Industries · Financial services and trust administration
IT and security for trust administrators, escrow teams and lenders.
We protect the money you move and the personal data you hold, keep your team working, and help you show regulators, lenders and insurers that your controls are real.
A 15-minute call with an engineer who works with financial firms.
Trusted by
Sound familiar?
What we hear from financial and trust teams.
Trust, escrow and lending work comes down to two things: moving other people's money correctly, and keeping their personal details private. Attackers want both.
01
Every email could move money.
Wires, payoffs, disbursements and trust distributions are often arranged by email. Clients, attorneys, title officers and beneficiaries all write in. When one message changes where the money goes, there may be only a few hours to catch it.
02
You hold data people can't change.
Social Security numbers, account numbers, dates of birth and family details sit in your files for years. A stolen password can be reset. A stolen Social Security number can't, and your clients know it.
03
Someone always wants proof.
Banks, lenders, auditors and insurers send security questionnaires. Many non-bank financial firms also fall under the FTC Safeguards Rule, which expects a written security program. Saying “we're careful” is not enough. They want to see it on paper.
Know what you are up against
The attacks that actually hit financial and trust firms, explained.
You don't need to know how hackers work. It helps to know what an attack looks like when it reaches your desk, why firms like yours are a good target, and the habit that stops most of it.
The attackWhat it looks likeWhy financial firms get hitWhat stops most of it
01
Changed wire instructions
Called business email compromise, or BEC
What it looks like
Right before a closing, payoff or distribution, an email says the account has changed. It looks like it came from the client, their attorney or a beneficiary. It may use a look-alike address, or come from their real mailbox after someone broke into it.
Why financial firms get hit
Large sums move on dates the attacker can predict. Many outside people are on the thread, so one more message doesn't stand out.
What stops most of it
Call to confirm any new or changed account, using a phone number already in the file. Never use a number from the email.
02
A taken-over mailbox
After a fake sign-in page
What it looks like
A staff member gets a “secure document” link and types their password into a page that looks like the real sign-in. The attacker then reads the mailbox quietly and sets rules that hide replies, waiting for the right deal.
Why financial firms get hit
Your staff open documents from outside parties all day. A mailbox at a financial firm shows who is about to send money, and how much.
What stops most of it
MFA on every mailbox, plus alerts when someone adds a forwarding rule or signs in from somewhere new. MFA means a second check, like a code on your phone, when someone signs in.
03
Ransomware and data theft
Files locked, and a threat to publish
What it looks like
Files and systems stop opening, and a note demands payment. Often the attacker copied client records first and threatens to post them online if you don't pay.
Why financial firms get hit
Client data is valuable, and closings and distributions can't wait. A firm that can't work and fears a leak is under heavy pressure to pay.
What stops most of it
Backups kept where ransomware can't reach them and tested, plus EDR on every computer. EDR is software that spots attacker behavior and stops it.
04
A caller pretending to be the client
By phone or email, with a convincing story
What it looks like
Someone calls or writes as a beneficiary or borrower. They know a few personal details and ask you to update an address, a phone number or a bank account. The next payment then goes to them.
Why financial firms get hit
Your team wants to help, and many clients are older or hard to reach. Personal details are easy to find after past data leaks.
What stops most of it
A written identity check for any change to contact or bank details, and a second person who approves it before money moves.
Inbox
FromRay Okafor <rokafor@harb0rfinch.example>1
ToLena, Trust administration
SubjectRE: Q3 distribution, Marsh Family Trust2
Hi Lena, Ellen asked me to pass this along before Thursday's distribution. She closed her old account, so please send this and future distributions to the account below.3
She is traveling and hard to reach by phone, so just reply here to confirm.4
Ray
New account: routing ending 2208 · account ending 6614
Illustration. The names, firms and numbers are made up.
Up close
What a fake distribution request looks like.
This kind of email arrives a few days before money is due to go out, from someone your team already trusts. Here is how to read it.
1The address has one character swapped. The real firm is harborfinch. This one is harb0rfinch, with a zero where the letter o should be. In a busy inbox, it reads the same.
2It knows the trust and the date. Attackers often read a real mailbox first, so the trust name, the beneficiary and the timing are all correct.
3The money goes somewhere new. And it asks for future payments too, so the loss can repeat.
4It explains away the phone call. A call to the beneficiary at the number in your file is exactly what would expose it.
The habit that stops it: before changing where money goes, call the account holder at a number already in the file, and have a second person approve the change.
$2.9 billion
in reported losses from business email compromise in 2023, across 21,489 complaints to the FBI. That is out of about $12.5 billion in total reported losses from internet crime that year.
Source: FBI Internet Crime Complaint Center (IC3), 2023 Internet Crime Report.
Check your exposure
Check your exposure in 60 seconds.
Seven yes-or-no questions about how your firm works today. You'll see where you stand, and the three moves that would help most.
01
Before money goes to a new or changed account, does someone call to confirm?Using a number already in the file, not one from the email.
02
Does everyone use MFA on email, remote access and the systems that hold client data?MFA is a second check when someone signs in, like a code on their phone.
03
Are backups tested, and stored somewhere ransomware can't reach?“Tested” means someone restored files from them in the last few months.
04
Do you have a written security program, with one named person in charge of it?If your business is covered by the FTC Safeguards Rule, the rule calls this person the Qualified Individual.
05
Is client information encrypted on laptops, in storage and when you email it?Encrypted means scrambled, so it can't be read without the right key or password.
06
When someone leaves or changes roles, is their access removed the same day?Email, client files, banking portals and any shared passwords.
07
Do you have a written plan for a breach, including who must be told and by when?Your bank, your insurer, your IT team, your attorney, and any regulator or client you must notify.
Nothing you click here leaves your browser.No email, no form.
IT across the life of an account
From the first document to the final distribution.
Whether it is a trust, an escrow or a loan, each stage brings new people, new documents and new money movements. Pick a stage to see what tends to go wrong there and what we put in place.
Onboarding
New clients send IDs, tax forms, trust documents and bank details. It is the most personal data you will ever collect from them, all at once.
What can go wrong
Clients email scans of IDs and statements as plain attachments, which then sit in several inboxes.
Copies get saved to desktops and downloads folders, outside the system that is backed up.
What we set up
A secure upload link for clients, so documents land in one protected place.
Encrypted laptops and a rule that client files live only in the system of record.
Funding
Deposits, earnest money or loan funds arrive. Outside parties ask where to send it, and the answer usually goes out by email.
What can go wrong
An attacker sends the sender fake instructions that look like yours.
Someone registers a look-alike of your domain to send those fake instructions.
What we set up
Email settings (SPF, DKIM and DMARC) that prove mail from your domain really came from you.
A watch on look-alike domains, and a standard line in every email telling clients to call before wiring.
Administration
The longest stretch. Staff update records, answer clients and work with outside advisors. Access tends to grow over time and rarely shrinks.
What can go wrong
Everyone can open every client folder, even ones they never work on.
A caller with the right personal details talks staff into changing an address or phone number.
What we set up
Access set by role, reviewed every quarter, with a list you can show an auditor.
A written identity check for any change to contact details, before it is saved.
EDR on every computer, watched for alerts.
Payments out
Money leaves your control. This is the moment every fake email is built for.
What can go wrong
A changed account arrives by email a day or two before the payment date.
One person can both change the bank details and release the payment.
What we set up
A call-back rule for any new or changed account, using a number already on file.
Two-person approval in the banking portal, with MFA for both people.
Reviews and audits
A bank, lender, auditor or insurer asks how you protect client data. They want documents, dates and screenshots.
What can go wrong
The written program is years old and no longer matches what you do.
Answers get written from memory, and one of them turns out to be wrong.
What we set up
A current written program, a yearly risk assessment and a record of testing.
Reports that show MFA, encryption, EDR and backups are actually in place.
