FINRA Warns of Fake Agency Website

The Financial Industry Regulatory Authority (FINRA) issued an alert regarding the appearance of a fake website purporting to be from the authority. The fake website uses the domain “finnra.org” in which the letter “n” appears twice. This example of domain spoofing (aka typojacking, typosquatting - i.e., the use of a criminally fake but similar spelling of a domain name), is a tactic to induce users to inadvertently click on a fake site and subsequently provide user credentials, download malware, or otherwise succumb to similar illegal activity. In this circumstance, FINRA has pointed to the existence of a fake registration page, designed to capture user credentials and identifying information. FINRA warns that the “finnra.org” domain is not associated with the agency, and that all emails originating from that domain should be deleted.

ACA Guidance

ACA Aponix recommends that brokers and broker-dealers be on the lookout for emails or other material using the “finnra.org” domain (with the letter “n” appearing twice) or other typojacking, phishing, or similar social engineering attempts. Clients are advised to carefully inspect hyperlinks and domain names to verify that they are from a trusted source. Additionally, firms are advised to enhance training efforts toward recognizing and preventing typojacking, phishing, and related criminal activity.

How We Help

ACA Aponix offers the following solutions that can help your firm protect itself in relation to this and similar social engineering efforts, and to enhance its cybersecurity in general:

• Phishing testing and cyber awareness
• Penetration testing and vulnerability assessments
• Cyber incident response planning
• Cybersecurity training

Contact Us

If you have any questions, please contact your ACA Aponix consultant or email us at info@acaaponix.com.