Insurance Hypothetical

Look what happened to this insurance agency, so it doesn't happen to yours

By FraudMeNot Team

Disclosure: This post contains no affiliate links. Some links on FraudMeNot may be affiliate links; if you buy through them, FraudMeNot may earn a commission at no extra cost to you. No product can guarantee you won't be scammed. Details.

Label: Hypothetical. "Hypothetical scenario." (Fictional agency, people, and events; the only real figures are the cited FBI statistics.)

General education only, not legal, financial, tax or security advice. No guarantee. Consult a qualified professional. Stories may be dramatized or composite; see each label.

The story (hypothetical)

A small independent agency gets a call. The caller says he's from a carrier's "producer support" team: "We're migrating portals today. I'll text you a code to confirm your login." The CSR reads the code back. The caller now has the agency's carrier-portal session.

Over the weekend, someone changes the payout bank details on a client's pending claim and asks for an "updated" commission deposit account by email, sent from a lookalike of the agency owner's address. On Monday, a client calls asking where the claim check went.

What's real behind it

• Phishing/spoofing was the most-reported crime type to the FBI's IC3 in 2025, with 191,561 complaints. (Source 1)
• Business email compromise, which includes payment-detail-change requests: 24,768 complaints and about $3.05 billion in reported losses in 2025. (Source 1)

The moment it could have been stopped

Reading a one-time code to an inbound caller. Real support staff don't need your code.

Tips (general)

1. Never share one-time codes. Hang up and call back using the number on the carrier's official site or your agency agreement.
2. Confirm any change to claim payee or bank details with the client on a known number.
3. Require two people to approve changes to commission or payout accounts.
4. Turn on MFA everywhere, and prefer app-based or key-based MFA over text codes where the carrier offers it.
5. Check your state's insurance data-security requirements with your own counsel or compliance advisor.

Sources

1. FBI IC3, 2025 Internet Crime Report, crime-type tables. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

Disclaimer. FraudMeNot content, including the Close Call Report, is general educational and awareness material only. It is not legal, financial, tax, compliance, or cybersecurity advice, and it is not a security service or assessment. Nothing here creates a professional or advisory relationship. Content is provided "as is" without warranties; it may contain errors or become outdated, and no step described can guarantee prevention of fraud or loss. Consult a qualified attorney, accountant, financial professional, or security provider about your specific situation. If you've been scammed, contact your bank immediately and report it at reportfraud.ftc.gov and ic3.gov.

Story labels. Stories may be dramatized or composite; see each label. Each story carries one label: Real, reported: nothing added or dramatized (based on public records, linked), Real, reported (based on public sources, linked; details may be dramatized), Composite/dramatized (based on common patterns; names, places and numbers are invented, and any resemblance to real persons or firms is coincidental), or Hypothetical. People named in reported cases who haven't been convicted are presumed innocent; allegations are only allegations.

AI disclosure. Narration is AI-generated (text-to-speech). Scripts are researched and reviewed by a person. Some visuals may be AI-generated or stock.

Affiliate/sponsor note. We may earn commissions or sponsorship fees; see disclosures in each item.

Affiliate/sponsor disclosure for this item: none (no affiliate links or sponsors).