How to Spot Phishing Emails: A Guide for Mortgage Brokers

What a Phishing Email Looks Like

A phishing email impersonates a trusted person or organisation to trick you into handing over information or taking a harmful action. In a brokerage, a fake lender message might claim your portal access expires unless you enter your password through its link. The page captures your login instead of renewing access.

Scamwatch’s phishing guidance describes messages that copy trusted organisations and create urgency. Some lead to fake login pages. Others persuade you to download malicious files or call the scammer.

A business email compromise involves criminals using or impersonating a business email account to commit fraud. That can include payment instructions inserted into a real conversation. Check the requested action even when the sender’s address looks right.

Signs of a Phishing Email

An unexpected login or payment request needs independent verification, even if the email contains your client’s name and loan details. Look for these signs before acting.

• Inspect the full sender address. Expand the display name and compare the domain with the organisation’s known address. A matching display name alone proves nothing.
• Notice pressure to bypass your normal checks. Threats about lost portal access or a missed settlement can push staff to act before verifying.
• Inspect links without opening them. On a desktop, hover over the link to see its destination. Use the saved portal bookmark if you need to check the account.
• Leave unexpected attachments closed. A document that asks you to install software or enable active content needs your IT provider’s assessment.
• Stop any request to change bank details. Call the payee using a previously verified number and apply your brokerage’s payment-authorisation process.

Spelling mistakes can be a warning, but polished writing doesn’t establish legitimacy. Criminals can copy genuine templates and use information from an exposed client file.

For a payment change, a reply to the same email thread isn’t independent verification. The person controlling the mailbox can answer it. Use contact details already held in your approved records.

Phishing Email Examples Brokers See

These fictional examples show how an ordinary brokerage task can become a phishing request. The safe response checks the task outside the message.

Email theme	Example request	What to do
Fake lender portal	“Your broker access will expire. Sign in now to keep this application moving.”	Open the lender portal from your bookmark and check for a real notice. Call the lender through a known contact if needed.
Aggregator login	“Re-authenticate your account to release this month’s commission statement.”	Open the aggregator portal separately. Don’t enter your password or a one-time code through the email link.
DocuSign request	“Your client’s signed documents are ready. Download this viewer to open them.”	Confirm the expected document with the sender through a known channel. Use the signing service directly and leave the download alone.
Invoice or settlement change	“Our bank account has changed. Please use these details for today’s payment.”	Hold the payment. Call the known payee to verify the account change and obtain the required second authorisation.

DocuSign’s fraud alerts describe attacks involving genuine platform notifications that lead recipients to malicious downloads. A notification from a real service can still contain a harmful request.

Keep the client reference and request details when you escalate an example to your security contact. Avoid circulating client documents across the whole team as a warning.

Report Phishing in Outlook and Gmail

Report suspected phishing through your mail service and your brokerage’s internal security channel. If you entered credentials or sent money, start the response steps in the next section immediately.

Outlook

In supported Outlook versions with Microsoft’s built-in reporting enabled, use this sequence:

1. Select the suspicious message in the message list.
2. Choose Report, then Report phishing.
3. Follow any confirmation prompt and tell your internal security contact what happened.

Microsoft’s Outlook reporting instructions explain that the organisation controls whether reports reach its reporting mailbox, Microsoft or both. Reporting phishing deletes the message. Follow your evidence-preservation process before reporting an incident your team needs to investigate.

If Report is missing, use your organisation’s approved reporting button or contact your IT provider. In a shared mailbox, delegate permissions can affect whether the report reaches the reporting mailbox.

Gmail on a computer

Google’s Gmail phishing instructions give these steps:

1. Open the suspicious message without opening its links or attachments.
2. Beside Reply, select More, the three-dot menu.
3. Select Report phishing, then follow any confirmation prompt.

Tell your internal security contact separately if you interacted with the message. A mail-service report doesn’t secure an exposed account or stop a payment.

For suspicious contact, report the scam to Scamwatch, even if you avoided a loss. If money or personal information has been stolen, use the Australian Signals Directorate’s cybercrime reporting service as well. Contact the bank immediately when a payment or banking details are at risk.

What to Do If You Clicked

If you clicked a phishing link, stop interacting with the page and tell your security contact immediately. State whether you entered a password, approved a sign-in or downloaded a file. Those details determine the response.

1. Stop financial loss first. If money was sent or banking details were exposed, call the bank immediately using its official contact details. Ask it to stop the transaction.
2. Secure exposed accounts. From a trusted device, open the provider’s official site and change the password. Change reused passwords on other accounts too.
3. Have your administrator remove unauthorised access. Sign out active sessions and review recovery details. Check mailbox forwarding rules and connected apps, then enable or restore multi-factor authentication.
4. Escalate downloads. If you opened a file or installed software, stop using the device for client work and have your IT provider assess it for malware.
5. Preserve evidence and assess exposure. Record what happened and when. Identify affected client information, then warn relevant contacts through a trusted channel if your mailbox was used to target them.

The Australian Cyber Security Centre’s account recovery guidance explains the account controls. Its business email compromise recovery guidance also covers notifying contacts and recording the incident.

A click alone doesn’t establish a notifiable data breach. If your brokerage is covered by the Notifiable Data Breaches scheme, assess any suspected exposure of personal information promptly.

Under the OAIC’s notification rules, notification generally requires unauthorised access, disclosure or loss that’s likely to cause serious harm. Effective remedial action can prevent the breach meeting that test. An exposed mailbox containing identity documents needs assessment even if nobody reports missing money.

Take all reasonable steps to complete an assessment within 30 days of becoming aware of grounds to suspect an eligible breach. Notify the OAIC and affected individuals as soon as practicable once the breach is established, unless an exception applies. The OAIC’s assessment guidance explains the process.

Before returning to normal work, have your IT provider confirm the affected account and device are secured. Confirm that any payment alert and client-data assessment have an owner.

Train Your Team to Spot Phishing

Give staff a short routine they can follow during a busy settlement day. New starters need the same routine before handling client documents or payment instructions.

1. Show one redacted suspicious message in a team meeting. Ask staff what action it requests and which independent channel they would use to verify it.
2. Practise finding the mail service’s reporting control. Give staff the internal security contact through an approved staff channel so they don’t have to search during an incident.
3. Rehearse a payment-change call using a previously verified number. Require staff to explain who authorises the change before a payment proceeds.
4. Make prompt reporting the expected response to a mistake. Ask what the person clicked or entered so the response team can contain the incident.

For a free phishing-related test, use the Australian Cyber Security Centre’s business email compromise quiz. Discuss the answers together and apply them to your own lender and aggregator workflows.

Finish the exercise by asking each staff member to show where they report a suspicious email and explain how they verify changed bank details. If either action is unclear, fix the process before the next client payment.