Wire Fraud Won’t Wait.
Neither Should Your Security.

Business Email Compromise

An attacker spoofs your CFO’s email and instructs your accounts payable team to wire $80,000 to a “new vendor account.” By the time anyone notices, the money is gone. BEC is the #1 financial fraud vector — and financial organizations are the most targeted industry.

Average BEC loss: $125,000+ per incident

Hacked Staff Accounts

A loan officer clicks a phishing link. Their credentials are harvested. Now an attacker has access to your loan origination system, borrower PII, and email for weeks before anyone notices. No MFA. No alerting. No way to know how much data walked out.

Mean time to detect account breach: 207 days

Weak or Misconfigured Firewall

Your firewall was set up years ago and hasn’t been touched since. Default credentials. No IDS/IPS. Rules that were added “temporarily” and never removed. Attackers scan for exactly this — exposed management ports, outdated firmware, open RDP — and they find it fast.

GLBA requires documented network security controls

GLBA Compliance Gaps

The FTC’s updated GLBA Safeguards Rule requires a written information security program, qualified individual oversight, annual penetration testing, and multi-factor authentication — by name. Many community lenders aren’t there yet. An exam finding or breach exposes you to FTC enforcement, litigation, and CDFI Fund scrutiny.

Updated GLBA Safeguards Rule: effective since June 2023

We’ve Worked BEC Incidents. We Know What Breaks.

Most IT firms hand you a firewall and call it done. We’ve been brought in after the wire fraud happened — after the accounts were compromised, after the phishing email got clicked. We know how these attacks unfold because we’ve cleaned them up.

That experience shapes everything we build for financial clients. We don’t just check compliance boxes — we close the specific gaps that attackers exploit in organizations with thin IT staff and real wire transfer exposure.

Talk to Lewis IT About Your Exposure →

GLBA Safeguards Rule

The FTC’s updated rule requires a written information security program with 9 specific safeguards — including MFA, encryption, annual pen testing, and a designated Qualified Individual. Applies to any financial institution.

Bank Secrecy Act Controls

BSA/AML compliance depends on the integrity of your transaction systems and the identities using them. Compromised credentials or tampered audit logs can create regulatory exposure during FinCEN examinations.

CDFI Fund Requirements

CDFI Fund certification and award compliance increasingly includes data security expectations for organizations handling federal award dollars. A breach affecting borrower data can jeopardize program status and future awards.

Maryland PIPA

Maryland’s Personal Information Protection Act requires notification of affected individuals within 45 days of a breach involving SSNs, financial account numbers, or other covered PII. Your incident response plan must be ready before the breach happens.

Email Security & Anti-BEC Controls

DMARC, DKIM, and SPF enforcement stops domain spoofing cold. AI-powered email filtering catches the impersonation attacks that get past standard spam filters. Executive impersonation alerts and wire transfer verification workflows reduce human error.

Multi-Factor Authentication (MFA) Deployment

MFA is now required under GLBA. We deploy it across email, VPN, loan systems, and remote access — with phishing-resistant options (FIDO2) for high-value accounts. Staff onboarding included.

Firewall & Network Security

Firewall audit and hardening, network segmentation between staff and sensitive systems, IDS/IPS activation, and ongoing rule management. We eliminate the “set it and forget it” firewall that most community lenders are running.

Endpoint Detection & Response (EDR)

Next-gen EDR on every workstation and server — with 24/7 SOC monitoring. We catch the credential-harvesting malware, the reconnaissance tools, and the lateral movement that traditional antivirus misses entirely.

GLBA Written Information Security Program

We draft and maintain your WISP, risk assessment, vendor management inventory, and incident response plan — the full documentation package required under the updated GLBA Safeguards Rule. Living documents, not a one-time filing.

Security Awareness Training

Phishing simulation campaigns and monthly training modules focused on financial-sector attack scenarios — wire fraud verification, executive impersonation, fraudulent invoice schemes. Annual GLBA training requirement covered.

Breach Response & Incident Remediation

If you’re in an active incident — or think you might be — call us. Forensic triage, attacker eviction, wire recall coordination, regulatory notification prep under Maryland PIPA, and post-incident hardening. We’ve been here before.

Managed IT Support & Helpdesk

Day-to-day IT support for your staff — hardware, software, email, network. Flat-rate pricing, fast response. So your small team isn’t also your IT department.