# Email security for financial advisors: threats, Regulation S-P and fixes

URL: https://iblockspam.com/blog/email-security-for-financial-advisors
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for advisers: client impersonation wire requests, mailbox takeover, imposter domains, and what amended SEC Regulation S-P expects of firms.

## Short answer

Financial advisors are targeted because client accounts move money on emailed instructions. The main risks are fake client wire requests from hacked or spoofed addresses, takeover of advisers' cloud mailboxes and imposter domains. Amended SEC Regulation S-P requires an incident response program and client notice within 30 days. Use MFA, call clients back before wires, publish DMARC and filter inbound mail.

An advisory practice runs on trust and email. Clients send instructions, statements go out, custodians send alerts and wires move on the strength of messages that look routine. That makes adviser inboxes one of the most valuable targets in small business. This guide covers the email threats specific to financial advisors, what the SEC and FINRA have said about them, what amended Regulation S-P now expects, and a practical checklist.

## Why are financial advisors targeted by email fraud?

Financial advisors are targeted because a convincing email can move a client's money, and advisers' mailboxes hold the personal and account details criminals need to make that email convincing. Fraud against advisers usually takes one of three forms:

- **Client impersonation.** A criminal sends instructions as the client, from the client's hacked mailbox or a lookalike address.
- **Adviser mailbox takeover.** A criminal phishes the adviser's or assistant's email password and reads years of client correspondence, statements and account numbers.
- **Firm impersonation.** A criminal sets up a lookalike domain or website in the adviser's name to collect client information or deliver malware.

FINRA's [2026 Annual Regulatory Oversight Report](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/cybersecurity) describes "account impersonations" as threat actors combining stolen customer information with a "compromised or spoofed email address" to initiate actions from a customer's account, often a third-party wire transfer request. It also lists "attacks leveraging spoofed domains and social media profiles" that impersonate firms, representatives and FINRA staff.

More broadly, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses across all industries ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). **BEC** is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money.

## What email threats do advisory firms see?

The table lists the common threats, with the check that stops each.

| Threat | What arrives | Who it targets | How to check |
|---|---|---|---|
| Fake client wire request | "Please wire $85,000 to my attorney's account today" from the client's address | Adviser, operations staff | Call the client on the number in your file |
| Fake custodian or portal alert | "Unusual sign-in on your advisor platform, verify now" | Advisers, assistants | Open the custodian portal from a bookmark |
| Fake regulator notice | A "request" or "filing deadline" from a domain resembling FINRA or the SEC | Compliance, principals | Check the domain; contact the regulator directly |
| Imposter adviser domain | Emails to your clients from a domain using your adviser's name | Your clients | Monitor for lookalikes; publish DMARC |
| Document-share phishing | "Signed account forms shared with you" leading to a fake sign-in page | Anyone | Confirm with the sender; type the address |

### Fake client instructions

The classic attack is short and urgent. Here is an example of the kind of message that should always trigger a phone call:

> Example: "Hi Mark, I'm in meetings all day and can't talk. Please wire $85,000 from my brokerage account to the account below for a property closing tomorrow. I've attached the wiring details. Thanks, Susan"

FINRA's 2026 report lists, among effective practices, reviewing email addresses and verifying signatures associated with third-party accounts before moving money, and watching wire requests to third parties, including previously unused ones. The safest rule is simple: no wire to a new destination without a call to the client on a number you already have, whatever the email says about being unavailable.

### Adviser mailbox takeover

The SEC has already sanctioned firms over this. In August 2021 it announced three actions against eight broker-dealers and advisory firms ([SEC press release 2021-169](https://www.sec.gov/newsroom/press-releases/2021-169)):

| Firm group | What happened, per the SEC | Clients exposed | Penalty |
|---|---|---|---|
| Cetera Entities | Cloud email accounts of over 60 personnel "taken over by unauthorized third parties" | At least 4,388 | $300,000 |
| Cambridge | Cloud email accounts of over 121 representatives taken over | At least 2,177 | $250,000 |
| KMS | Cloud email accounts of 15 advisers or their assistants taken over | About 4,900 | $200,000 |

The SEC said Cambridge found its first takeover in January 2018 but didn't adopt and implement firm-wide enhanced security measures for its representatives' cloud email accounts until 2021, and KMS didn't fully implement its measures firm-wide until August 2020. The SEC's Cyber Unit chief put it plainly: "It is not enough to write a policy requiring enhanced security measures if those requirements are not implemented". Once inside a mailbox, attackers often add rules that forward or hide mail. See [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) and [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised).

