# Email security for credit unions and community banks

URL: https://iblockspam.com/blog/email-security-for-credit-unions-community-banks
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for credit unions and community banks: member wire fraud, brand impersonation, FFIEC email controls, NCUA 72-hour and bank 36-hour incident notices.

## Short answer

Credit unions and community banks face fraudulent wire and account change requests from hijacked member mailboxes, phishing that impersonates the institution to members, and staff account takeover. FFIEC guidance names MFA, anti-phishing filtering, DMARC, macro blocking and external-email banners. Verify every member instruction outside email, and know your 72-hour (NCUA) or 36-hour (bank) notification duty.

Credit unions and community banks run on trust and small teams. Members expect to email a loan officer or the branch, wire and ACH requests move every day, and the same few people often handle IT, compliance and operations. Criminals use email to impersonate members, impersonate the institution, and steal staff passwords. This guide covers those risks, what FFIEC guidance and your regulator expect, and a checklist you can apply this quarter.

## Why are credit unions and community banks targeted by email?

They're targeted because email can move money. A fraudster who controls a member's mailbox, or a staff account, can request transfers, change contact details or harvest member data. Smaller institutions also tend to have fewer specialist staff to spot it.

- **Member relationships run on email.** Members email loan officers, business banking staff and branch managers directly. Criminals who hijack a member's mailbox can send instructions from the member's real address.
- **Your brand is a lure.** Phishing that copies your logo and name works on your members because they really do get email from you.
- **Third parties hold your data.** Cores, CUSOs, digital banking providers and card processors connect to your systems. A compromise there can arrive as an email from a trusted partner.

Business email compromise is the headline loss. The FBI's Internet Crime Complaint Center recorded 24,768 **business email compromise (BEC)** complaints in 2025, with $3,046,598,558 in reported losses across all industries ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). BEC is fraud where a criminal impersonates or takes over a trusted email account to redirect money. Our [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) explains the mechanics.

## What email threats do financial institutions see?

| Threat | What arrives | Target | First control |
|---|---|---|---|
| Member impersonation | A wire or ACH request from a hijacked member mailbox | Member services, business banking | Call back on the number on file |
| Account maintenance fraud | "Please update my phone and email address" | Member services | Enhanced verification before any change |
| Brand impersonation | A fake "suspicious activity" alert using your name | Your members | DMARC at reject, member education |
| Lookalike domains | Mail from `example-cu-alerts.com` or similar | Members and vendors | Lookalike monitoring, takedown requests |
| Staff credential phishing | A fake Microsoft 365 or core vendor sign-in page | Employees | Phishing-resistant MFA |
| Vendor invoice fraud | "Our bank details changed" from a real or fake vendor | Accounts payable | Call-back procedure |
| Ransomware | A malicious attachment or link | Anyone | Attachment filtering, backups |

### Member impersonation from a real mailbox

This is the scheme that most often turns into a loss. A criminal phishes the member's personal email password, reads their mail to learn their balance and habits, and then emails your staff from the member's real address. Because the message genuinely comes from the member's account, SPF, DKIM and DMARC all pass. Only a call to a phone number you already hold catches it.

> Example: "Hi Karen, I'm traveling and can't call right now. Please wire $48,500 from my savings to the title company for our closing. Details attached. This needs to go out today."

Urgency, travel and a reason not to call are the warning signs. Our [real estate wire fraud guide](https://iblockspam.com/blog/real-estate-wire-fraud-closing-scams) covers the closing-day version.

### Deepfake voices weaken call-backs

A call-back is only as good as the number you dial and the checks you run on the call. FinCEN's November 2024 alert reports an increase in suspicious activity reports describing deepfake media, including "fraudulent identity documents to circumvent identity verification and authentication methods" ([FinCEN](https://fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial)). Always dial out to a number on file rather than accepting an inbound call as proof. See [AI voice cloning and deepfake BEC](https://iblockspam.com/blog/ai-voice-cloning-deepfake-bec).

## What does FFIEC guidance say about email?

The FFIEC's 2021 guidance, *Authentication and Access to Financial Institution Services and Systems*, treats email as a main way in. Section 7 says "Users' email accounts and Internet browsers are common access points used by threat actors to gain unauthorized access, obtain or compromise sensitive data, or initiate fraud" ([FFIEC guidance](https://www.fdic.gov/news/financial-institution-letters/2021/fil21055a.pdf)). The **FFIEC** is the interagency council whose members include the FDIC, the Federal Reserve, the OCC and NCUA.

