How to Spot Phishing Emails Aimed at Brokers

To spot phishing emails, check the full sender address and the destination of any link, then confirm unexpected requests through a trusted contact. For an urgent lender login request, open your saved broker portal and check for the task there.

A familiar logo, a client’s name or a genuine-looking email thread cannot prove a request is safe. Keep passwords and authentication codes out of replies and unexpected login screens.

What a Phishing Email is

A phishing email impersonates a trusted person or organisation to steal information or persuade you to take a harmful action. A fake lender notice might send a broker to a copied login page. The attacker then uses the captured password to enter the real account.

The same approach reaches brokerages through other channels. An SMS scam might claim a loan document needs attention. Scam calls can impersonate a lender’s support team and ask you to approve a password reset. Voice cloning can imitate a colleague, while a deepfake can imitate someone’s appearance or voice.

Australian Government phishing guidance explains these email, text and voice attacks. If a call asks you to bypass a normal approval, end it and call the person on a number already in your records.

Phishing Email Examples Brokers Receive

Phishing aimed at brokers often copies an ordinary lending task, such as checking a condition or opening a client document. Each row below is an illustration, with a dummy sender address. The messages are invented and contain no working scam links.

Illustration	Dummy sender	Example request	What to check independently
Lender impersonation	`security@lender-access.invalid`	“Your broker access expires in one hour. Sign in to keep lodgements open.”	Open the lender portal from your bookmark and contact its support team through your existing directory.
Aggregator impersonation	`payments@aggregator-check.invalid`	“Your commission statement is on hold. Confirm your account through this attachment.”	Check the aggregator portal for the statement and ask your usual contact about the hold.
CRM impersonation	`support@crm-renewal.invalid`	“Your client records will be deleted unless you verify your password.”	Open the CRM directly and check account notices. Ask your administrator about the claimed deletion.
DocuSign impersonation	`signing@document-review.invalid`	“A lender has sent your settlement pack. Review the document.”	Confirm the sender and expected signing request through a known channel before accessing documents.
Client impersonation	`alex@borrower-documents.invalid`	“I’ve attached my payslips. Use your work email password to unlock them.”	Call the client using the number already held in the file. Check whether they sent the documents.

A real sender can also have a compromised mailbox. Treat an unusual request in an existing conversation as something to verify, even when the address matches your records.

Warning Signs in a Phishing Email

Look for a mismatch between the request and the work you expect to do. A sudden password demand or changed bank details deserves a separate check before you act.

Expand the sender details and read the complete email address. A display name such as “Lender Support” is easy to copy. Check unexpected reply-to addresses too.
On a computer, hover over a link without clicking and inspect its destination. A padlock only means the connection is encrypted. It does not prove who runs the site.
Leave unexpected attachments unopened. A file that asks you to enable macros, install software or enter your mailbox password needs investigation.
Pause when the message threatens account closure or a missed settlement unless you act immediately. Urgency can discourage the checks you normally make.
Confirm a bank-account change with the person using a number already on file. Use your brokerage’s payment approval process before changing stored details.

Google’s phishing guidance explains sender and link checks. Good spelling and a familiar logo do not remove the need to verify a request.

For the lender illustration above, use this short checklist before clicking:

Expand security@lender-access.invalid and compare it with the lender’s genuine address held in your records.
Leave the email’s sign-in button alone and open your saved lender portal.
Look for the claimed access warning in the portal. If it is absent or unclear, call your known lender support contact.
Report the message if the lender confirms it is fake. Keep the original available to your IT team.

Report a Phishing Email

Report a suspected phishing email through your mail provider and your brokerage’s internal reporting process. Tell IT immediately if anyone interacted with it, so they can check other recipients and account activity.

Outlook

For Outlook.com and Outlook on the web, follow Microsoft’s reporting instructions:

Select the suspicious message in the message list.
Choose Report, then Report phishing above the reading pane.
Follow any confirmation prompt and your brokerage’s instructions for retaining evidence.

A work account can have a reporting button configured by its administrator. If the option is missing, ask IT for the brokerage’s approved reporting route. Reporting phishing in Outlook.com does not automatically block the sender.

Gmail

On a computer, use the message’s reporting menu:

Open the email without following its links or opening attachments.
Next to Reply, select More.
Select Report phishing.

The Gmail help page linked above documents these steps. Keep client information within your brokerage’s approved reporting process when sharing evidence.

Scamwatch and ReportCyber

Use Scamwatch’s report form to report suspicious contact or activity. Record what the message asked you to do and provide the relevant evidence.

If personal information or money has been stolen, use ReportCyber to make a cybercrime report to police. Contact the bank immediately if money or banking access is at risk. Reporting does not replace urgent action to secure an account.

If Someone Clicked

If someone clicked a phishing link, stop using the page and tell your IT provider what happened. Explain whether they only opened it, downloaded a file, entered a password or approved an authentication prompt. Those actions call for different containment steps.

Close the suspicious page. Preserve the original email and record the time and actions taken for IT.
If a file ran or software was installed, stop using the device and contact IT from another device. Follow its isolation instructions before reconnecting it to work systems.
If a password was entered, use a trusted device to open the real service directly and change the password. Change it on other accounts where it was reused.
Ask the administrator to end active sessions and inspect account access. Review recovery methods, multi-factor authentication settings and mailbox forwarding rules for unauthorised changes.
Check affected client files and connected accounts. Contact the bank immediately about suspicious payments and warn contacts if the mailbox sent scam messages.

The Australian Government’s account recovery steps explain password changes and mailbox checks. Its malware recovery guidance covers an affected device. Recovery needs confirmation that unauthorised access and settings have been removed, alongside checking for further suspicious activity.

A click alone does not establish that client information was accessed. Treat possible exposure as a suspected privacy incident and ask the person responsible for privacy to assess it. Client documents accessed through a stolen mailbox password can turn the event into a data breach.

The OAIC’s Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act. It requires notification when a breach is likely to cause serious harm, subject to the scheme’s conditions. Escalate possible exposure promptly so the brokerage can assess the affected information and take action to limit harm.