Closing and records
The trust terminates, the escrow closes or the loan is paid off. The files still have to be kept, sometimes for many years.
What can go wrong
Old files sit on a forgotten drive that no one backs up or protects.
Data is kept forever because no one decided when to delete it.
What we set up
A retention schedule you set with your attorney, applied to files and email.
Archived records kept encrypted and searchable, with a yearly restore test.
Software we already support
Keep the tools you already use.
You picked your systems for good reasons. We look after the accounts, access, backups and connections around them, so they stay secure without slowing down your team.
Microsoft 365Email, files and Teams
MFA, email filtering, alerts on forwarding rules, encryption for outgoing mail, and backups of mail and files.
QuickBooksAccounting
Separate logins for each person, MFA, and a check on who can approve payments.
DocuSignE-signatures
Sign-in protection for senders, and training so staff can spot fake signing requests.
ShareFileSecure file exchange
Client upload links, expiring shares and a review of who still has access.
Using something else? Ask on the call, and we will tell you honestly what we can look after.
Regulators, lenders and insurers
Questions your regulator, lender or insurer will ask, and the honest answers.
Many of these come straight from the FTC Safeguards Rule (16 CFR Part 314, under the Gramm-Leach-Bliley Act), which applies to many non-bank financial institutions. Not every trust or escrow business is covered, so ask your attorney. Lenders and insurers ask the same things either way.
What it means
A document that describes how you protect customer information, kept up to date. If your business is covered by the Safeguards Rule, it requires one, and it requires you to designate a “Qualified Individual” to oversee it.
How we get you to yes
We write the program with you, based on the controls you really have, and help you decide who on your team fills that role.
What it means
When someone signs in, they need a second check beyond the password, like a code or a prompt on their phone. The Safeguards Rule requires MFA for anyone accessing customer information, if your business is covered.
How we get you to yes
We turn it on for email, remote access and your core systems, and give you a report that shows it is enforced.
What it means
Encrypted data is scrambled, so it can't be read without the key. The Safeguards Rule calls for encrypting customer information both stored and in transit, if your business is covered.
How we get you to yes
We turn on disk encryption for laptops and servers, set up encrypted email, and list where client data lives so nothing is missed.
What it means
A written look at what could go wrong, and proof that your safeguards work in practice. The Safeguards Rule requires regular testing and risk assessments, if your business is covered.
How we get you to yes
We run the assessment and the testing, and hand you a dated report you can file and show.
What it means
Since May 13, 2024, businesses covered by the Safeguards Rule must notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers. State laws, lenders and contracts can add their own notices.
How we get you to yes
We build the notice steps into your incident plan, so you know which facts to gather and who to call, including your attorney.
What it means
Immutable means a backup can't be changed or deleted, even by someone with an admin password. Tested means someone actually restored files from it recently.
How we get you to yes
We set up a protected copy, run a restore test, and write down the date and result for your records.
What it means
Before anyone sends money to a new or changed account, they call the person at a number already on file, and a second person approves.
How we get you to yes
We help you write the policy, train whoever releases funds, and tag emails from outside your firm so look-alikes stand out.
We run IT and security for trust and financial teams across Southern California.
It applies to many non-bank financial institutions, but not to every trust, escrow or lending business. Whether it covers you depends on what you do and who you serve, so your attorney should make that call.
Either way, the rule is a sensible checklist. Lenders and insurers ask for most of the same things, so we can build toward it while you get the legal answer.
Most likely. We look after Microsoft 365, QuickBooks, DocuSign and ShareFile, and the accounts, access and backups around them. For anything else, ask on the call and we will tell you honestly what we can do.
Yes. Send it before the call. We will tell you which answers are already yes, which are quick fixes and which need more planning. Every yes we help you give comes with evidence you can attach.
Detection tools run around the clock; our engineers respond Mon–Fri 8–5 PT. We come on site when the job needs it.
You talk to an engineer. Tell us how money and client data move through your firm and what is worrying you. You will leave with at least one thing worth fixing, whether or not we work together.
