Penetration Testing for Mortgage Brokers UK — Why FCA-Regulated Firms Need Security Testing

The Data Mortgage Brokers Hold Makes Them High-Value Targets

A mortgage broker's client file is a comprehensive financial dossier. It contains full name and date of birth, National Insurance number, employment history, payslips and bank statements, credit history, existing debts and financial commitments, and property valuation details. In the wrong hands, this data enables identity fraud, mortgage fraud, and account takeover attacks that can devastate a client's financial life.

Mortgage brokers are also FCA-regulated, which means they operate under both the FCA's regulatory requirements and GDPR's data protection obligations. A security breach is not just a reputation problem — it triggers mandatory reporting obligations and potential enforcement action from two separate regulators.

Regulatory Context for UK Mortgage Brokers

**The FCA's Senior Managers and Certification Regime (SM&CR)** creates personal accountability for cybersecurity at the senior manager level. If your firm suffers a significant cyber incident and it can be shown that reasonable steps were not taken to protect client data, senior managers face personal consequences — not just the firm.

**FCA Operational Resilience Policy** requires regulated firms to identify their important business services and set impact tolerances for disruption. A ransomware attack that takes your case management system offline for a week is an operational resilience failure.

**GDPR Article 32** requires "appropriate technical and organisational measures" proportionate to the risk. For a firm handling the volume and sensitivity of data that mortgage brokers process, the ICO would expect regular security testing — not a one-time assessment years ago.

**ICO enforcement in financial services:** The ICO has fined financial services firms for inadequate security measures. DSG Retail (Currys) received a £500,000 penalty for a point-of-sale attack that affected millions of customers. While mortgage brokers are smaller, the principle applies: the ICO expects security measures proportionate to the data processed.

Common Attack Vectors Against Mortgage Broker Websites

Client Portal Vulnerabilities

Many mortgage brokers offer client portals where borrowers upload payslips, bank statements, and ID documents. These portals are high-value targets. Common vulnerabilities include:

**Insecure direct object references:** Client document IDs that are guessable or sequential. If you can access `portal.yourfirm.com/documents/10245`, can you access `portal.yourfirm.com/documents/10244`? If so, you have a serious data exposure.

**Unrestricted file upload:** Document upload functions that accept any file type can be abused to upload malicious scripts (web shells) if the server executes uploaded files.

**Broken access control:** A client who logs in to view their own documents should not be able to view another client's documents by manipulating URL parameters or API calls.

CRM and Case Management System Exposure

Smaller mortgage broking firms often use cloud-based CRM or case management software. If admin credentials are weak, shared, or reused, attackers with access to one set of credentials can access the firm's entire client database.

Phishing Targeting Staff

Mortgage brokers are attractive targets for business email compromise (BEC) attacks. A convincing phishing email that captures a staff member's email credentials gives the attacker access to client communications, document requests, and potentially banking instruction emails — the precursor to authorised push payment fraud where lenders or solicitors are tricked into sending funds to fraudulent accounts.

Third-Party Software Vulnerabilities

Many mortgage broker websites use WordPress with specialist financial services plugins, or white-label platforms from lead generation providers. Vulnerabilities in these platforms affect every firm using them — and attackers know this.

What a Penetration Test of a Mortgage Broker's Web Presence Covers

A security assessment for a mortgage broker typically includes:

**Client portal testing:** IDOR vulnerabilities on document access, authentication strength, session management, and file upload security.

**Authentication and access control:** Password policy, brute force protection on login endpoints, MFA availability and enforcement, password reset flow security.

**Form security:** Enquiry forms, application forms, and document upload forms tested for SQL injection, XSS, and file handling vulnerabilities.

**Third-party integration security:** How the website communicates with your CRM, case management system, or lender APIs — whether API keys are exposed in client-side code, whether endpoints are authenticated.

**Information disclosure:** Sensitive information visible in page source, HTTP response headers, or error messages — staff email addresses, internal system names, software versions.

**SSL/TLS configuration:** Certificate validity, protocol version, cipher suite strength — especially important for client portal communications.

The FCA's Expectations on Security Testing

The FCA does not publish a prescriptive list of required security tests. But FCA supervisory visits and Dear CEO letters make clear that the FCA expects:

- Regular assessment of cyber risks proportionate to the firm's data processing activities - Testing of controls, not just documentation of controls - Evidence that findings are remediated, not just logged

A penetration test report — especially one showing both findings and remediation — is the kind of evidence that satisfies supervisory enquiries and demonstrates a functioning security programme.

Practical Steps for Mortgage Broking Firms

**Start with automated scanning.** An automated security scan of your website and client portal surfaces the most common vulnerabilities — IDOR, XSS, SQL injection, broken authentication — quickly and inexpensively. Yrzo AI's scanner runs 44 OWASP checks and delivers a plain-English report in under 20 minutes, at £399 per scan.

**Commission a manual penetration test for your client portal.** If your portal handles client financial documents, it warrants a manual test from a CREST-accredited firm. Budget £4,000–£8,000 for a focused web application test. The report is evidence for FCA supervisory purposes.

**Enforce MFA on all staff accounts.** Every email account, CRM login, and case management system should require MFA. A single compromised password should not be sufficient to access client data.

**Review your third-party suppliers.** Under GDPR, you are responsible for the security of processors you share data with. Ask your CRM provider and case management software vendor for evidence of their security testing.

**Document everything.** A security test you did not document did not happen from a regulatory perspective. Keep scan reports, remediation logs, and evidence of fixes.

The combination of FCA regulation, GDPR obligations, and the sensitivity of client financial data makes mortgage broking one of the UK sectors where security testing is least optional and most overlooked.