Its appendix lists email system controls. Here they are with where to find each one in your platform.

| FFIEC control (paraphrased) | What it means in practice | Where to read more |
|---|---|---|
| Vendor-recommended configuration, e.g. "MFA, anti-phishing, and anti-ransomware" | Turn on the protections your email platform recommends and watch for config changes | [Microsoft 365 preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies) |
| "Layered security controls, to include the use of MFA or equivalent techniques" for email users | MFA on every mailbox, phishing-resistant for staff with core or wire access | [Passkeys and phishing-resistant MFA](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email) |
| Email systems "monitored to detect suspicious activity" | Alerts on new forwarding rules, risky sign-ins, mass sending | [Malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) |
| Anti-phishing controls, including DMARC "policy and verification are enabled" | Publish DMARC for your domain and honor it on inbound mail | [What is DMARC?](https://iblockspam.com/blog/what-is-dmarc) |
| "Macro scripts transmitted via email are disabled" | Block Office macros from the internet | [Office macros blocked from the internet](https://iblockspam.com/blog/office-macros-blocked-from-internet) |
| Malicious attachments "blocked and moved to a segregated environment" | Attachment filtering and quarantine | [Dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) |
| External email messages "labeled with a prominent notice or banner" | An external sender tag on every outside message | [Outlook external email warning](https://iblockspam.com/blog/outlook-external-email-warning-tag) |

The same guidance asks for "Enhanced authentication controls" on "account maintenance activities (e.g., changes to physical or email address, password, contact information, or enrolled devices)". It also recommends educating customers about "phishing, social engineering, mobile-based trojans, and business email compromise".

## Which rules apply to your institution's email security?

The rule set depends on your charter and insurer. This table is a starting map, not legal advice; confirm the details with your compliance officer and counsel.

| Institution | Security program rule | Incident notice to regulator |
|---|---|---|
| Federally insured credit union | NCUA 12 CFR 748.0 security program | NCUA, within 72 hours of reasonable belief |
| FDIC-, Fed- or OCC-supervised bank | [Interagency Guidelines Establishing Information Security Standards](https://www.federalreserve.gov/supervisionreg/interagencyguidelines.htm) under GLBA section 501(b) | Primary federal regulator, within 36 hours of determination |
| Non-federally insured credit union | Typically the FTC Safeguards Rule; confirm with your state regulator | FTC, for qualifying events (see our [Safeguards Rule guide](https://iblockspam.com/blog/ftc-safeguards-rule-email-security)) |

### NCUA: the security program and the 72-hour rule

NCUA's rule says each federally insured credit union's written security program must be designed to "protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member" ([12 CFR 748.0](https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748)). Appendices A and B to Part 748 hold NCUA's guidelines for safeguarding member information and responding to unauthorized access. NCUA proposed in December 2025 to remove both from the regulation and publish their content as guidance. At the time of writing (November 2026), both still appear in the eCFR and we found no final rule, so check the current status before relying on either.

Since September 1, 2023, a federally insured credit union must notify NCUA "as soon as possible and no later than 72 hours" after it reasonably believes a reportable cyber incident occurred ([NCUA](https://ncua.gov/regulation-supervision/regulatory-compliance-resources/cybersecurity-resources/cyber-incident-reporting)). Under the rule, reportable incidents include unauthorized access to or exposure of sensitive data, disruption of vital member services, and incidents caused by a compromise at a CUSO, cloud provider or other third-party data host ([Federal Register](https://www.govinfo.gov/content/pkg/FR-2023-03-01/html/2023-03682.htm)). The rule's preamble says "Blocked phishing attempts, failed attempts to gain access to systems, or unsuccessful malware attacks" don't have to be reported ([Federal Register](https://www.govinfo.gov/content/pkg/FR-2023-03-01/html/2023-03682.htm)). A phished staff mailbox that exposed member data may well be reportable. NCUA accepts reports through its online form, by phone at 1-833-CYBERCU, or by secure email.

### Banks: the 36-hour rule

The OCC, the Federal Reserve and the FDIC require a banking organization to notify its primary federal regulator "no later than 36 hours after the banking organization determines" that a notification incident has occurred ([FDIC FIL-74-2021](https://www.fdic.gov/news/financial-institution-letters/2021/fil21074.html)). A notification incident is one that has materially disrupted or degraded, or is reasonably likely to, the bank's operations or important business lines. Full compliance began May 1, 2022.

## How should staff verify member instructions that arrive by email?

Verify any instruction that moves money or changes contact details through a channel the sender doesn't control. Write it down, train it, and apply it to every member, including the ones staff know well.

1. **Never act on email alone** for wires, ACH set-ups, large withdrawals, new payees or changes to phone, email or address.
2. **Call the member on the number already on file**, not one in the email or its signature. Don't accept an inbound call as confirmation.
3. **Ask a question the member can answer** from your relationship, not from their mailbox.
4. **Pause after recent contact changes.** A new phone number followed by a wire request is a classic takeover sequence.
5. **Require a second approver** for wires over your set limit and for any first payment to a new beneficiary.
6. **Tell the member if their email looks compromised**, and point them to [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).
7. **If money has gone, act at once.** Recall the transfer, file a suspicious activity report where required, and report to the FBI at ic3.gov. Our [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) covers the first hours.

