# Email security for insurance agencies: the risks and the rules

URL: https://iblockspam.com/blog/email-security-for-insurance-agencies
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for insurance agencies: carrier portal phishing, fake NIPR invoices, premium payment fraud, and what state data security laws expect.

## Short answer

Insurance agencies are targeted because their inboxes hold policyholder data and carrier portal logins, and premiums, claims and commissions move on email instructions. The main risks are fake carrier and licensing emails, mailbox takeover and payment redirection. Many states also require a written security program. Turn on MFA, publish DMARC, filter inbound mail and verify every payment change by phone.

An insurance agency's inbox is full of things criminals want: policyholder applications, driver's license numbers, bank details for premium drafts, and the logins for a dozen carrier portals. Money also moves on email, from premium payments and claim checks to commission deposits. This guide covers the email threats specific to agencies, what state insurance data security rules expect, and a checklist for producers and customer service staff.

## Why are insurance agencies targeted by email attacks?

Insurance agencies are targeted because they combine sensitive client data, many third-party logins and regular payments, usually without a security team. A typical independent agency works with many carriers, each with its own portal, and staff sign in to those portals from links and notices that arrive by email. A fake "carrier portal" email is therefore routine-looking and high value.

Three features of agency work make it easy to exploit:

- **Many trusted senders.** Carriers, premium finance companies, the agency management system vendor, state insurance departments and licensing services all send notices that ask you to sign in or pay.
- **Rich client files.** Applications and quotes contain dates of birth, license numbers, health details for life and health lines, and bank account details. Those files sit in mailboxes as attachments.
- **Money on instructions.** Clients pay premiums, carriers pay commissions and claimants receive payments based on details that are often confirmed by email.

The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses across all industries ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). **BEC** is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money or data.

## What email scams target insurance agents?

Agencies see general phishing plus lures built around licensing, carriers and payments. The table lists the most common and the safe way to check each.

| Scam | What arrives | Who it targets | How to check |
|---|---|---|---|
| Fake carrier portal notice | "Your agent portal password expires" or "new commission statement available" | Producers, CSRs | Open the portal from a bookmark |
| Fake licensing or regulator invoice | A past-due invoice "from" NIPR or a state insurance department | Agency principal, licensing staff | Verify with the sender's official website contact |
| Commission or payee change | A carrier or partner "updating" where commissions go | Agency owner, bookkeeper | Call the carrier's agency services line |
| Premium payment redirection | Clients get "new payment instructions" from a lookalike of your domain | Your clients | DMARC, plus a written payment policy |
| Claim payment redirection | A claimant or body shop "changes" bank details for a payout | Claims staff | Call on a number from the claim file |
| Malicious attachments | "ACORD form", "loss runs" or "declarations page" files that lead to a sign-in page | Anyone | Block risky file types; confirm unexpected files |

**Loss runs** are a carrier's claim history reports for an insured, and **ACORD forms** are the standard insurance industry forms agencies exchange daily. Both are normal attachments, which is why criminals use their names.

### Fake licensing invoices

In April 2026 the Nebraska Department of Insurance warned agents about fraudulent emails impersonating NIPR, the National Insurance Producers Registry, that claimed "past due invoices" and asked for payment ([Nebraska DOI](https://doi.nebraska.gov/node/2261)). The department said the emails may appear to come from trusted domains such as "@nipr.com, @naic.org, or @stripe", and told agents who receive one to "stop immediately and take no action": don't open attachments, click links or pay. A message like this example is a classic of the type:

> Example: "Dear Customer, our records show 2 past due invoices on your producer account. To avoid interruption of your license services, please review the attached statement and remit payment within 48 hours."

### Mailbox takeover and thread hijacking

When a producer's mailbox is phished, the attacker can read every client thread and reply inside it. They may send a client "updated" payment instructions in a real conversation about a renewal, or ask a carrier to change where a payout goes. Our guide to [email thread hijacking](https://iblockspam.com/blog/email-thread-hijacking) explains the technique, and [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) shows the forwarding rules attackers add to stay hidden.

Many phishing kits now steal the session after you approve MFA. See [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) for why phishing-resistant MFA matters for staff who sign in to many portals.

## What do state insurance data security laws require for email?

Many states have enacted a version of the NAIC Insurance Data Security Model Law, which requires licensees, including agents and agencies, to run an information security program and report cybersecurity events to the insurance commissioner. The NAIC is the National Association of Insurance Commissioners. Its [model law (#668)](https://content.naic.org/sites/default/files/model-law-668.pdf) defines a licensee as any person licensed or required to be licensed under the state's insurance laws, with narrow exceptions. Provisions that touch email include:

| Model law provision | What it says | What it means for email |
|---|---|---|
| Section 4 (security program) | Use "effective controls, which may include Multi-Factor Authentication procedures for any individual accessing Nonpublic Information" | MFA on mailboxes that hold client data |
| Section 4 (security program) | Protect "by encryption or other appropriate means" all nonpublic information transmitted over an external network | A plan for sending client files securely |
| Section 5 (investigation) | Investigate a cybersecurity event promptly | A process for checking a compromised mailbox |
| Section 6 (notification) | Notify the commissioner "as promptly as possible but in no event later than 72 hours" after determining an event occurred, when the law's criteria are met | Know who reports a mailbox breach, and how fast |
| Section 9 (exceptions) | A licensee "with fewer than ten employees, including any independent contractors, is exempt from Section 4" | Small agencies may be exempt from the program, not from reporting |

States change the model when they adopt it, so your state's law is what counts. Your state insurance department publishes the version that applies to you.

### New York agencies and 23 NYCRR Part 500

New York licensees are covered by the Department of Financial Services (DFS) cybersecurity regulation, [23 NYCRR Part 500](https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500). DFS says that starting on November 1, 2025, covered entities must "use MFA for any individual accessing any of its information systems", with two exceptions ([DFS MFA guidance](https://www.dfs.ny.gov/industry-guidance/cybersecurity/multifactor-authentication)). One is for entities that qualify for the limited exemption in section 500.19(a). Those must still use MFA for remote access to their own systems, for remote access to third-party applications, "including but not limited to those that are cloud based", from which nonpublic information is accessible, and for privileged accounts. In our reading, cloud email that holds client files fits that description, but DFS doesn't name email specifically, so confirm it with counsel.

This is general information, not legal advice. Ask your counsel or compliance adviser which rules apply to your agency and in which states you hold licenses.

## How do you stop premium and claim payment fraud?

Stop payment fraud with a rule that no payment detail changes on the strength of an email. The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3 PSA I-091124-PSA](https://www.ic3.gov/PSA/2024/PSA240911)). For an agency, that becomes:

1. **Tell clients how you collect premiums** at onboarding and on every invoice: "We will never change our payment details by email."
2. **Never change a payee on an email or PDF.** For claim payouts, commissions and refunds, call the person on a number already in your file.
3. **Require a second person** to approve any payee change and any agency trust account payment above a set amount.
4. **Check the full sender address** on every payment message, especially on a phone, where only the display name may show.
5. **If money has gone**, call your bank for a recall at once and file at [ic3.gov](https://www.ic3.gov). The FBI says time is of the essence.

Our [vendor invoice fraud guide](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) has the full call-back procedure.

## Is Microsoft 365 or Google Workspace security enough for an agency?

For a small agency, Microsoft 365 or Google Workspace with MFA turned on, stricter anti-phishing policies and external sender tags is a reasonable baseline, and many agencies start there. Check those settings before you buy anything. Our guides to [Microsoft 365 anti-phishing policy settings](https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings) and [Gmail spam settings in Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace) explain what to change. For the general case, see [do you need a spam filter with Microsoft 365?](https://iblockspam.com/blog/do-i-need-a-spam-filter-with-microsoft-365).

An MX-level filter in front of your mailboxes adds an independent check before mail reaches staff. **MX records** are the DNS entries that tell the internet where to deliver mail for your domain; pointing them at a filtering service means it checks every message first. That helps an agency when:

- carrier-themed phishing keeps getting through to producers and CSRs
- you want to block risky attachments and Office macros from outside senders without maintaining mail flow rules
- you want approved sender lists that also check the sender is genuine, so a spoofed carrier address doesn't skip filtering
- staff need to release held renewals and quotes themselves, from a quarantine digest

It doesn't replace MFA, a written security program or your payment rule. For agencies, iBlockSpam prices [per domain rather than per user](https://iblockspam.com/solutions/small-business), so adding producers or seasonal CSRs doesn't change the bill.

