Website Security for Independent Mortgage Brokers in the UK

What Independent Mortgage Brokers Hold

A mortgage broker's client file is one of the most comprehensive collections of personal financial data that any small business handles. By the time a case reaches submission, the broker typically holds copies of three to six months of payslips or accounts, three to six months of bank statements, a credit report, proof of identity (passport or driving licence), proof of address, details of existing debts and outgoings, and information about the property being purchased or remortgaged.

For self-employed clients, the file expands further: SA302s, tax year overviews, full accounts prepared by an accountant, and sometimes business bank statements going back two years. This is detailed enough to enable identity fraud, account takeover, and targeted social engineering against the client — which is why mortgage broker data is a meaningful target.

Independent mortgage brokers in the UK are regulated by the FCA and are data controllers under UK GDPR. The FCA's rules on systems and controls (SYSC) require firms to have appropriate arrangements to ensure the integrity of data used in regulated activities. The ICO's data protection framework applies to all personal data processed, and a breach involving financial documents carries high notification risk.

The Digital Attack Surface

**Client portals and document upload systems** — Most brokers now use a secure document upload link or a dedicated portal (Twenty7tec, Mortgage Brain, or a bespoke solution) to collect client documents. Where the portal is self-hosted or integrated into the broker's website, the security of the upload mechanism — how files are stored, how access is controlled, how long files are retained — is critical.

**CRM and case management access via the browser** — Web-based CRM platforms used by brokers (Salesforce, Hubspot, or sector-specific tools) are accessed through browsers on staff devices. Weak credentials or absence of MFA on these accounts gives an attacker access to the entire client record.

**Contact and qualification forms** — Initial enquiry forms often collect employment status, rough income figure, property value, and deposit amount — enough to build a targeted phishing profile of the prospective client.

**Email** — Mortgage advice and client communication happens heavily by email. Email is the most common channel for business email compromise attacks targeting property transactions, and for social engineering attacks that impersonate solicitors or lenders to redirect funds.

**Lender and sourcing system access** — Brokers access lender portals and sourcing systems (Trigold, Criteria Hub, lender extranets) through browsers. These accounts, if compromised, allow fraudulent applications to be submitted in the broker's name.

Fraud Risks Specific to Mortgage Broking

Conveyancing fraud and payment diversion

The mortgage process involves significant sums moving between client, solicitor, and lender. Attackers who gain access to email communications — either the broker's email or the solicitor's — can intercept communications at the point of completion and divert the client's deposit or the mortgage advance to an attacker-controlled account. This attack has caused losses running to hundreds of thousands of pounds in individual cases.

The broker is not the direct target in most of these attacks, but a compromised broker email account is a perfect launching point for an attack on the client — the broker's communication is trusted.

Fraudulent mortgage applications

A broker's lender portal credentials allow an attacker to submit mortgage applications. Combined with client data extracted from a compromised CRM, this enables application fraud using real client identities. Lenders attribute the submission to the broker's FCA number, creating significant regulatory exposure.

Targeted phishing against clients

Client data in a mortgage broker's CRM — income, property value, solicitor details — enables highly targeted phishing. A client who has just been through fact-find with their broker is primed to expect emails about their mortgage. A phishing email referencing their specific situation, appearing to come from the broker's domain, has a high success rate.

Email Security Configuration

DMARC at enforcement is a non-negotiable control for mortgage brokers. Without DMARC at `p=reject` or `p=quarantine`, your domain can be spoofed in emails to your clients. Given the sums involved in property transactions, a convincing spoofed email costs a client their deposit.

Check DMARC configuration at [mxtoolbox.com/dmarc.aspx](https://mxtoolbox.com/dmarc.aspx). If your record is missing or at `p=none`, fix it before anything else.

Practical Controls

Enable MFA on every platform: email, CRM, lender portals, document management. Review what your website's contact form collects and where it stores submissions. Check that document upload links expire after use rather than remaining accessible indefinitely. Ensure client files are deleted from web-accessible storage once a case is submitted.

The [GDPR website security requirements](/blog/gdpr-website-security-requirements-uk) guide covers the broader technical obligations that apply to FCA-regulated firms processing personal data. For understanding the cost and scope of a formal penetration test, [penetration test cost UK](/blog/penetration-test-cost-uk) has realistic figures across different engagement types.

Yrzo AI's automated security assessment scans your mortgage broker website across 54 technical checks — form security, authentication controls, email security configuration, HTTP headers, and SSL — and returns plain-language findings with remediation steps in minutes. From yrzoai.dev.