DMARC stands for Domain-based Message Authentication, Reporting and Conformance. In plain terms, it is a technical email security standard that tells receiving mail servers what to do when an email claims to be from your domain but fails authentication checks. Without an active DMARC policy, a scammer can send an email that appears to come from your address with little technical barrier stopping it from reaching your client’s inbox.

To check your current status, ask your IT provider or email administrator the following: “Do we have a DMARC record published for our domain, and is it set to quarantine or reject unauthenticated messages rather than just monitor them?” Also ask them to confirm that SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are correctly configured, as DMARC depends on both being in place to function effectively. These three together form the baseline of email authentication for any professional firm handling client communications and financial instructions.

This is an area where the law is still developing in Australia, but the risk is real and should not be underestimated. If a client suffers a financial loss as a result of a spoofed email purporting to come from your firm, and it can be shown that your firm failed to take reasonable steps to prevent impersonation, you may face a civil claim from the client. Under the Corporations Act 2001 and the Australian Consumer Law, operating in a way that allows misleading representations to be made in your name, even where you were not the author, can create liability depending on the circumstances.

ASIC has also signalled that cybersecurity governance is a licensee obligation, not just an IT matter. An AFS licensee that cannot demonstrate it had reasonable fraud prevention measures in place, including email authentication, client communication protocols, and staff training, faces potential regulatory scrutiny in addition to the civil exposure. Review ASIC’s guidance on cyber resilience for financial services at asic.gov.au. Seek your own legal or compliance advice on your specific exposure.

Yes. Under the Australian Financial Services licensing regime and ASIC’s Regulatory Guide 271 on internal dispute resolution, AFS licensees are required to have a clearly accessible complaints process and must acknowledge and respond to complaints within defined timeframes. ASIC RG 271 requires complaints to be acknowledged within one business day where received electronically, including by email, and resolved within 30 calendar days for most complaints, or 45 days for superannuation-related matters.

The email address used for complaints on your website or in your Financial Services Guide must be actively monitored, not a passive inbox that goes unchecked. Using a dedicated complaints@ address is good practice, but it only works if someone is responsible for monitoring it daily. Confirm with your compliance manager or licensee that your complaints email is mapped to a monitored inbox and that your internal dispute resolution policy reflects the current RG 271 requirements. Review ASIC Regulatory Guide 271 for full obligations. Seek your own legal or compliance advice.

Professional indemnity (PI) insurance covers claims arising from errors or omissions made in providing professional services. A spoofed email scenario, where a fraudster impersonates your firm and deceives a client into transferring funds, does not typically arise from an error in your professional advice. It is a cybercrime event, which means a standard PI policy is unlikely to respond to the client’s loss. The cover most relevant to this scenario is a combination of cyber liability insurance, which may cover your firm’s costs in responding to the incident, and crime or fraud insurance, which may cover direct financial losses caused by social engineering or impersonation fraud.

Whether any of these policies actually pay out depends heavily on the specific policy terms, the circumstances of the fraud, and whether your firm can demonstrate it had reasonable preventative measures in place. Ask your insurance broker: “If a client transfers funds in response to a spoofed email impersonating our firm, which of our policies responds to the client’s loss, and which covers our own costs?” This is general information only and not insurance or legal advice.

Proactive client education does not provide a legal shield, but it is relevant to demonstrating that your firm took reasonable steps to protect clients from foreseeable harm, which is a factor regulators and courts consider when assessing whether a business met its duty of care. Under the Privacy Act 1988 and the broader obligations on AFS licensees, firms are expected to take reasonable steps to protect client information and to manage foreseeable risks. Documenting that your firm regularly communicated fraud warnings through email signatures, newsletters, or client communications creates a contemporaneous record that reasonable precautions were taken.

This is particularly useful if the matter is ever reviewed by the OAIC, ASIC, or in civil proceedings. Keep records of when these communications were sent and what they said. The Australian Cyber Security Centre also publishes guidance for businesses on scam prevention that can inform your client communication approach at cyber.gov.au. Seek your own legal or compliance advice on what constitutes reasonable precautions for your firm’s specific client base and risk profile.