### Imposter domains and websites

FINRA's [Regulatory Notice 20-30](https://www.finra.org/rules-guidance/notices/20-30) warned of imposter websites that appear to be representatives' personal sites, often "using the registered representative's name as the domain name". FINRA said the fraudsters could use the domain to "send fake emails purporting to be from the registered representative", with phishing links or malware. It recommends periodic web searches for your representatives' names, abuse reports to the host and registrar, and warning clients. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) covers detection.

## What does amended Regulation S-P require?

Amended Regulation S-P requires SEC-registered investment advisers, broker-dealers, investment companies and transfer agents to keep a written incident response program and to notify affected individuals after unauthorized access to sensitive customer information. The SEC adopted the amendments on May 16, 2024 ([SEC press release 2024-58](https://www.sec.gov/newsroom/press-releases/2024-58)). According to the SEC's [small entity compliance guide](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf):

| Requirement | What the SEC says | What it means for email |
|---|---|---|
| Incident response program | Written policies and procedures "reasonably designed to detect, respond to, and recover from" unauthorized access to or use of customer information | A tested plan for a phished mailbox |
| Customer notification | Notice "as soon as practicable, but not later than 30 days" after becoming aware of unauthorized access, with limited exceptions | Know what client data sat in each mailbox |
| Service provider oversight | Providers must notify you "as soon as possible, but no later than 72 hours" after a breach of a customer information system they maintain | Ask your email and filtering providers about breach notice |
| Compliance dates | Larger entities by December 3, 2025; smaller entities by June 3, 2026 | Both have passed at the time of writing (October 2026) |

The 30-day clock is why mailbox hygiene matters. If you can't tell what client data was in a compromised mailbox, it's hard to judge who must be notified. Keeping account forms and statements in your CRM or document system, rather than in email attachments, limits the exposure.

State-registered advisers follow their state securities regulator's rules instead, and dual registrants may also have FINRA obligations. This guide isn't legal or compliance advice. Ask your compliance consultant or counsel how these rules apply to your firm.

## How should an advisory firm verify client instructions?

Verify every request to move money to a new place through a channel the requester didn't choose. A practical procedure:

1. **Record a verified phone number** for each client at onboarding, and treat changes to it with the same suspicion as a bank change.
2. **Call back on that number** before any wire or transfer to a new or third-party account, even for "urgent" requests and even if the email thread looks genuine.
3. **Ask a question the email can't answer**, such as the purpose of a previous transaction, if the voice or request feels off.
4. **Require a second person** in operations to approve first-time third-party wires.
5. **Never accept changes to contact details** and money movement in the same request.
6. **If money has gone**, contact the receiving bank and custodian immediately and file at [ic3.gov](https://www.ic3.gov). FINRA's [compromised accounts checklist](https://www.finra.org/rules-guidance/key-topics/customer-information-protection/firm-checklist-compromised-accounts) says to report to IC3, particularly when trying to recall a wire sent outside the United States, and to state securities regulators.

Our [business email compromise prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) covers the wider controls, and [AI voice cloning and deepfake BEC](https://iblockspam.com/blog/ai-voice-cloning-deepfake-bec) explains why a call alone isn't proof if the number came from the email.

## Is Microsoft 365 or Google Workspace security enough for an RIA?

For a small registered investment adviser (RIA), Microsoft 365 or Google Workspace with MFA enforced, external sender tags and stricter anti-phishing settings is a sound baseline, and the SEC cases above show that applying protections to every account matters more than any single product. FINRA's 2026 report lists "Use multi-factor authentication (MFA) for login access to the firm's systems, including email" among effective practices. Start there. For the general case, see [do you need a spam filter with Microsoft 365?](https://iblockspam.com/blog/do-i-need-a-spam-filter-with-microsoft-365).

An MX-level filter adds an independent check before mail reaches advisers. **MX records** are the DNS entries that tell the internet where to deliver your domain's mail; pointing them at a filtering service means each message is checked first. That's useful when:

- phishing aimed at advisers and assistants keeps reaching inboxes
- you want approved sender lists that verify the sender, so a spoofed custodian address doesn't bypass filtering
- you want to block risky attachments and Office macros without writing mail flow rules
- you want mail held, not bounced, if your mail platform is unreachable

Before you add any filter, check how it fits your email archiving and recordkeeping process with your compliance officer; see [email archiving vs backup](https://iblockspam.com/blog/email-archiving-vs-backup). Our comparison of [Microsoft 365 built-in protection vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) sets out what each layer does.

