Financial firms can face enforcement over weak identity-theft controls even when customers suffer no documented loss. The SEC found that TAG Associates failed to adequately review and update its written prevention program between June 2014 and December 2023 despite dozens of attempted fraud incidents. The settled action included a $175,000 civil penalty and also resolved separate custody-rule violations. TAG did not admit the findings.
Why It Matters
The case shifts attention from outcomes to governance, review and senior oversight. Existing verification stopped an unauthorized wire attempt, but the written program was not updated to reflect changing email and transfer risks. For leaders: a control that works once does not replace required program review and management reporting. For defenders: feed attempted fraud patterns into documented control updates and compliance reviews. The larger lesson is that unsuccessful attacks still create evidence that risk programs must evolve.
What Defenders Should Do
Schedule documented identity-theft program reviews after attempted fraud and report resulting changes to senior management.