GLBA pretexting rule: how do advisers stop social engineering?

What does the GLBA pretexting rule prohibit?

The GLBA pretexting rule prohibits obtaining a financial firm's customer information by lying for it. Under 15 U.S.C. 6821(a), it is a violation to obtain, or attempt to obtain, customer information of a financial institution by making a false, fictitious, or fraudulent statement to an officer, employee, or agent of the institution, by making one to a customer of the institution, or by handing staff a document the person knows is forged, counterfeit, lost, or stolen.

At an RIA or broker-dealer, the person being lied to is usually an operations associate or client service lead trying to help someone who sounds like a client.

The provision also reaches whoever hires the work out. Section 6821(b) makes it a violation to ask someone to obtain customer information while knowing they will use one of those methods. The definitions in section 6827 are broad. Customer information means any information maintained by or for a financial institution that is derived from the customer relationship and identified with the customer. A document is "any information in any form." Brokers, dealers, investment advisers and investment companies all fall within the statute's definition of a financial institution.

Why is pretexting called GLBA's forgotten provision?

Pretexting is called GLBA's forgotten provision because most firms build their programs around GLBA's privacy notices and the safeguards duty in 15 U.S.C. 6801(b), and file pretexting away as a criminal matter for someone else. The penalties do point at the fraudster. Section 6823 provides for fines and up to five years in prison for knowing and intentional violations, and up to 10 years with doubled fines when the violation happens alongside another federal crime or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period.

The part aimed at your firm is one sentence long. Section 6825 directs each federal banking agency, the National Credit Union Administration, and the Securities and Exchange Commission "or self-regulatory organizations, as appropriate" to revise their rules as needed so that financial institutions have "policies, procedures, and controls in place to prevent the unauthorized disclosure of customer financial information and to deter and detect activities proscribed under section 6821." Defending against pretexting is a regulatory expectation of the firm, separate from any case against the caller.

Where does pretexting show up in Reg S-P?

In two places: the safeguards policies and the incident response program. 17 CFR 248.30(a) requires written policies and procedures reasonably designed to "protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer." A caller who talks an operations associate into reading out an account number and home address has gained unauthorized access, even though no system was breached.

Since the 2024 amendments, the same section also requires an incident response program "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures." When sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, affected individuals must be notified as soon as practicable and no later than 30 days after the firm becomes aware of it, unless a reasonable investigation shows the information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. A successful pretext call belongs in that assessment process like any other incident.

State-registered advisers generally fall under the FTC Safeguards Rule instead, which requires security awareness training that is updated to reflect the risks the firm identifies, under 16 CFR 314.4(e).

What are examples of pretexting at an advisory firm?

Pretexting at an advisory firm usually looks like a routine service request from someone who already knows a lot about the client. FINRA's 2026 Annual Regulatory Oversight Report describes account impersonation in which criminals use "stolen customer information in combination with a compromised or spoofed email address" to request actions such as third-party wire transfers. The same report lists GenAI-enabled fraud, including deepfake audio and video, among the threats member firms face. Typical patterns include:

• A caller posing as a client asks staff to confirm an address, account numbers or recent balances for a loan application.
• An email from a client's real but compromised address asks to change the bank account on file before a distribution.
• Someone claiming to be a client's CPA or estate attorney asks for statements and says the paperwork is on the way.
• A caller posing as IT support asks an employee to approve a sign-in prompt or read back a one-time code.

Each of these goes through a person. The statute names officers, employees, agents and customers as the people a pretexter lies to, and technical controls on their own do not protect them.

Which controls deter and detect pretexting?

The controls that deter and detect pretexting are verification steps staff follow every time, and records showing they did. The "deter and detect" language in section 6825 translates into a short list of controls an examiner can test:

• Callback verification, using a number already on file, for any request to change contact details, bank instructions or account access. Never use a number supplied in the request.
• A written list of information staff will not disclose by phone or email until the caller's identity is verified.
• Out-of-band confirmation for third-party wires and changes to standing instructions. FINRA's report lists verifying email addresses and signatures for third-party transfers as an effective practice.
• Help desk rules for staff password resets and multifactor authentication re-enrollment, with identity checks your IT provider is contractually required to follow.
• Security awareness training that uses current lures, including voice and video impersonation, refreshed when the risk assessment changes.
• A record of each verification step, so the firm can show that the procedure ran.

What should firms do this quarter?

Start by testing how easily a stranger could get client information out of your firm. These steps fit into one quarter:

• Pull the last 90 days of client change requests (address, email, bank, beneficiary) and check whether each one was verified by callback.
• With leadership approval, run one pretext test against the front desk and operations team and document the result.
• Add a pretext call scenario to the next Reg S-P incident response review and tabletop exercise.
• Confirm your IT provider's help desk identity checks are written down and match your policy.
• Update the risk assessment to name social engineering and impersonation as threats, with the controls above as mitigations.

How does s90 help?

s90 builds the technical side of these controls for advisers, broker-dealers and dual-registered firms: multifactor authentication and conditional access across email and core systems, help desk identity verification that follows your written procedure, and the logs and reports that show an examiner your procedures ran. If you would like a second look at your verification workflow, we are glad to walk through it with your compliance team.