## How do you protect clients from fake emails in your agency's name?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. **DMARC** is a DNS record that tells receiving servers what to do with mail claiming to be from your domain that fails SPF and DKIM. Include your agency management system and any service that sends renewals or statements for you. A record at enforcement looks like this example:

```
_dmarc.example-agency.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-agency.com"
```

CISA's joint phishing guidance asks organizations to "ensure DMARC is set to 'reject' for sent emails" ([CISA](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)). Start at `p=none`, fix any service that fails, then enforce. Our [DMARC from none to reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the steps. For lookalike domains such as `example-agencyins.com`, see [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## Insurance agency email security checklist

1. Turn on MFA for every mailbox and every carrier portal that supports it, starting with the principal and anyone who handles payments.
2. Find out whether your state has enacted the NAIC model law, or whether 23 NYCRR Part 500 applies, and who in the agency would report a cybersecurity event.
3. Write down your payment change rule and send it to clients, carriers and partners.
4. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
5. Block risky attachment types and Office macros from outside senders. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
6. Send client files through a secure method instead of plain attachments. See [email encryption types for business](https://iblockspam.com/blog/email-encryption-types-for-business).
7. Check mailboxes for forwarding rules you didn't create.
8. Train producers and CSRs on fake carrier and licensing invoices, and give them one way to report a suspicious email.
9. Remove access promptly when a producer leaves. See [employee offboarding](https://iblockspam.com/blog/employee-offboarding-email-security).

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your agency's domain to see your MX, SPF and DMARC setup.
- Ask your state insurance department or counsel which data security law applies to your agency.
- Review the basics in the [small business email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business).
- If you want a filtering layer in front of Microsoft 365 or Google Workspace, see how iBlockSpam works for [small businesses](https://iblockspam.com/solutions/small-business). Unlimited mailboxes means mailbox count, not message volume: each domain includes 100,000 inbound messages a month.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why are insurance agents targeted by phishing emails?

Agents hold policyholders' personal and financial details and sign in to many carrier portals with email-based logins. Premium payments, claim checks and commissions also move on emailed instructions. A single stolen password can expose client files or redirect money, and small agencies rarely have security staff watching for it.

### Are emails from NIPR asking agents to pay a past-due invoice real?

Treat them as suspicious. In April 2026 the Nebraska Department of Insurance warned of fraudulent past-due invoice emails impersonating NIPR, the National Insurance Producers Registry, that could appear to come from trusted domains. Don't click or pay from the email. Verify with NIPR directly, using contact details from its official website.

### Does the NAIC Insurance Data Security Model Law apply to small agencies?

It depends on your state's version. The NAIC model exempts licensees with fewer than ten employees, including independent contractors, from its information security program section, but not from the other sections, such as investigating and reporting cybersecurity events. States adapt the model when they enact it, so check your state's law and ask your adviser.

### How can an insurance agency stop fake premium payment emails sent to its clients?

Publish SPF, DKIM and a DMARC policy of quarantine or reject so that mail faking your exact domain fails. Tell clients in writing how you collect premiums and that you never change payment details by email. Watch for lookalike domains of your agency name, because DMARC can't block those.

### Do New York insurance agents need MFA on email?

New York DFS says that from November 1, 2025, covered entities must use MFA for any individual accessing any of their information systems, with limited exceptions. Agencies that qualify for the 500.19(a) limited exemption must still use MFA for remote access, including to cloud-based third-party applications from which nonpublic information is accessible. Confirm your own status with counsel.

## Sources

- [NAIC: Insurance Data Security Model Law (#668), 2017](https://content.naic.org/sites/default/files/model-law-668.pdf)
- [New York DFS: Multi-Factor Authentication Requirements under 23 NYCRR Part 500 (July 2025)](https://www.dfs.ny.gov/industry-guidance/cybersecurity/multifactor-authentication)
- [New York DFS: Cybersecurity Regulation 23 NYCRR Part 500](https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500)
- [Nebraska Department of Insurance: Fraudulent emails sent to agents requesting payment, impersonating NIPR (April 10, 2026)](https://doi.nebraska.gov/node/2261)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-insurance-agencies (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt