Insurance brokerages and agencies

A brokerage is a concentrated store of exactly what fraudsters want: names, addresses, dates of birth, licence numbers, vehicle and property details, banking information for pre-authorized payments, and often claims and health information. It is also a business that sends and receives payment instructions by email all day, with clients, carriers and premium finance companies.

That combination makes brokerages attractive for business email compromise. A compromised producer mailbox can be used to send clients 'updated' payment instructions, to harvest documents from years of correspondence, or to request changes from carriers that look routine.

Most brokerages outside Quebec, Alberta and BC fall under PIPEDA for client information. Schedule 1 sets out the fair information principles, and the safeguards principle requires security protections appropriate to the sensitivity of the information. If a breach creates a real risk of significant harm, the brokerage must report it to the Office of the Privacy Commissioner of Canada and notify affected clients as soon as feasible, and keep a record of every breach for 24 months.

• Know where client data lives: broker management system, email, shared drives, scanned documents, personal devices
• Limit who can export full client lists
• Encrypt laptops and phones that carry client email
• Keep breach records even for incidents you decide not to report

Brokerages log into many carrier and quoting portals, and shared logins are common because they are convenient. Shared credentials mean you cannot tell who did what, cannot cut off one departing employee without disrupting everyone, and often cannot turn on multi-factor authentication properly.

We help brokerages move to named accounts wherever carriers allow it, store any unavoidable shared credentials in a business password manager with access logs, and put MFA on email, the broker management system and remote access first, since those are the doors attackers use.

Technology helps, but most payment fraud is stopped by procedure. The Canadian Anti-Fraud Centre collects reports of fraud and cybercrime, and the pattern is consistent: a convincing email, a changed bank account, urgency. Controls that work:

If client information may have been exposed, see privacy breach assessment and notification.

1. 01

   Never change banking details on email alone

   Call the client or carrier back on a number already on file, not one in the message.

2. 02

   Hold first-time and changed payees

   Second-person approval before money moves to new account details.

3. 03

   Warn clients

   Tell clients in onboarding materials that you will never change payment instructions by email.

4. 04

   Lock down mailboxes

   Alerts on new forwarding rules and sign-ins from unusual locations; DMARC on your domain so others cannot spoof it.

A one-page plan beats a binder. Know who decides, who calls your errors-and-omissions and cyber insurers, who calls counsel, and how you will reach staff if email is down. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations start with developing an incident response plan for this reason. Keep a printed contact sheet and practise a business email compromise scenario once a year.

• Help desk and device management for producers, CSRs and remote staff
• Microsoft 365 or Google Workspace hardening, including MFA and mailbox-rule monitoring
• Email authentication (SPF, DKIM, DMARC) to stop spoofing of your domain
• Backups of mailboxes and shared files, tested
• Investigation when something goes wrong: 24/7 incident line (289) 582-9930
• Fees are quoted per engagement; ask about managed plans