfer, or otherwise send a request that results in the movement of funds.

To answer this question, you need to provide the total number of employees, contractors, or other personnel within your firm who have the explicit authority or system access to send a funds transfer request.

• Review Permissions: Identify all staff members who have logins or authority to access custodian platforms for the purpose of moving money.
• Count Individuals: Provide a specific count of these individuals.
• Include All Roles: This could include anyone from senior advisors to administrative staff, if they have the capability to initiate such transactions.

• Mistake: Only counting senior advisors or partners.
  • You must count any staff member with the ability to send a transfer request, regardless of their title. Administrative staff are often targeted by fraudsters because they may have access but less training.
• Pitfall: Thinking that because a staff member's access is supervised, they don't count.
  • Even if a transaction requires a manager's approval, the staff member who can initiate the request still represents an access point and must be included in the count.
• Mistake: Excluding staff who only handle certain types of transfers.
  • If a staff member can initiate any type of transfer (e.g., only ACH, not wires), they still have the ability to send a transfer request and must be counted.

This question helps the insurance carrier evaluate the internal control environment of your firm. While family-run businesses can be very strong, insurers view them as having a different risk profile than firms with non-family employees. The level of trust, formality of procedures, and methods of oversight can differ. A larger number of non-family employees can increase the number of potential targets for social engineering, as criminals may try to exploit weaker links in a larger organization. This question helps the underwriter understand this dynamic.

• Who is a "Non-Family Employee"? This is any employee who is not a close relative of the firm's principals or owners. Close relatives typically include a spouse, parent, child, or sibling. You should count any employee who does not have such a family connection.

To answer this question, you need to provide the total number of your employees who are not family members of the firm's principals.

• Count Individuals: Review your staff roster and count all employees who do not have a close family tie to the firm's ownership.
• Include All Roles: This includes full-time, part-time, and temporary employees if they are not family members.

Provide the specific number. If all of your employees are family members, the answer is "0".

• Mistake: Only counting full-time employees.
  • You must include all non-family employees, regardless of their employment status (full-time, part-time, etc.), as they all represent a potential vector for a social engineering attack.
• Pitfall: Getting offended by the question.
  • This question is not a judgment on your family or your employees. It is a standard question used by insurers to understand the internal control environment. Family businesses often have higher levels of implicit trust and less formal oversight, which is a unique risk factor an underwriter must consider.
• Mistake: Thinking that since a non-family employee doesn't have access to funds, they don't need to be counted.
  • All employees must be counted. A criminal might target a junior, non-family employee in an attempt to gather information that can be used to impersonate a more senior person at the firm in a later attack.

This question helps the insurance carrier evaluate your firm's internal security and hiring practices. Requiring background checks on all employees with access to sensitive data is a fundamental control for mitigating internal fraud and reducing vulnerability to social engineering. A firm that vets its employees is seen as a lower risk than one that does not, as it takes proactive steps to prevent hiring individuals who may pose a threat to the firm or its clients.

• What is a "Background Check"? A pre-employment or periodic process to investigate an individual's history. This typically includes, at a minimum, a criminal record check. It can also include verification of employment history, credit checks, and checks of regulatory databases (like FINRA's BrokerCheck).
• What is "Sensitive Information"? Any data that, if compromised, could harm clients or the firm. This includes client financial records, account numbers, social security numbers, and especially the ability to access or initiate funds transfers.

To answer this question, you need to confirm if your firm has a mandatory policy to conduct background checks on every employee who will have access to sensitive client or firm information.

• Review your hiring process: Is a background check a standard, required step for all personnel in sensitive roles?
• Consider all employees: This policy must apply to everyone with access, from senior partners to administrative staff.
• "All" is the key word: If you conduct checks on some employees with access but not others, the answer to this question is "no."

If you have a mandatory policy to check all employees with sensitive access, you can answer "yes."

• Mistake: Answering "yes" when you only check certain employees.
  • The question specifically asks about all employees with access. If you only check advisors but not the administrative staff who may also have access to client data, your answer must be "no."
• Pitfall: Conducting only informal reference checks.
  • While calling references is a good practice, it is not a formal background check. An underwriter is looking for a formal process that includes, at a minimum, a review of criminal history.
• Mistake: Assuming that because an employee has a professional license, a background check is not needed.
  • While licensing bodies conduct their own checks, a direct background check as part of your hiring process is a separate and important internal control.