Email security for insurance agencies: the risks and the rules

An insurance agency's inbox is full of things criminals want: policyholder applications, driver's license numbers, bank details for premium drafts, and the logins for a dozen carrier portals. Money also moves on email, from premium payments and claim checks to commission deposits. This guide covers the email threats specific to agencies, what state insurance data security rules expect, and a checklist for producers and customer service staff.

Why are insurance agencies targeted by email attacks?

Insurance agencies are targeted because they combine sensitive client data, many third-party logins and regular payments, usually without a security team. A typical independent agency works with many carriers, each with its own portal, and staff sign in to those portals from links and notices that arrive by email. A fake "carrier portal" email is therefore routine-looking and high value.

Three features of agency work make it easy to exploit:

• Many trusted senders. Carriers, premium finance companies, the agency management system vendor, state insurance departments and licensing services all send notices that ask you to sign in or pay.
• Rich client files. Applications and quotes contain dates of birth, license numbers, health details for life and health lines, and bank account details. Those files sit in mailboxes as attachments.
• Money on instructions. Clients pay premiums, carriers pay commissions and claimants receive payments based on details that are often confirmed by email.

The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses across all industries (IC3 2025 report). BEC is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money or data.

What email scams target insurance agents?

Agencies see general phishing plus lures built around licensing, carriers and payments. The table lists the most common and the safe way to check each.

Loss runs are a carrier's claim history reports for an insured, and ACORD forms are the standard insurance industry forms agencies exchange daily. Both are normal attachments, which is why criminals use their names.

Fake licensing invoices

In April 2026 the Nebraska Department of Insurance warned agents about fraudulent emails impersonating NIPR, the National Insurance Producers Registry, that claimed "past due invoices" and asked for payment (Nebraska DOI). The department said the emails may appear to come from trusted domains such as "@nipr.com, @naic.org, or @stripe", and told agents who receive one to "stop immediately and take no action": don't open attachments, click links or pay. A message like this example is a classic of the type:

Example: "Dear Customer, our records show 2 past due invoices on your producer account. To avoid interruption of your license services, please review the attached statement and remit payment within 48 hours."

Mailbox takeover and thread hijacking

When a producer's mailbox is phished, the attacker can read every client thread and reply inside it. They may send a client "updated" payment instructions in a real conversation about a renewal, or ask a carrier to change where a payout goes. Our guide to email thread hijacking explains the technique, and malicious inbox rules shows the forwarding rules attackers add to stay hidden.

Many phishing kits now steal the session after you approve MFA. See adversary-in-the-middle phishing for why phishing-resistant MFA matters for staff who sign in to many portals.

What do state insurance data security laws require for email?

Many states have enacted a version of the NAIC Insurance Data Security Model Law, which requires licensees, including agents and agencies, to run an information security program and report cybersecurity events to the insurance commissioner. The NAIC is the National Association of Insurance Commissioners. Its model law (#668) defines a licensee as any person licensed or required to be licensed under the state's insurance laws, with narrow exceptions. Provisions that touch email include:

States change the model when they adopt it, so your state's law is what counts. Your state insurance department publishes the version that applies to you.

New York agencies and 23 NYCRR Part 500

New York licensees are covered by the Department of Financial Services (DFS) cybersecurity regulation, 23 NYCRR Part 500. DFS says that starting on November 1, 2025, covered entities must "use MFA for any individual accessing any of its information systems", with two exceptions (DFS MFA guidance). One is for entities that qualify for the limited exemption in section 500.19(a). Those must still use MFA for remote access to their own systems, for remote access to third-party applications, "including but not limited to those that are cloud based", from which nonpublic information is accessible, and for privileged accounts. In our reading, cloud email that holds client files fits that description, but DFS doesn't name email specifically, so confirm it with counsel.

This is general information, not legal advice. Ask your counsel or compliance adviser which rules apply to your agency and in which states you hold licenses.

How do you stop premium and claim payment fraud?

Stop payment fraud with a rule that no payment detail changes on the strength of an email. The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). For an agency, that becomes:

1. Tell clients how you collect premiums at onboarding and on every invoice: "We will never change our payment details by email."
2. Never change a payee on an email or PDF. For claim payouts, commissions and refunds, call the person on a number already in your file.
3. Require a second person to approve any payee change and any agency trust account payment above a set amount.
4. Check the full sender address on every payment message, especially on a phone, where only the display name may show.
5. If money has gone, call your bank for a recall at once and file at ic3.gov. The FBI says time is of the essence.

Our vendor invoice fraud guide has the full call-back procedure.

Is Microsoft 365 or Google Workspace security enough for an agency?

For a small agency, Microsoft 365 or Google Workspace with MFA turned on, stricter anti-phishing policies and external sender tags is a reasonable baseline, and many agencies start there. Check those settings before you buy anything. Our guides to Microsoft 365 anti-phishing policy settings and Gmail spam settings in Google Workspace explain what to change. For the general case, see do you need a spam filter with Microsoft 365?.

An MX-level filter in front of your mailboxes adds an independent check before mail reaches staff. MX records are the DNS entries that tell the internet where to deliver mail for your domain; pointing them at a filtering service means it checks every message first. That helps an agency when:

• carrier-themed phishing keeps getting through to producers and CSRs
• you want to block risky attachments and Office macros from outside senders without maintaining mail flow rules
• you want approved sender lists that also check the sender is genuine, so a spoofed carrier address doesn't skip filtering
• staff need to release held renewals and quotes themselves, from a quarantine digest

It doesn't replace MFA, a written security program or your payment rule. For agencies, iBlockSpam prices per domain rather than per user, so adding producers or seasonal CSRs doesn't change the bill.

How do you protect clients from fake emails in your agency's name?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. DMARC is a DNS record that tells receiving servers what to do with mail claiming to be from your domain that fails SPF and DKIM. Include your agency management system and any service that sends renewals or statements for you. A record at enforcement looks like this example:

_dmarc.example-agency.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-agency.com"

CISA's joint phishing guidance asks organizations to "ensure DMARC is set to 'reject' for sent emails" (CISA). Start at p=none, fix any service that fails, then enforce. Our DMARC from none to reject guide covers the steps. For lookalike domains such as example-agencyins.com, see lookalike domain phishing.

Insurance agency email security checklist

1. Turn on MFA for every mailbox and every carrier portal that supports it, starting with the principal and anyone who handles payments.
2. Find out whether your state has enacted the NAIC model law, or whether 23 NYCRR Part 500 applies, and who in the agency would report a cybersecurity event.
3. Write down your payment change rule and send it to clients, carriers and partners.
4. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
5. Block risky attachment types and Office macros from outside senders. See dangerous email attachment types.
6. Send client files through a secure method instead of plain attachments. See email encryption types for business.
7. Check mailboxes for forwarding rules you didn't create.
8. Train producers and CSRs on fake carrier and licensing invoices, and give them one way to report a suspicious email.
9. Remove access promptly when a producer leaves. See employee offboarding.

Next steps

• Run the free Email Health Check on your agency's domain to see your MX, SPF and DMARC setup.
• Ask your state insurance department or counsel which data security law applies to your agency.
• Review the basics in the small business email security checklist.
• If you want a filtering layer in front of Microsoft 365 or Google Workspace, see how iBlockSpam works for small businesses. Unlimited mailboxes means mailbox count, not message volume: each domain includes 100,000 inbound messages a month.

More threat guides are in our phishing and threats topic.