TL;DR
Business Email Compromise (BEC), not ransomware, is the leading financial threat to advisors, RIAs, and broker-dealers. Financial services was the #1 breached industry in 2025 (ITRC, via American Banker: https://www.americanbanker.com/news/itrc-2025-data-breach-report). The FBI reported over $2.9 billion in BEC losses in 2023 alone (FBI IC3: https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf). And as of June 3, 2026, the SEC’s updated Reg S-P requires small firms to have a written incident response program in place. If you’re not thinking about BEC, your clients are at risk, and so is your compliance posture. Table of Contents
- The Threat Everyone’s Ignoring
- What is BEC?
- Why Financial Advisors Are Prime Targets
- Real Attack Scenarios: How BEC Plays Out
- What Are Attackers Really After?
- Technical Controls That Block BEC
- Human Controls: Process Over Technology
- The SEC and FINRA Compliance Angle
- The Role of a vCIO in Your Defense
- FAQ
- Next Step: Download the BEC Attack Prevention Checklist
The Threat Everyone’s Ignoring
When financial advisors think about cybersecurity, ransomware usually tops the list. It’s dramatic. It shuts down systems. It makes headlines.
But here’s what’s quietly draining accounts, destroying client relationships, and creating regulatory nightmares for firms just like yours:
Business Email Compromise
Financial services reported more data breaches than any other industry in 2025, 739 in total, topping the list for the second year running (via American Banker). And within those attacks, BEC is a top loss driver. Not ransomware.
Email Fraud
The FBI’s Internet Crime Complaint Center (IC3) documented $2.9 billion in BEC losses in 2023 alone. That number likely undercounts actual damage. Many incidents go unreported out of embarrassment, client fear, or regulatory concern.
If you’re a financial advisor, RIA, or broker-dealer, BEC isn’t a hypothetical. It’s the attack most likely to hit your firm, and the one you’re least prepared for.
What is BEC?
Let’s be clear about what we’re talking about.
Business Email Compromise is a targeted social engineering attack. An attacker either compromises a legitimate email account or convincingly spoofs one, then uses it to manipulate people into sending money, sharing sensitive data, or changing account credentials.
It’s not a virus. It’s not malware (usually). It’s scaled deception. How it works:
- Attacker researches your firm: clients, relationships, transaction patterns, key personnel
- Attacker compromises or spoofs a trusted email address (yours, your client’s, or a custodian’s)
- A seemingly routine request arrives: a wire transfer, an account update, a document request
- No one questions it. The email looks right. The name looks right. The request seems normal.
- Money moves. Data leaves. The fraud is discovered days or weeks later.
By the time anyone realizes what happened, the damage is done. Wire transfers are difficult to reverse. Client data, once out, can’t be recalled.
Why Financial Advisors are Prime Targets
Criminals go where the money is. But BEC attackers are more sophisticated than that. They go where trust and money cross paths.
That’s your firm.
Three factors make financial advisors uniquely vulnerable:
You Handle Large Wire Transfers Regularly
Advisors routinely facilitate fund movements for clients. Attackers know this. A spoofed email from ‘you’ to a client asking them to wire funds to a new account fits the pattern of normal business. Clients trust you. They don’t always verify.
Your Clients Have a Fiduciary Relationship With You
That fiduciary duty is your greatest professional asset. It’s also what attackers exploit. Clients are conditioned to follow your guidance, act on your recommendations, and respond to your requests, often without additional verification.
Your Inbox Is an Intelligence Asset
Think about what lives in your email: client net worth, account numbers, beneficiary designations, transaction histories, life event data. An attacker who compromises your email account doesn’t just get your contacts. They get a complete financial profile of every client you serve.
The majority of finance organizations hit by a cyberattack experience at least one successful breach, and BEC is the delivery mechanism for many of them.
Real Attack Scenarios: How BEC Plays Out
These aren’t theoretical. These scenarios play out every day across financial services firms.
Scenario 1: Wire Transfer Fraud
An attacker compromises the email account of a senior advisor. They monitor the inbox for weeks, learning client names, transaction patterns, communication style. When a client requests a large fund transfer, the attacker intercepts and replies first, slightly changing the destination account. The client, seeing what appears to be their advisor’s email, initiates the transfer. The advisor has no idea until the client calls to confirm receipt.
Scenario 2: Account Takeover via Credential Phishing
A staff member receives what appears to be a DocuSign notification or a custodian portal login prompt. They enter credentials. Attacker now has access to the firm’s email system. Over the next several days, they study the firm’s client list and begin targeting high-net-worth clients with spoofed emails requesting account updates.
Scenario 3: Invoice Fraud
An attacker spoofs a vendor or technology partner’s email address and sends an updated invoice with revised banking details. Accounts payable, or the advisor handling the relationship, processes the payment to the fraudulent account. The legitimate vendor follows up weeks later wondering why payment hasn’t arrived.
Scenario 4: Client Impersonation
An attacker compromises a client’s personal email account and monitors their inbox. When they see conversations with your firm about a pending transaction, they send an email to your staff impersonating the client, with slightly different instructions. Staff, believing it’s the client, act on the request.
What Are Attackers Really After?
Three primary targets drive BEC attacks on financial services:
1. Client Funds
The most direct objective. Wire transfers, distribution requests, account withdrawals. Attackers prefer wire transfers: fast, difficult to reverse, and increasingly normalized in advisor communications.
2. Client Data
Social security numbers, account numbers, beneficiary information, tax documents. This data enables follow-on fraud: identity theft, account takeover at the custodian level, synthetic identity creation.
3. Account Credentials
Gaining persistent access to email systems allows attackers to operate undetected for weeks or months, studying patterns, waiting for the right moment, intercepting communications, and even deleting evidence of their activity.
Technical Controls That Block BEC
Technology alone doesn’t stop BEC, but without the right technical controls, you’re leaving the door open. Here’s what actually works:
Multi-Factor Authentication (MFA)
This is non-negotiable. If MFA isn’t enabled on every email account, including shared mailboxes and service accounts, your email system is exposed. MFA stops credential-based account compromise, which is the entry point for most BEC attacks. Use app-based authenticators or hardware keys. SMS-based MFA is better than nothing but is vulnerable to SIM swapping.
Email Authentication: SPF, DKIM, and DMARC
These three protocols work together to verify that emails claiming to come from your domain are actually from your domain.
- SPF (Sender Policy Framework): Defines which mail servers are authorized to send on your behalf
- DKIM (DomainKeys Identified Mail): Cryptographically signs outbound emails to verify they haven’t been tampered with
- DMARC (Domain-based Message Authentication): Tells receiving mail servers what to do when SPF or DKIM fails, and gives you visibility into spoofing attempts.
Without DMARC set to ‘reject’ or ‘quarantine,’ attackers can convincingly spoof your email domain. Many firms have SPF and DKIM in place but no DMARC policy, leaving a significant gap.
Advanced Email Security Gateways
Microsoft 365 Defender, Proofpoint, Mimecast, and similar platforms provide AI-driven threat detection that goes beyond basic spam filtering. They flag lookalike domains (arakyta.com vs. arakyta-support.com), impersonation attempts, and unusual sending patterns, and can quarantine suspicious messages before they reach inboxes.
Conditional Access Policies
Block email access from unmanaged devices or unfamiliar locations. If someone’s credentials are stolen, conditional access policies can prevent login from a foreign IP or unrecognized device, limiting the attacker’s ability to use those credentials.
Privileged Access Management (PAM)
Not every user needs admin-level access. Limiting privileges reduces the blast radius when a credential is compromised. An attacker who gains access to a standard user account has far less ability to cause damage than one who gains admin access.
Human Controls: Process Over Technology
Here’s the uncomfortable truth: technical controls can be bypassed by human behavior. The most effective BEC prevention programs combine technology with process.
Wire Transfer Verification Protocols
Every wire transfer request, regardless of source, should require verbal confirmation via a pre-established phone number. Not the number in the email. Not the number in a new message. A number you already have on file. This single control has prevented more BEC losses than almost any other measure. It’s simple. It’s manual. It works.
Callback Procedures for Account Changes
Any request to change banking information, account details, or beneficiary designations should trigger a mandatory callback. Staff should be trained to recognize this category of request as high-risk, and to never act on it without voice confirmation.
Staff Training and Simulation
Phishing simulations and security awareness training, delivered regularly, not annually, change behavior. Staff who have clicked a simulated phishing link and seen the immediate consequence are more likely to pause before clicking a real one. Training should include BEC-specific scenarios, not just generic phishing.
Dual Authorization for Transactions
For transactions above a defined threshold, require two authorized individuals to approve. This adds friction, intentionally. Friction stops fraud.
The SEC and FINRA Compliance Angle
If you’re an RIA, broker-dealer, or investment adviser, this isn’t just a security conversation. It’s a regulatory one.
The SEC’s updated Regulation S-P, Safeguards Rule, went into effect June 3, 2026 for small firms. Among other requirements, it mandates:
A written incident response program
Procedures for notifying customers of data breaches involving their personal information
Documentation of your data security policies and access controls
FINRA Rule 4370 requires business continuity planning that includes cybersecurity considerations. FINRA’s cybersecurity examination checklist increasingly focuses on email security controls and employee training programs.
Here’s the reality: examiners aren’t just asking whether you have cybersecurity controls. They’re asking to see them. Written policies. Documented procedures. Training records. Incident response plans.
A BEC attack that isn’t preceded by documented security controls isn’t just a financial loss. It’s a compliance failure. That failure can result in regulatory action, fines, and reputational damage that outlasts the financial loss itself.
The Role of a vCIO in Building a Defensible Compliance Posture
Most financial advisory firms don’t have a full-time IT security leader. A Chief Information Officer with financial services regulatory expertise can run an estimated $200,000 to $450,000 per year in fully-loaded compensation. That’s not realistic for a 10-person RIA or a boutique broker-dealer. That’s exactly where a vCIO, Virtual Chief Information Officer, fills the gap. A vCIO from Arakÿta does more than manage your IT infrastructure. They:
- Build and maintain your written information security program (WISP), a foundational document for SEC and FINRA compliance
- Conduct risk assessments that surface BEC vulnerabilities before an examiner does
- Implement and document technical controls (MFA, DMARC, email security gateways) with audit-ready documentation
- Develop and run staff security awareness training programs
- Build incident response plans that meet Reg S-P requirements
- Serve as a point of contact for regulatory inquiries
The difference between a firm that survives an SEC examination and one that doesn’t often comes down to documentation and process. A vCIO builds both.
Arakÿta also provides continuous environment monitoring, flagging anomalies in real time so that threats like BEC don’t go undetected for weeks.
FAQ
Is BEC different from phishing?
Yes. Phishing is broad. It tries to trick many people with a generic lure. BEC is targeted. Attackers research your firm, your clients, and your communication patterns before striking. That’s what makes it so effective and so difficult to detect.
Does cyber insurance cover BEC losses?
It depends on your policy and the specific circumstances. Many policies cover BEC losses, but coverage often requires you to demonstrate that you had reasonable security controls in place. A firm with no MFA, no DMARC, and no wire verification procedures may face coverage disputes. Check your policy, and close the gaps before you need to file a claim.
How do I know if my email is already configured correctly?
A quick DNS lookup of your domain’s SPF, DKIM, and DMARC records will show your current configuration. Free tools like MXToolbox can check your email authentication posture in minutes. If you don’t have a DMARC policy set to ‘quarantine’ or ‘reject,’ you’re exposed.
How long does it take to implement these controls?
Technical controls like MFA and email authentication can be configured within days for most environments. Building a complete written security program, one that satisfies SEC Reg S-P requirements, typically takes 4 to 8 weeks with the right partner. The sooner you start, the better.
What should I do if I suspect a BEC attack is in progress?
Do not engage with the suspicious email. Contact your IT security team or MSP immediately. If a wire transfer has been initiated, contact your bank within hours. There may be a brief window to recall or redirect funds. Document everything. Your incident response plan should define these steps in advance so you’re not making decisions under pressure.
Next Step: Download the BEC Attack Prevention Checklist
We built a practical checklist specifically for financial advisors, RIAs, and broker-dealers. The BEC Attack Prevention Checklist for Financial Advisors walks you through:
- The technical controls your firm needs, and how to verify they’re in place
- Wire transfer and account change verification procedures
- Staff training requirements
- Documentation your compliance program needs to satisfy SEC Reg S-P
It’s audit-ready, practical, and built for firms that need to move fast.
Or if you’d rather talk through your firm’s specific posture:
