Phishing & online fraud
Phishing and online fraud: the right reflexes
Fraud attempts are becoming increasingly credible. Insurer logos, fake portals, signature requests or login notifications: learn to recognize the warning signs before clicking.
A fraudulent email can now look completely legitimate
It may use an insurer’s logo, imitate an official communication, use a colleague’s name or redirect you to a login page that looks almost identical to the one you use every day.
For an advisor who receives communications every day from insurers, clients, partners and different platforms, a few seconds of verification can make all the difference.
What is phishing?
Phishing consists of impersonating a trusted person or organization in order to push you into taking an action.
Fake emails an advisor could encounter
Some scenarios are especially credible in an advisor’s day-to-day work.
An email supposedly sent by an insurer
The message may use the correct logo, the correct colours and perfectly credible wording.
A fake login or password notification
The link may take you to a fake page designed to collect your email address and password.
A fake electronic signature request
An unexpected notification may imitate a signature service you actually use.
An unexpected invoice or attachment
A file presented as a PDF or client document may contain a malicious file or lead to a fraudulent website.
A message that appears to come from a colleague
Fraudsters may use a familiar name while using an email address that is very similar to the real one.
🚩 7 signs that should get your attention
A sense of urgency
“Immediately,” “account suspended,” “action required today.”
An unusual email address
Always check the sender’s full email address.
A login request
Be cautious of a sudden request to log back into a portal.
A request for your password
Never send your password by email.
A request for a verification code
Never share your MFA code or a code received by SMS.
An unexpected attachment
Even a professional-looking file can pose a risk.
Something seems unusual
A process or request that differs from the usual deserves verification.
⏱️ The 10-second rule
Take a few seconds and ask yourself these five questions.
🌐 When in doubt: go directly through the official portal
If an email tells you that a document is available in your insurer portal, you do not necessarily need to click the link you received.
Open your browser and go directly to the official portal you normally use.
🔐 Protect your accounts as well
🔒 Enable multifactor authentication
When MFA is available, use it. It adds an additional layer of protection even if your password is compromised.
🔑 Use different passwords
Avoid reusing the same password for your email, insurer portals, professional tools and personal accounts.
🗝️ Use a password manager
It allows you to generate and store unique and complex passwords.
💻 Keep your devices up to date
Regularly install updates for your operating system, browser and software.
With artificial intelligence, fake messages are becoming more credible
Spelling mistakes are no longer a reliable indicator. AI can produce professional, personalized and highly credible messages. A perfectly written email can therefore still be fraudulent.
🚨 Did you click on a suspicious link?
What matters now is how quickly you react.
Immediately stop interacting with the website or email.
If you entered a password, change it immediately through the official website.
If that password is used elsewhere, change it on the other affected accounts as well.
Notify SFG quickly so that the necessary measures can be taken.
If access to an insurer portal may have been compromised, contact the appropriate service to secure the account.
If necessary, have your computer checked by your IT support team.
STOP → VERIFY → ACCESS DIRECTLY → REPORT
Do not click immediately.
Check the sender, the link and the nature of the request.
Open the official portal yourself rather than using the link you received.
If something seems suspicious, inform SFG quickly.
Trust your doubt
You do not need to be a cybersecurity expert to adopt the right reflexes. Taking a few seconds to verify a sender or go directly to the official portal can prevent the compromise of an account or confidential information.