## How do you stop criminals impersonating your firm to clients?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. **DMARC** is a DNS record telling receivers what to do with mail that claims to come from your domain but fails SPF and DKIM. Include your CRM, newsletter service and any portal that emails clients. A record at enforcement looks like this example:

```
_dmarc.example-wealth.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-wealth.com"
```

Our [DMARC from none to reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the rollout. DMARC doesn't block lookalike domains, so pair it with monitoring and a clear message to clients: "We will never ask you to send money or change account details by email alone."

## Financial advisor email security checklist

1. Enforce MFA on every mailbox, including assistants, part-time staff and outside contractors.
2. Write down your client call-back rule for wires and contact detail changes.
3. Update your incident response program so it covers a compromised mailbox: who investigates, how you find what client data was exposed, and who decides on notice.
4. Ask your email, archiving and filtering providers how and when they'd notify you of a breach.
5. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
6. Search for your advisers' names and firm name regularly to catch imposter domains.
7. Check mailboxes for forwarding rules you didn't create.
8. Keep client documents out of email where you can, using a secure portal instead.
9. Train staff on fake custodian, regulator and document-share emails.

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your firm's domain to see your MX, SPF and DMARC setup.
- Review your incident response program against the amended Regulation S-P with your compliance consultant.
- Brief clients on how you verify instructions, in your next newsletter or onboarding pack.
- If you're weighing an extra filtering layer, start with [Microsoft 365 built-in vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway). iBlockSpam prices per domain, so adding an assistant or associate adviser doesn't change the bill.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do criminals use email to steal from investment clients?

The usual method is a fake client instruction. A criminal takes over or spoofs a client's email address, then asks the adviser to wire money to a new third-party account, often citing urgency. FINRA calls this account impersonation. Another method is taking over the adviser's own mailbox and reading client details from it. Call the client back on a known number before any wire.

### What does amended Regulation S-P require for a hacked adviser mailbox?

It requires an incident response program to detect, respond to and recover from unauthorized access to customer information, and notice to affected individuals as soon as practicable, but not later than 30 days after becoming aware, when sensitive customer information was or is reasonably likely to have been accessed. Exceptions apply. Ask your compliance counsel how it applies.

### When did small investment advisers have to comply with the Regulation S-P amendments?

The SEC set June 3, 2026 for smaller entities and December 3, 2025 for larger entities. Both dates have passed at the time of writing (October 2026), so the incident response, service provider and notification requirements now apply to SEC-registered advisers. State-registered advisers should check their state's rules.

### Did the SEC fine firms over phished email accounts?

Yes. In August 2021 the SEC sanctioned eight broker-dealer and advisory firms in three actions after cloud email accounts of their personnel were taken over, exposing personal information of thousands of clients. Penalties were $300,000, $250,000 and $200,000. The SEC said a written policy isn't enough if its security requirements aren't implemented.

### Should an advisory firm worry about fake websites using its advisers' names?

Yes. FINRA has warned of imposter sites that use a representative's name as the domain, and can send fake emails from it with phishing links or malware. Search the web for your advisers' names regularly, report imposter sites to the registrar and host, and warn clients not to trust emails from the imposter domain.

## Sources

- [SEC press release 2021-169: SEC Announces Three Actions Charging Deficient Cybersecurity Procedures (August 30, 2021)](https://www.sec.gov/newsroom/press-releases/2021-169)
- [SEC press release 2024-58: SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information (May 16, 2024)](https://www.sec.gov/newsroom/press-releases/2024-58)
- [SEC: Enhancements to Regulation S-P, A Small Entity Compliance Guide](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf)
- [FINRA: 2026 Annual Regulatory Oversight Report, Cybersecurity and Cyber-Enabled Fraud](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/cybersecurity)
- [FINRA Regulatory Notice 20-30: Fraudsters Using Registered Representatives Names to Establish Imposter Websites (August 2020)](https://www.finra.org/rules-guidance/notices/20-30)
- [FINRA: Firm Checklist for Compromised Accounts](https://www.finra.org/rules-guidance/key-topics/customer-information-protection/firm-checklist-compromised-accounts)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-financial-advisors (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt