AegisAI Perspectives · 073
A broker-dealer protects cloud email from account takeover with MFA on every mailbox, alerts on rules and odd sign-ins, and a callback before assets move.
A broker-dealer protects cloud email with MFA on every mailbox, alerts on new rules and odd sign-ins, and a callback before assets move, because FINRA names account impersonation through compromised email as a threat1. AegisAI raises a finding per account when a takeover looks likely, and every finding comes with recommended steps23.
This page is the account takeover detail behind the hub on email security for financial services, which maps the Regulation S-P notice of no later than 30 days10. For the stages of a takeover in any sector, read how email account takeover works.
FINRA describes account impersonation as stolen customer information plus a compromised or spoofed email address, used to start actions such as a third-party wire request.
In Regulatory Notice 12-05, FINRA warned of customer funds stolen through instructions emailed from compromised customer accounts16.
If an attacker signs in there, the incident falls under Regulation S-P, and Rule 30 of Regulation S-P requires written policies that safeguard customer information6.
FINRA's 2026 effective practice is MFA for login access to firm systems. Email is one of them, and the practice covers associated persons and firm staff as well as contractors and customers3.
FINRA advises reviewing suspicious login activity from unidentified browsers or locations, and wire requests to third-party accounts, to decide on trading and fund restrictions4. In a mailbox, the matching symptom is a rule that automatically forwards email to unknown addresses20.
In Microsoft 365, turning automatic forwarding off disables any Inbox rules or mailbox forwarding that redirect messages to external addresses21.
FINRA lists scanning outbound email and attachments to identify and block exfiltration of sensitive customer information as an effective practice5.
Many firms in FINRA's roundtable moved away from using email addresses as authentication factors, because email account breaches are common12. Password resets and asset moves need a second channel, such as a confirmation call on an established phone number.
Firms in the same roundtable required a confirmation phone call to the customer on an established phone number when suspicious activity showed up in the account. Use the number on file, never one from the email.
FINRA lists a change in the email account of record, followed by a request for a third-party wire, as activity that could indicate a takeover. Hold the wire until the callback in step 6 is logged.
Revoking active sessions immediately invalidates any active access using the stolen credentials. Reset the password, then delete app passwords, because a reset does not revoke them.
The amended rule requires an incident response program designed to detect and respond to unauthorized access to customer information, then recover from it11. Record the date the firm became aware, because notice is due no later than 30 days after it.
| Expectation | Where it comes from | Setting or record to show |
|---|---|---|
| MFA on email for associated persons and staff | FINRA 2026 oversight report | MFA enforced on every mailbox, shared mailboxes included |
| Review suspicious logins and third-party wire requests | FINRA 2026 oversight report | Sign-in alerts routed to the fraud or compliance desk |
| Block exfiltration of customer information | FINRA 2026 oversight report | Outbound scan on email and attachments |
| No email as an authentication factor | FINRA Regulatory Notice 21-18 | Resets and asset moves verified on a second channel |
| Callback on an established number | FINRA Regulatory Notice 21-18 | Logged call before release |
| Incident response program | SEC Regulation S-P amendments | Written plan that covers a taken-over mailbox |
| Customer notice | SEC Regulation S-P amendments10 | Notice within 30 days of awareness |
Regulation S-P and S-ID sit next to FINRA Rules 3110 (Supervision) and 4370 in FINRA's list of rules a cyber incident can touch9. Larger entities had to comply with the Regulation S-P amendments by Dec. 3, 20257, and smaller entities by June 3, 20268.
Illustrative example, figures are fictional. A broker-dealer with 60 registered representatives runs on Microsoft 365. A representative signs in to a fake document page, and an attacker signs in to her mailbox from a new country an hour later. The attacker adds a rule that moves replies containing "wire" to an archive folder. Two days later a client's account record shows a new email address, and an email from that address asks for $85,000 to go to a new third-party account. The callback goes to the client's number on file, and the client says he sent nothing. IT revokes the representative's sessions and deletes the rule. It also removes two app passwords. Compliance records the day the firm became aware and opens the Regulation S-P file.
AegisAI weighs impossible travel, new devices, inbox rule changes and suspicious internal sends together per account22. Every finding comes with recommended steps, and your team acts in Entra ID, Okta or Google Workspace. On Microsoft 365, sign-in reports need Entra ID P1. Early access runs on the connection you already have, review-only, with no MX change, and you can see it on your own tenant or read the account takeover protection page.
FINRA's 2026 oversight report lists MFA for login access to firm systems such as email, used by associated persons and staff, as an effective practice. It is a practice FINRA observed, and Regulation S-P separately requires safeguards for customer information.
It can be, when the mailbox held customer information. The amended rule requires an incident response program for unauthorized access to customer information, and notice to affected individuals no later than 30 days after the firm becomes aware.
Larger entities had to comply by Dec. 3, 2025. Smaller entities had to comply by June 3, 2026.
No. A reply goes back to the mailbox the attacker controls. Many firms in FINRA's roundtable stopped using email addresses as authentication factors, and some required a confirmation call on an established phone number.
Revoke the active sessions, which invalidates any access using the stolen credentials. Then reset the password, delete app passwords, remove forwarding rules and tell compliance the date the firm became aware.
