Cybersecurity Risks and Challenges in the Digitized Mortgage Industry
A recent Arizent study reveals that despite rising cybersecurity risks and increased fraud exposure in the digitized mortgage industry—exacerbated by the pandemic and involving threats throughout the mortgage process—many mortgage leaders inadequately test their IT infrastructure, underestimate their vulnerability, and face significant financial losses, with only about half conducting regular penetration testing or breach simulations, highlighting a critical need for improved cybersecurity measures and potential future requirements from cyber insurance carriers.
Mortgage leaders are increasingly concerned about cybersecurity risks as the industry undergoes digital transformation, but many admit to not taking sufficient precautions, according to a recent Arizent study.
Key concerns include consumer behavior on mobile devices and the granting of data access to third parties. Despite these worries, only about half of respondents reported testing their own IT infrastructure's cybersecurity. This is a significant oversight, especially as fraud costs lenders more than four times the dollar amount lost.
JT Gaietto, chief security officer at Digital Silence, noted that many in the industry underestimate their susceptibility to cyber threats, often due to their size, reliance on outsourcing, or lack of awareness.
A LexisNexis Risk Solutions report found that the mortgage industry is more exposed to fraud than banks and other financial services. Threats occur throughout the mortgage process, from account creation and login to funds distribution. Fraudulent activity in acquiring housing was involved in five of the top six threats identified.
Since the onset of the coronavirus pandemic, the industry's exposure to fraud has increased significantly. In the first three quarters of 2021, every dollar of fraud loss cost lenders $4.40 in fines, legal fees, labor, and recovery expenses—nearly a dollar more than pre-pandemic levels. Firms reported an average of 1,431 fraud attempts per month in 2021, preventing 62% of attacks, but the volume remains higher than before the pandemic.
Mortgage and banking respondents reported better penetration testing practices than insurance carriers and wealth management firms: 54% said their organizations conduct periodic data breach simulations, and 47% routinely attempt to hack their own IT infrastructure, sometimes with third-party experts. Garry Woods, executive director of governance, risk, compliance, and policy at Richey May, suggested that cyber insurance carriers may soon require improved precautionary measures.
Woods stated, "For a lot of organizations you'll see a plan to bring those best services activities, it's going to help minimize the increase annually of cybersecurity insurance. I think you're going to see that number over the next three years increase significantly."
While companies are adopting digital business tools, this hasn't necessarily increased their confidence in security. Sixty-five percent of leaders told Arizent that faster payments and money transfers have increased cybersecurity risks. Among banking and mortgage respondents, 50% said mobile device use is increasing their risk profile, and 41% cited increased third-party data access as a vulnerability.
Most mortgage firms purchase, rather than build, their own mobile platforms, which exposes them to risks like the Apache Software Foundation Log4j vulnerability. Gaietto explained that such vulnerabilities are widespread and can disrupt entire lending platforms if software is not kept up to date.
Among banking and mortgage leaders, 49% identified spear phishing—fraudulent email attempts to deceive mortgagors for wire fraud—as a top cybersecurity threat. Woods described spear phishing as the industry's most common attack and noted a rise in bot attacks for companies allowing online loan applications, though only 31% of respondents saw this as a growing risk.
Insider threats, such as employees taking proprietary information when leaving the company, are also a concern. Fifty-one percent of respondents identified data breaches as a major concern for the future. Gaietto predicted that this threat would persist as profit margins shrink with rising rates.
Related
Multi-Signal Fraud Detection Benchmarks
Proof has developed a layered fraud detection model that combines passive signals, active checks, and collective telemetry from its Identity Authorization Network to outperform traditional passive-only methods by 600-1,300% in detecting sophisticated fraud without increasing user friction, addressing the shortcomings of standard approaches like MFA and KBA that are increasingly ineffective against targeted attacks.
The Trust Ledger: Why Digital Fraud Is Outpacing Trust and What We Can Do About It
The Trust Ledger report reveals that as digital interactions replace in-person trust, AI-driven identity fraud is rapidly increasing across all industries, necessitating continuous, layered verification methods combining biometrics, behavioral analysis, reusable digital credentials, and human oversight to effectively prevent fraud while maintaining user experience.
Top 10 Platforms Helping CUs Fight Fraud in 2026 | Proof | Proof
The article highlights the top 10 platforms credit unions should consider in 2026 to combat fast-moving digital fraud by combining identity verification and fraud intelligence, with the first platform, Proof, offering high-assurance identity verification through document and biometric checks, human review, fraud signal detection, reusable verification, and flexible integration to protect member experiences and secure high-risk transactions.
What Is Social Engineering in a Fraud Scheme?
Social engineering in fraud schemes involves manipulating human trust and emotions through tactics like phishing, spear phishing, and pretexting to deceive individuals into revealing sensitive information or granting unauthorized access, exploiting their natural instincts to be helpful and responsive under pressure.
Why KYC Alone No Longer Stops Fraud
KYC, originally designed for regulatory compliance to verify customer information at onboarding, is no longer sufficient to prevent fraud because modern fraudsters use synthetic identities, credential reuse, and AI-generated documents to pass these checks, necessitating ongoing identity assurance beyond initial KYC to confirm that customers are truly who they claim to be during all subsequent actions.
Top 3 Types of Digital Identity Fraud | Proof
Digital identity fraud, increasingly prevalent and harmful, primarily involves financial, medical, and child identity theft where criminals exploit stolen personal data to commit unauthorized financial transactions, corrupt health records, and misuse children's clean credit histories, with early detection through credit monitoring and prompt reporting to authorities being crucial for individuals and businesses vulnerable to these attacks.