Phishing scams that impersonate insurers

A phishing message pretending to be your insurer is built to make you click a link, call a number or send a payment before you think. The safest rule is also the simplest: never act on the message itself. Close it, then reach the company through the phone number on your policy documents or the website address you already use, and ask whether anything is actually wrong.

The Federal Trade Commission lists the usual tells on its phishing guidance: unexpected messages claiming suspicious activity or an account problem, generic greetings, unrecognized invoices or payment links, and links asking you to update payment details. It adds that legitimate companies do not send links like that by email or text.

The messages homeowners actually get

Insurance phishing follows the calendar of the policy. These are the common versions, described as patterns, not as quotations from any real campaign.

Attackers know that most homeowners have only a few touchpoints with an insurer a year, so a message arriving at renewal or just after a storm can be believable. They also use real details, such as your name, your address or the insurer you actually use, taken from public records or an earlier data breach, which is why a correct detail is not proof that a message is genuine.

Mortgage and closing scams that touch insurance

Two variants cost people the most because the amounts are large.

Redirected payment instructions. A message appearing to come from your agent, escrow officer or mortgage servicer says that payment details have changed and asks you to wire a premium or closing amount to a new account. Verify any change by calling a number you already have, not the one in the message. The risk is highest when you are buying a house, when many documents and many emails are moving at once; see getting homeowners insurance when you buy a house and insurance binders and proof of insurance at closing.

The insurance-lapse notice. A letter or text claims your policy lapsed and a "lender-placed" policy will be charged unless you act. Real force-placed notices exist, but they come from your mortgage servicer by mail, referencing your loan number. If you receive one, call the servicer on the number on your mortgage statement, then call your insurer to confirm the status of your policy.

A five-second test

1. Who contacted whom? If you did not start the conversation, you have no reason to trust the sender.
2. Is there a deadline? A threat of immediate cancellation or a claim "expiring" is pressure, not process. Real cancellations come with written notice and a state-specific period, covered in cancellation for nonpayment and reinstatement.
3. Where does the link go? On a computer, hover over it; on a phone, press and hold. A look-alike address (an extra word, a different ending, a misspelled name) is a giveaway. Better yet, do not click at all.
4. What does it want? Passwords, one-time codes, card numbers or a Social Security number should never be requested by text or email.
5. How does it want payment? Gift cards, wire transfers, cryptocurrency, and payment apps are red flags. Insurers take premiums through their own portals, by mail, or through your lender's escrow.

If you clicked or replied

1. If you entered a password, change it now at the real site, and anywhere else you reuse it. Turn on multi-factor authentication. The FTC's guidance recommends it because a stolen password alone then cannot open the account.
2. If you gave a card or bank number, call your card issuer or bank and ask them to freeze or replace it. Dispute any charges.
3. If you clicked a link or opened an attachment, update your security software and run a scan, as the FTC advises.
4. If you gave out a Social Security number or other identity details, go to IdentityTheft.gov for the FTC's recovery steps tailored to what was exposed, and consider a credit freeze.
5. If you sent a wire, call the bank immediately and ask for a recall; speed matters, and you should also report to the FBI's Internet Crime Complaint Center at ic3.gov.
6. Call your insurer at the number on your declarations page and confirm that the policy and any claim are intact. Tell them what happened so they can watch your account.

Reporting

The FTC says to forward phishing emails to the Anti-Phishing Working Group at [email protected], forward phishing texts to 7726 (SPAM), and report the attempt to the FTC at ReportFraud.ftc.gov. After reporting, delete the message. If the scam used an insurer's name, tell that insurer; most have a fraud or security contact on their websites. If an agent's or adjuster's identity was used, tell your state department of insurance through the NAIC's state directory and see how to check an agent's or adjuster's license.

How a real insurer contacts you

You can expect legitimate contact to be consistent: a claim number you already received, an adjuster whose license you can look up, and payment through a check, a direct deposit set up by you, or a portal you reached on your own. The details of how claim payments really arrive, including the lender's role, are in claim checks, holdbacks and when the money arrives and why your mortgage company is on the claim check. A claim never requires you to pay money to receive money.

Key takeaways

• Do not act on an unexpected message; contact the company using a phone number or website you already know.
• Phishing aimed at homeowners tracks the policy calendar: renewal, lapse and force-placed warnings, and claim-payment notices after a storm.
• Be most careful with any message that changes where you should wire a premium or closing payment; confirm by phone first.
• If you clicked, change passwords, turn on multi-factor authentication, call your bank, and follow the FTC's steps at IdentityTheft.gov.
• Report to the FTC at ReportFraud.ftc.gov, forward texts to 7726, forward emails to [email protected], and tell your insurer.