Cyber Liability Insurance for Mortgage Brokers and Lenders
A loan file is the most complete financial portrait of a household outside a bank, and it travels between five parties by email. Cyber Insurance Group has agents dedicated to cyber liability, comparing coverage across 12+ A-rated carriers.
Compare your mortgage business across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteEverything About a Household, Assembled in Six Weeks
No other small business collects this much financial detail about a person this fast, or shares it with this many parties.
The complete portrait
Tax returns, pay stubs, bank and asset statements, credit reports, Social Security numbers and identity documents, per borrower, per file.
Five parties, one file
Processor, underwriter, appraiser, title and investor all receive copies, mostly by email, inside a 30 to 45 day window.
Borrowers send it unprotected
Applicants routinely email documents from personal accounts before anyone has explained a secure portal to them.
Originators work from phones
The most mobile part of the business handles the most sensitive documents, often on devices nobody is managing.
The FTC Lists Your Job Title
Many businesses have to work out whether a federal rule reaches them. You do not.
What the rule says
The financial institutions subject to the Commission’s enforcement authority include, but are not limited to, mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, and tax preparation firms. Source: 16 CFR 314.2. Our financial services page covers what the Safeguards Rule requires generally, including the reporting duty.
The part the rule does not solve for you
Compliance addresses your own program. It does not address the fact that the file leaves. Once a document is attached to an email and sent to an appraiser, your written information security program is no longer the thing protecting it, and the recipient’s mailbox is.
Why the transaction window is the risk
A loan is assembled, scrutinized and funded on a compressed timetable with a known closing date and a known amount. That is precisely the shape of transaction attackers watch for, which is why mortgage and settlement sit together in the fraud statistics even though they are different businesses. The settlement side is covered on our closing practice page.
Who actually sets your rules
- Insurance agencies answer to your home state’s insurance commissioner, on a clock that changes when you cross a state line.
- Mortgage brokers and lenders answer to the FTC, which names mortgage brokers and mortgage lenders expressly in the rule.
- Payment processors and ISOs answer to the card networks, through contract rather than statute, which is a different kind of binding.
Why it changes the policy conversation
Two questions decide the value of the policy here: the funds transfer fraud sublimit measured against a typical closing, and whether the wording responds when the compromised mailbox belonged to someone else in the transaction. Our data breach response guide walks through the sequence.
Built for a File That Leaves the Building
Borrower notification
Breach response funds notifying borrowers whose complete financial profile was exposed, which is a higher-harm disclosure than most.
Diverted funds
Funds transfer fraud and social engineering cover respond to payments made on fraudulent instruction, within their sublimits.
Claims from the transaction
Third-party liability funds the defense when other parties to the closing allege your systems were the point of compromise.
The pipeline keeps moving
Business interruption responds when the loan origination system is unavailable against rate locks and closing dates.
Before You Decide
The objections we actually hear from business owners, answered straight.
Are mortgage brokers covered by the FTC Safeguards Rule?
You are named in it. The rule’s own discussion of which financial institutions fall under the Commission’s enforcement authority lists mortgage lenders and mortgage brokers expressly, alongside finance companies, account servicers and collection agencies. There is no interpretive question to resolve about whether the rule reaches you.
What makes a loan file different from other financial records?
Completeness. A single file routinely contains tax returns, W-2s, pay stubs, two months of bank statements, asset and retirement statements, a credit report, Social Security numbers and a government identity document, for every borrower. Very little outside a bank assembles that much about a household in one place, and nothing else assembles it that quickly.
Why does it matter that the file travels?
Because your security is only as good as the weakest party in the chain. Over a 30 to 45 day window that file moves between the originator, processor, underwriter, appraiser, title or settlement agent and the investor, very often as email attachments. Each hop is a copy outside your controls, and borrowers frequently send documents from personal email before you have any say in it.
Who gets blamed if a borrower’s wire is diverted?
Everyone argues, and you will be in the argument. Closing wire fraud typically begins with a compromised mailbox somewhere in the transaction and ends with a buyer whose funds are gone. Whether the compromised mailbox was yours is a forensic question answered expensively and after the fact. We cover the settlement side of this on our closing practice page.
Does a loan officer’s phone count as part of our exposure?
Almost always, and it is usually the least controlled device in the business. Originators work from phones and personal laptops, receive borrower documents through text and personal email, and move between employers taking contact information with them. Underwriters ask about mobile device management for exactly this reason.
What does cyber liability insurance not cover for a mortgage business?
It does not cover loan quality, repurchase demands or a compliance finding on origination. It does not recover a borrower’s diverted wire beyond what funds transfer fraud cover responds to, within its sublimit. It covers the incident, the borrower notification, the liability claims and the interruption to your pipeline.
What Would Cyber Liability Insurance Cost Your Mortgage Business?
Pricing follows loan volume, how borrower documents are collected and shared, how wire instructions are verified, and the controls you can evidence. See the breakdown in our cost guide, or get a number for your business.
Compare 12+ A-rated carriers for your business
Free, no obligation, about 4 minutes.