## How do you stop criminals impersonating your institution to members?

Publish DMARC at `p=reject` on every domain you own, watch for lookalikes, and tell members exactly how you contact them. **DMARC** is a DNS record that tells receiving servers to reject mail that claims your domain but fails authentication. A finished record looks like this (example domain):

```
_dmarc.example-cu.org  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-cu.org"
```

The .bank domain ending shows how seriously the sector treats this. Its registry requires every .bank domain to publish a DMARC record "whether or not the domain is used to send email", with a reject policy, allowing p=none or p=quarantine only while email is being deployed, and moving to reject "within 90 days of deployment" ([fTLD Registry](https://register.bank/security-technical-details/)). You can meet the same standard on a .org or .com domain today.

DMARC doesn't stop lookalike domains. For those, monitor new registrations with the [lookalike domain guide](https://iblockspam.com/blog/lookalike-domain-phishing), and tell members on your website and in statements what you will never ask by email: passwords, one-time codes or card PINs. Point them to our plain-language guide on [fake bank alert emails](https://iblockspam.com/blog/fake-bank-alert-emails).

## Credit union and community bank email security checklist

1. Enforce MFA on every mailbox; use phishing-resistant MFA for staff with core, wire or admin access.
2. Write and train the member instruction verification procedure above.
3. Publish SPF, DKIM and DMARC on every domain, and move DMARC to `p=reject`.
4. Turn on the FFIEC-listed email controls: macro blocking, attachment filtering, external banners and monitoring.
5. Alert on new forwarding rules and unusual sign-ins in staff mailboxes.
6. Add email scenarios to your incident response plan, with the 72-hour or 36-hour notice step and who makes the call.
7. Ask email and filtering providers how they notify you of incidents, since vendor incidents can start your clock.
8. Educate members on what you never send, and give them one place to report suspicious messages.

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your main domain and any marketing or alert domains.
- Review last quarter's wire and account-change exceptions against your verification procedure.
- Check that your [incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan) names who decides whether an email incident is reportable.
- If you're adding a filtering layer in front of Microsoft 365 or Google Workspace, iBlockSpam's [small business plans](https://iblockspam.com/solutions/small-business) are priced per domain with unlimited mailboxes, and include quarantine, attachment filters and domain monitoring. Filtering is one control; it doesn't replace MFA, verification procedures or your regulator's requirements.

## Frequently asked questions

### Do blocked phishing emails count as a reportable cyber incident for credit unions?

No. In the preamble to its 2023 final rule, NCUA says blocked phishing attempts, failed attempts to gain access to systems and unsuccessful malware attacks do not have to be reported. A phishing email that leads to unauthorized access to sensitive data or disrupts member services may be reportable, and the 72-hour clock starts when you reasonably believe that happened.

### How fast must a community bank report a cyber incident?

Under the joint OCC, Federal Reserve and FDIC rule, a banking organization must notify its primary federal regulator no later than 36 hours after it determines a notification incident has occurred. That's an incident that materially disrupts or degrades, or is reasonably likely to, the bank's operations or key business lines. Full compliance began May 1, 2022.

### What email controls does FFIEC guidance list?

The FFIEC's 2021 authentication guidance lists vendor-recommended email configuration, MFA or equivalent for email users, monitoring for suspicious activity, anti-phishing controls including DMARC, disabled macros in email, blocking malicious attachments, banners on external email and user education. It's guidance that examiners refer to, not a checklist that guarantees an exam outcome.

### Can a credit union act on a member's emailed wire request?

Only after confirming it through a channel the criminal doesn't control, such as a call to the phone number already on file. Member mailboxes are often compromised, so an email from the member's real address proves nothing. Write the rule into your funds transfer agreement and procedures, and apply it every time.

### Should a bank or credit union use a .bank domain?

.bank is a restricted domain ending with mandatory security rules. Registrants must publish DMARC with a reject policy (within 90 days of deployment), publish SPF even for non-sending domains, use DNSSEC and offer TLS 1.2 or higher for email. It doesn't stop lookalikes in other endings, so you still need DMARC on your existing domain and member education.

## Sources

- [FFIEC: Authentication and Access to Financial Institution Services and Systems (August 2021), via FDIC FIL-55-2021](https://www.fdic.gov/news/financial-institution-letters/2021/fil21055a.pdf)
- [NCUA: Cyber Incident Notification Requirements](https://ncua.gov/regulation-supervision/regulatory-compliance-resources/cybersecurity-resources/cyber-incident-reporting)
- [Federal Register: NCUA final rule, Cyber Incident Notification Requirements for Federally Insured Credit Unions (March 1, 2023)](https://www.govinfo.gov/content/pkg/FR-2023-03-01/html/2023-03682.htm)
- [FDIC FIL-74-2021: Computer-Security Incident Notification Final Rule](https://www.fdic.gov/news/financial-institution-letters/2021/fil21074.html)
- [eCFR: 12 CFR Part 748, Security Program (NCUA)](https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748)
- [FinCEN: FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (November 2024)](https://fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial)
- [fTLD Registry (.bank): Security Requirements and Technical Details](https://register.bank/security-technical-details/)
- [Federal Reserve: Interagency Guidelines Establishing Information Security Standards](https://www.federalreserve.gov/supervisionreg/interagencyguidelines.htm)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-credit-unions-community-banks (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt