FINRA Issues Regulatory Notice and Warns of Email Attacks
The Financial Industry Regulatory Authority (FINRA) is going on the offensive to protect the investing public against email hacking attacks in which fraudulent transfers are being made. Issuing both a Regulatory Notice 12-05 and an Investor Alert that is aptly titled: Email Hack Attack? Be Sure to Notify Brokerage Firms and Other Financial Institutions, the agency has blanketed the subject due to what it says are increased reports of email and account invasion by hackers that are leading to investors' funds being stolen.
At first glance, the scenario is similar to other email scams, but these attacks differ in a significant way. In past instances, customers are sent emails asking for private information that is then used to fraudulently obtain information that allows outsiders to gain access to accounts.
As noted in the Regulatory Notice executive summary, the scheme has several steps that make it appear that the transfer requests are legitimate. But in fact the perpetrators have gained access to an investor's email and contact lists and that information is then used to instruct firms to make transfers into accounts controlled by third parties, not the investor. In some instances, these fraudulent "instructions" might include what are also fraudulent letters of authorization that attempt to pressure firms into releasing funds prior to a follow-up phone authorization.
The FINRA warning is intended to inform the public to avoid these circumstances by safeguarding assets. The Regulatory Notice is also intended to halt this trend by helping firms understand that allowing or accepting email instructions is fraught with risk. The hope is that firms will reassess their policies with regard to instructions, which should help protect against this fraudulent practice on the part of hackers.
Once an individual is aware of or suspects that email has been compromised, FINRA is asking that investors immediately inform their brokerage firms or financial institutions of this problem.
Referring generally to NASD Rule 3012 and NYSE Rule 401, RN12-05 reminds firms that they must establish, maintain and enforce written supervisory control policies and procedures that are reasonably designed to review and monitor the transmittal of funds or securities from customer accounts to third-party accounts. These requirements and their scope have been delineated in Regulatory Notice 09-64, which "highlighted a number of questions firms should consider in assessing the adequacy of their policies and procedures for verifying the validity of requests to withdraw or transfer customer funds."
This increase of fraudulent email activity serves as a reminder that firms should be vigilant in assessing and establishing policies and practices as to electronic communications with investors. Assessing the risks involved with the way in which investors are permitted to communicate instructions for the withdrawal or transfer of funds through electronic means, including verification and follow-up, are recommended.
The lawyers of Wall Street's Gusrae Kaplan Nusbaum PLLC are experienced advisors to firms and broker-dealers in all areas of compliance. Contact our law firm for more information on our wide range of services, including litigation and enforcement representation. We are a firm comprised of experienced former senior level regulators and securities and compliance litigators, providing advisory services to our clients in regulatory compliance.



