A familiar client name. A familiar application. An urgent request.
Nothing about the email immediately looks unusual, and that is exactly what makes it dangerous.
One Click Can Become a Much Bigger Problem
Imagine an administrator receiving what appears to be a routine email from a client. The subject line matches a live application, and the message explains that updated bank statements are attached. Settlement is approaching, so the documents need to be processed urgently.
The administrator is about to open the attachment when one small detail feels wrong: the client normally emails from a different address.
Instead of replying to the message or opening the file, the administrator pauses and calls the client using the phone number already recorded in the CRM.
The client confirms they did not send the email.
That one decision changes the entire outcome. The incident can be escalated, potentially affected records and access can be investigated, and the suspicious attachment remains unopened.
Cyber resilience is often tested in moments exactly like this. Open, forward, download or verify?
The Numbers Show Why That Pause Matters
Cyber incidents are not unusual events sitting somewhere at the edge of business risk.
New Zealand’s National Cyber Security Centre recorded 7,122 cyber security incident reports in 2023/24, including 343 incidents assessed for specialist technical support because of their potential national significance. During the same period, the NCSC published 11,386 phishing indicators through its Phishing Disruption Service and reported $21.6 million in financial losses through incidents handled by its general triage process.
The threat has continued. In the first quarter of 2025 alone, the NCSC handled 1,292 incidents, including 440 phishing and credential-harvesting incidents, a 15% increase from the previous quarter.
Fraud figures make the human element even clearer. According to New Zealand’s Ministry of Business, Innovation and Employment, $265 million in reported fraud was recorded across 12 banks over a 12-month period. Around $126 million involved authorised payments, where people had been deceived into approving transactions themselves.
Technology matters, but so does the person sitting in front of the screen.
Most Controls Start as Habits Before They Become Technology
The Financial Markets Authority’s Cyber-resilience in FMA-regulated financial services guidance describes cyber risk as including loss, disruption or damage caused by failures in IT systems arising from both internal and external threats. It also encourages financial market participants to assess cyber risk as part of wider risk management and to use recognised cybersecurity frameworks.
For a financial advice provider, sophisticated security technology is valuable, but everyday behaviour still matters.
A convincing phishing email does not necessarily announce itself with bad spelling or an obviously strange sender. It may arrive at the right time, mention something familiar and create just enough urgency to encourage someone to act before checking.
The strongest habit is simple: pause and verify.
Give Staff a Safe Next Move
Telling staff to “be careful” is not enough. People should know exactly what to do when something does not look right.
Verify unexpected requests independently. Use contact information already stored in the CRM or another trusted system rather than a phone number, email address or link supplied in the suspicious message.
Leave suspicious attachments alone. Do not open, download or forward an attachment simply to determine whether it is legitimate.
Keep client information inside approved systems. Sensitive documents should not drift into personal email accounts, unapproved storage or other systems outside the FAP’s established controls.
Escalate early. Staff should know the specific internal, security or technology contact to notify when something appears wrong.
Record what happened. Capture what was received, what actions were taken and what information or systems may have been accessed so the incident can be properly assessed.
Not every suspicious message will become a regulatory incident. The appropriate reporting response depends on the organisation’s obligations and the particular circumstances. What should not be uncertain is what staff do first.
Access Should Match the Work
Information security is also built into ordinary administration.
Unique user accounts, appropriate permissions, secure devices, locked screens, careful identity verification and prompt removal of access when it is no longer required can all reduce unnecessary exposure.
The principle is straightforward:
Give people enough access to perform their role, not every permission the system can provide.
That becomes particularly important when external or offshore support teams are involved. Access should be connected to the work being performed, supported by clear document-handling expectations and backed by a defined escalation process.
For A-Perform, this means support can operate within the FAP’s approved access and document-handling controls, using monitored equipment and defined escalation steps. The FAP, however, remains responsible for its security decisions, assessment of incidents and applicable regulatory obligations.
Cyber Resilience Is Also Operational Resilience
The Financial Markets Authority describes the interconnected nature of financial services as meaning that one part of the sector could potentially become an entry point for a wider cyber incident.
That is why information security should not sit only with the IT team.
Administrators handling client documents, advisers communicating with clients, support staff accessing systems and managers approving processes all form part of the organisation’s security environment.
The objective is not to make staff afraid to open an email.
It is to make verification a normal part of doing the job.
Practical Takeaway: Try the 10-Minute Test
Run a short suspicious-email exercise with your team.
Give them a realistic message involving a client, an attachment and an urgent request. Then ask three questions:
Who do you contact?
What should you avoid clicking or opening?
How do you independently verify the request without relying on the information contained in the suspicious email?
If everyone can answer those questions confidently, you’ve turned information security from a policy people read into a behaviour people can actually use.
Because sometimes the difference between a suspicious email and a serious incident is simply one person deciding to pause before they click.
