MFAA guidance after the youX breach
Broker Daily reported the MFAA's guidance following the youX data breach, including the downstream risks brokers and customers must manage.
Read sourceMortgage broker guide · Reverse impersonation
The broker's client file is the crown jewels
A stolen client file does more than expose data. It gives a scammer the facts, timing and borrowed authority to impersonate your firm to the client when money is about to move.
The attack runs in reverse
Most breach advice looks inward: reset access, investigate the system and warn staff. That is necessary, but it misses the next target. Once a criminal has the file, they can move outward and approach the borrower as the trusted firm.
This is reverse impersonation: your firm is impersonated to your own clients. The criminal is not trying to fool the broker into believing they are the client. They are using details held by the broker to make the client believe the criminal is you.
Public guidance on this direction of attack remains thin. The youX breach and the MFAA's response made the sector risk visible, but the MFAA's practical resource is for its member network. This guide fills a different need: a public page brokers can share with clients, in newsletters and on social channels before an incident.
The load-bearing point
A caller knowing the property, lender, loan amount or settlement date proves that data travelled. It does not prove who is speaking.
From breach to redirected payment
The client sees one convincing request. The attacker has assembled it through a five-stage kill chain.
- 01
The file is exposed
A broker, aggregator, lender or connected service is compromised. The attacker obtains names, contact details, property information, loan status and the people involved in settlement.
- 02
The timing is reconstructed
The criminal does not need the whole file. A settlement date, lender name, deposit amount or recent email thread can reveal when a client expects an urgent instruction.
- 03
Your firm is impersonated
The attacker calls, texts or emails the client as the broker, lender or settlement contact. Real details make the approach feel like continuity, not a cold scam.
- 04
The destination changes
A deposit, shortfall, discharge payout or disbursement is redirected. Urgency and a plausible explanation keep the client inside the attacker's channel.
- 05
Trust absorbs the damage
The client may have followed instructions carrying your firm's identity and knowledge. Even where the firm did not send them, the relationship bears the operational and reputational fallout.
Tell clients before the fake call
A warning sent after a breach competes with the attacker's urgency. A standing verification rule is stronger because the client already knows what your firm will and will not do. Put it in onboarding, repeat it before settlement week and make it easy for the client to check.
A useful message does not ask clients to spot perfect fakes. It tells them exactly how the genuine firm behaves and gives them permission to stop. Use plain language such as the following.
- We will never treat an unexpected call, message or email as proof that it is us.
- Before you send money or accept changed details, use the contact number already in your records and ask for an independent verification.
- Do not use a callback number or link supplied in the same message that requests the change.
- If a request creates urgency, secrecy or pressure, pause. Settlement timing does not cancel the verification rule.
- Tell us immediately if someone quotes genuine loan or property details. Accurate information can be stolen information.
A brandable public client one-pager is available as PDF and editable DOCX. Brokers can also copy these rules into their own approved client communications and adapt them with their licensee or aggregator.
Verification is the inoculation
A callback to a known number is sound, but the procedure can collapse under settlement pressure or when staff use contact details supplied in the suspicious message. The safer rule is to initiate a fresh check using the client detail already visible in the firm's browser-based CRM, portal or email client.
With Vericode, staff highlight that phone number or email, right-click and send a one-time code by SMS or email. SMS is sent through Australian SMS provider MobileMessage using Vericode's ACMA-registered sender ID, VERICODE. The client reads the code back during the live interaction. This is CRM-agnostic: it works with information visible in a browser and is not a claimed direct integration with a named platform.
The check tests possession of the established channel. It does not ask whether the caller sounds convincing, and it does not rely on them knowing more facts from the stolen file.
Keep the evidence with the file
Each verification creates a timestamped, hash-chained record of who requested the check, the masked target, method and outcome. Compliance-authorised users can export the record as PDF or CSV and retain it beside the client file.
That evidence does not guarantee fraud prevention, an insurance response or a compliance outcome. It does replace an undocumented recollection with a durable record that the firm applied its rule at the moment of risk.
Verification should sit beside dual approval, payment-change procedures, staff training and a clear escalation path. If a check fails, stop the request, preserve the evidence and contact the real client using trusted records.
Industry sources
These sources establish the breach context and sector response. Vericode is not affiliated with or endorsed by the MFAA.
MFAA practical scam resource
The MFAA publicly announced a practical scam resource for its member network. The resource itself is member-gated, which limits what a broker can send directly to a client.
Read sourceFraud risk across broking
Broker Daily's industry coverage describes the rising fraud exposure facing brokers and the need for practical controls rather than awareness alone.
Read sourceThe reputational aftermath
Further coverage of the breach fallout focuses on the reputational risk for brokers when client trust is used as part of the attack.
Read sourceGeneral information only. This guide is not legal, financial, cyber-incident or compliance advice. Follow your firm's procedures and seek professional advice for your circumstances.
Protect the relationship before the call