For a mortgage adviser the risk turns on one moment: the weeks around completion, when large sums are transferred on the basis of details that go back and forth by email.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A mortgage file contains a copy of the identity document, payslips, an employer's statement, bank statements, details of current credit and the valuation of the property. That is not just a collection of personal data; it is the complete set needed to pass yourself off as someone else. A breach therefore gives rise not only to a duty to report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours, but also to a real risk of identity fraud affecting your client, with consequences that run on for years.
Then there is the moment of the transaction. Around completion there is communication about the client's own contribution and the notary's bank account number, usually by email. Anyone reading along in a mailbox only has to send a message with a changed account number at the right moment. Nothing is encrypted and nothing is stolen; money is transferred. That is social engineering and it falls not under ordinary cyber cover but under a separate fraud module with its own limit and its own conditions.
You also keep these files for a long time, because your regulated services require you to be able to show how you arrived at your advice. Clearing out is therefore only possible to a limited extent and the archive keeps growing. Insurers ask about the storage of identity documents, about the use of a secure client portal instead of email attachments, and about multi-factor authentication. Incorrect answers affect the duty of disclosure under Article 7:928 of the Dutch Civil Code and the consequences in Article 7:930 of the Dutch Civil Code.
What does cyber insurance for mortgage advisers cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
The fraud happens to your client, not to you
If the client transfers his own contribution to an account number taken from a forged email, he has lost the money and you are the one held responsible. The question is then whether the message came from your mailbox and whether you should have verified the change. So make it a rule that every change of bank details is confirmed by telephone using a number known in advance, and keep the evidence of that check.
Documents should not be exchanged as email attachments
Payslips and identity documents sent round as attachments stay in mailboxes for years, including the client's. If an account is compromised, the whole file is exposed. A secure upload portal limits that and is taken into account by insurers at the acceptance stage. Also ask how long your advice software keeps documents in temporary storage and whether that storage is included in the investigation.
Message traffic with lenders is a separate line
Applications and documents go to the lender through standardised message traffic. If that connection is down or your certificate is compromised, applications and with them completion dates are pushed back. Any early repayment penalty or expired offer that follows is financial loss for the client and is assessed on your professional indemnity insurance (BAV), not on the cyber policy. Make sure the two covers join up.
What falls outside the cover
Not covered are administrative fines of a punitive nature, the amount your client pays out voluntarily, the early repayment penalty on a missed completion date and improving your systems afterwards. Payments made without the verification prescribed in the policy are refused, as are intent and wilful recklessness under Article 7:952 of the Dutch Civil Code. Physical damage to equipment belongs under the business contents cover.
What does your premium depend on?
Number of advice files per year. Determines both the size of your archive and the number of transaction moments at which fraud can occur.
Size of the archive kept. Because you have to be able to substantiate your advice, the file of identity documents keeps growing.
Limit of the fraud module. In this sector it is a matter of a few large amounts. The sub-limit matters more than the main limit.
Documented verification procedure. Checking changes of bank details by telephone is a condition for that module at many insurers.
Secure client portal. Exchanging documents through a portal instead of by email reduces the exposure considerably.
Email security. Multi-factor authentication and checks on forwarding rules in mailboxes are conditions of acceptance here.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Our client transferred his own contribution to a false account number. Is that covered?
Only if the fraud or social engineering module is included and the claim is against you. The main cover of a cyber policy applies to attacks on your systems, and here nobody has broken in but someone has been deceived. The insurer also investigates whether the message went through your mailbox and whether your verification procedure was followed. If there is none, refusal often follows.
An outage makes us miss the completion date. Which policy handles that?
That is assessed on the professional indemnity insurance (BAV). The loss consists of financial loss to the client, for example an expired interest offer, and the complaint concerns your services. The cyber policy pays for restoring your systems, the forensic investigation, the costs of the duty to report and your own interruption during that period.
How long do we have to keep these files?
You have to be able to substantiate your advice, so the file stays in place for years after completion. That does not mean everything has to be kept: you may often record less of identity documents than you think. Limit copies to what is genuinely necessary and store them encrypted. That reduces the size of a breach immediately.
Our client is a victim of identity fraud after a breach at our office. What does the policy pay?
The third-party section handles claims from individuals arising from the breach, including the costs of defence. Many policies also pay for support to those affected, such as help in restoring their identity details. Report the incident as soon as you become aware of it; Article 7:941 of the Dutch Civil Code requires you to report an event without undue delay.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
