Email Security for Brokers: Phishing, Spoofing and Fake Funding Docs
Funding moves money on the strength of emails. That makes your inbox the most likely place a fraudster will try to get between you, your merchants and your funders.
An email arrives from a funder you work with every week. Same logo, same signature block, same rep's name. It says the funding desk has updated its wiring instructions for broker commissions and asks you to confirm your account details through a link. The sender address looks right at a glance. It is off by one letter.
Funding shops are built for this kind of attack. Deals move fast, money changes hands on the basis of emailed documents, and dozens of outside parties send attachments every day. A fraudster does not need to break into anything; they only need one person on your floor to trust the wrong message at the wrong moment.
This guide covers the three threats that matter most, phishing, spoofing and doctored documents, plus the technical basics and floor habits that blunt them.
Pre-flight summary
- Phishing targets credentials; two-factor sign-in and direct navigation blunt it.
- SPF, DKIM and DMARC help stop others sending mail as your domain, but not lookalikes.
- Confirm every payment-instruction change by calling a number already on file.
- Collect documents through a portal and tie underwriting figures to source pages.
- If an attack succeeds, act fast and involve counsel about any notification duties.
Leg 01Phishing: the attack aimed at your passwords
Phishing tries to get a broker to hand over credentials or open something malicious. In funding, the lures are tailored: a shared document from a funder, a signed contract to review, a voicemail transcript, a declined-payment notice. The click leads to a fake sign-in page that looks exactly like the real one.
The defenses are layered. Two-factor sign-in means a stolen password alone does not open the account. Training means brokers pause before entering credentials after clicking a link. And a habit of navigating directly to known systems, rather than signing in through links in emails, removes most of the risk outright.
- Unexpected urgency, especially around money or account access.
- Sender addresses that are close to, but not exactly, a known domain.
- Links whose real destination does not match the displayed text.
- Requests to sign in to view a document you were not expecting.
- Attachments with unusual file types or password-protected archives from strangers.
Leg 02Spoofing and what SPF, DKIM and DMARC do
Spoofing is sending email that pretends to come from your domain. If a fraudster can email your merchants as if they were your shop, they can send fake offers, fake payoff letters or fake bank details. Three standards help receiving servers tell real mail from forgeries.
SPF is a published list of servers allowed to send mail for your domain. DKIM adds a cryptographic signature to outgoing messages so receivers can check they were not altered and really came from an authorized sender. DMARC ties the two together and tells receivers what to do with mail that fails, such as quarantine or reject it, and can send you reports on who is sending mail using your name.
You do not need to configure these yourself, but you should ask whoever manages your domain whether all three are in place and whether DMARC has moved beyond a monitoring-only setting. Remember that these protect your own domain from impersonation. They do nothing about lookalike domains one letter off, which is why human verification still matters.
Leg 03Wire fraud and changed payment instructions
The most expensive email fraud in funding is redirected money. A merchant receives instructions to send a payoff to a new account. A broker receives a request to update their commission bank details. An investor gets a notice that distributions are moving. Each message looks routine.
The single most effective control is a call-back rule: any change to payment instructions is confirmed by phone using a number you already have on file, never one supplied in the email itself. No exceptions for urgency, seniority or a familiar name.
Any change to where money goes gets a call-back to a number already on file. No exceptions for urgency.
Leg 04Doctored statements and fake funding documents
Email is also how altered documents enter your pipeline. A statement PDF may have edited balances or deposits. A supposed approval letter may be invented. Treating merchants fairly does not mean accepting documents uncritically; it means verifying them consistently for everyone.
Reduce the risk by collecting statements through a merchant portal rather than forwarded attachments, and by underwriting in a way that ties every figure to its source page, which makes inconsistencies easier to spot. FundPilot's statement underwriting links each deposit, balance and NSF figure to the page it came from, and lender replies thread onto the deal, so an approval that did not come through the normal channel stands out.
Leg 05Floor habits that stop most attacks
Technology catches a lot, but habits catch the rest. Build these into training and repeat them often.
If your team works inside FundPilot, two-factor sign-in, role-based access and the audit trail cover the CRM side of this list, which leaves your energy for email accounts and payment-instruction habits.
- Turn on two-factor sign-in for every email account in the company.
- Confirm SPF, DKIM and DMARC are configured for your domain.
- Adopt a call-back rule for any change to bank details or payment instructions.
- Sign in to systems by typing the address or using a bookmark, not through email links.
- Collect merchant documents through a portal instead of open email.
- Give brokers a simple way to report suspicious messages, and thank them when they do.
- Never let personal email accounts carry merchant documents.
Leg 06When something gets through
Assume that one day a phishing email will succeed. Speed matters more than blame. The broker should report it immediately, change their password, and have their sessions revoked. Check the audit trail for exports, downloads and changes made from their account. If money may have been misdirected, contact the banks involved right away.
Depending on what data was exposed, you may have notification obligations to merchants, partners or authorities. Those requirements differ by jurisdiction and situation, so bring in qualified counsel early rather than after the fact.
Questions from the floor
Do SPF, DKIM and DMARC stop phishing emails we receive?
They help receiving systems judge whether mail claiming to be from a domain is genuine, so they can reduce some forged messages. But they mostly protect your own domain from impersonation, and they do nothing against lookalike domains registered by fraudsters. Brokers still need to check sender addresses carefully and follow call-back rules for anything involving money or credentials.
What should a broker do if they clicked a suspicious link?
Report it right away, without fear of blame. Change the password for any account they entered, and have a manager revoke active sessions and check the second factor. Review the audit trail for unusual exports or downloads from that account. Fast reporting turns a potential breach into a minor incident, so make sure the team knows exactly who to tell.
How can we tell if an emailed bank statement has been altered?
Look for internal inconsistencies, such as running balances that do not reconcile, fonts that change mid-page, or totals that disagree with individual lines. Collecting statements through a portal and verifying figures against their source pages makes discrepancies easier to catch. When something looks wrong, ask the merchant about it calmly and apply the same verification standard to every file.
General information only — not legal, tax or financial advice. Rules for telemarketing, texting, recording, disclosures and data retention vary and change; confirm current requirements with qualified counsel.
Connecting flights