Cyber Risk for Financial Services Firms: Protecting Client Funds and Staying Compliant

Cyber Risk for Financial Services Firms: Protecting Client Funds and Staying Compliant

Financial services firms hold information that can be used to steal money, impersonate clients or compromise accounts. For Victorian financial advisers and small firms, an attack can disrupt business operations and damage client trust, even if the firm does not hold funds directly.

Strong cyber security reduces the likelihood and impact of these incidents. It also helps firms meet their privacy and contractual responsibilities and demonstrate that risks are being actively managed.

Why financial services firms are attractive targets

A single firm may handle identity documents, contact details, account information, superannuation and portfolio data, insurance details, tax records and payment instructions. Criminals can use this information to target clients, impersonate staff or redirect transactions.

Common attack goals include:

• Payment diversion: convincing a firm or client to send funds to a criminal-controlled account.

• Account takeover: using stolen credentials to access email, financial platforms or client records.

• Identity fraud: using personal information to impersonate clients or staff.

• Extortion and disruption: encrypting or threatening to release sensitive data.

Smaller businesses are not overlooked. They may have fewer dedicated security resources, while still depending on email, cloud platforms, practice-management software and external providers to serve clients.

Threats to prioritise

Business email compromise and payment redirection

Business email compromise (BEC) often starts with a convincing message, a stolen password or access to a real mailbox. An attacker may monitor conversations, create an email-forwarding rule, impersonate a client or supplier, and send altered payment details at the right point in a transaction.

Treat any bank-detail change as a high-risk request. Verify it by calling a known number already on file, not a number supplied in the email. For new or unusual payments, require a second authorised person to approve the transaction and record how the details were confirmed.

The Australian Cyber Security Centre’s guidance on preventing business email compromise provides further advice.

Credential theft

Passwords can be exposed through phishing, reused across services or stolen from compromised devices. If an attacker gains access to an email account, they may reset other credentials or search old messages for personal and financial information.

Use phishing-resistant multi-factor authentication (MFA), such as passkeys or security keys, for email, administrator accounts and financial platforms wherever supported. Disable legacy authentication where it is not required, and review who has access to sensitive systems.

Third-party platform risk

Advisers rely on software providers, licensees, cloud platforms, document-signing services and outsourced IT providers. A weakness at one provider can affect the firm’s access to systems or data.

Maintain an inventory of key providers and the data or services they handle. Check security responsibilities, incident-notification arrangements, backup and recovery provisions, and how access will be removed if a service ends. Outsourcing a service does not remove the need to understand its risks.

Privacy obligations and APRA CPS 234

The Privacy Act 1988 and Australian Privacy Principles may apply to a financial services business depending on its circumstances. Many small businesses with annual turnover of $3 million or less are exempt, but there are exceptions. For example, some small businesses are covered because of the type of information or services they handle. Do not assume your firm is exempt based on turnover alone. The OAIC’s small business guidance explains the scope and exceptions.

Where an organisation is covered, APP 11 requires reasonable steps to protect personal information it holds from misuse, interference, loss, and unauthorised access, modification or disclosure.

The Notifiable Data Breaches (NDB) scheme is part of the Privacy Act. If a suspected breach could qualify as an eligible data breach, covered organisations must assess it and, where notification is required, notify affected individuals and the OAIC as soon as practicable. The OAIC says entities must take reasonable steps to complete an assessment within 30 calendar days of becoming aware of the information that led them to suspect an eligible breach. See the OAIC’s breach-response guide.

APRA CPS 234 is not a blanket requirement for every financial adviser or AFSL holder. It applies to APRA-regulated entities, including banks, insurers and superannuation trustees. It sets expectations for information-security capability, controls, testing, incident response and third-party information assets. APRA-regulated firms have specific incident notification timeframes under the standard. Advisers working with APRA-regulated organisations may also face security requirements through contracts or supplier assessments. Confirm which obligations apply to your business and its relationships. Read the APRA CPS 234 standard.

This is general information, not legal advice. Firms should confirm their obligations with an appropriately qualified adviser.

Practical controls that reduce risk

A reliable control set combines prevention, detection and recovery. Start with the systems and transactions that would cause the greatest harm if compromised.

1. Strengthen identity security. Require phishing-resistant MFA for administrators and high-risk accounts. Use separate administrator accounts, review access regularly and remove accounts promptly when staff or contractors leave.

2. Apply conditional access. Set policies that limit access based on the user, device and risk. For example, require MFA, block legacy sign-ins and restrict sensitive systems to approved, managed devices. Test changes before enforcing them broadly to avoid disrupting legitimate access.

3. Set clear payment-verification procedures. Verify changes to bank details by an independent call-back. Use a trusted number already held in your records, read back the details and require dual approval for new payees or unusual transfers.

4. Use endpoint detection and response (EDR). EDR helps identify suspicious activity on computers and servers, such as unusual processes or signs of malware. Ensure alerts are monitored and that someone is responsible for investigating and responding to them.

5. Protect and test backups. Keep encrypted backups that are isolated or immutable, so they cannot easily be changed or deleted by an attacker. Cover business-critical data and systems, and test that recovery works, not just that backup jobs report success.

6. Review third-party access. Limit providers to the access they need, document who is responsible for each security task and know how to escalate an incident. Reassess access and provider arrangements when systems, contracts or business needs change.

The ACSC small business cyber security guide is a useful starting point for prioritising foundational protections.

Prepare for an incident before one occurs

Write down who can authorise urgent action, who contacts your IT provider, and how you will reach your bank, insurer, legal adviser and key suppliers. Include steps to secure compromised accounts, preserve evidence and assess whether personal information may have been affected.

Run a short exercise using a realistic scenario, such as an adviser’s mailbox being compromised or a client payment being redirected. A planned response helps staff act quickly and reduces confusion when time matters.

Security-first IT support for Victorian firms

Financial services businesses need security controls that are configured, monitored and maintained, not just installed. Omnicron provides managed IT services for Melbourne businesses, with support for endpoint management, patching, Microsoft 365, backups and security-focused maintenance.

Omnicron’s OmniShield Live Defence gives businesses clearer visibility into threat detection and system activity. A security review can help identify gaps in identity, email, endpoint protection and backup recovery, then prioritise practical next steps.

For financial services firms seeking cybersecurity services in Victoria, a structured review can help reduce exposure, improve operational resilience and clarify where further investment is needed. To discuss your firm’s requirements, contact Omnicron.