One Click Can Cost Millions: Cybersecurity Risks for Mortgage Loan Originators

Many mortgage loan originators (MLOs) assume cybersecurity is primarily the responsibility of the company’s IT department. In reality, MLOs are often the first line of defense—and sometimes the greatest point of vulnerability.

Mortgage originators routinely handle highly sensitive nonpublic personal information (NPI), including:

• Tax returns,
• Pay stubs,
• Bank statements,
• Credit reports,
• Social Security numbers,
• Driver’s licenses, and
• Wire transfer information.

Because MLOs communicate constantly through email, mobile devices, cloud platforms, CRMs, and third-party applications, they are common targets for phishing, wire fraud, business email compromise, and social engineering attacks.

The DOJ’s Civil Cyber-Fraud Initiative increases pressure on mortgage companies to ensure employees—including originators—actually follow cybersecurity policies and procedures. If a company claims it has cybersecurity protections in place but employees routinely ignore them, regulators and investigators may view those representations as misleading or false.

Examples involving MLOs could include:

• Sharing borrower documents through unsecured methods,
• Using personal email accounts for loan files,
• Weak or reused passwords,
• Failure to use multi-factor authentication,
• Clicking phishing links that expose borrower data,
• Improper storage of borrower information on personal devices,
• Ignoring company cybersecurity training or policies, or
• Failing to report suspicious activity or potential breaches promptly.

MLOs should also understand that cybersecurity failures can overlap with existing legal obligations under:

• The Gramm-Leach-Bliley Act (GLBA),
• FTC Safeguards Rule,
• State privacy and data breach laws,
• Company information security policies, and
• Federal and state consumer protection laws.

In practical terms, cybersecurity has become part of professional compliance responsibility for mortgage originators—similar to anti-money laundering, fair lending, and privacy compliance.

For today’s MLO, cybersecurity awareness is no longer optional. Borrowers expect their personal financial information to be protected, and regulators increasingly expect companies to demonstrate that employees are properly trained, monitored, and following security procedures consistently.