{"data":{"allShapeableCollectionRecord":{"nodes":[{"data":{"id":"67a2d2a710e0a6b5850f1571","name":"Launch of Sync Underwriting","path":"/posts/launch-of-sync-underwriting-100","slug":"launch-of-sync-underwriting-100","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"","text":""},"content":{"text":"**Rhodian launches fifth agency, bringing a highly tailored cyber product to market.**\n\nSydney, Australia (February 03, 2025) – Rhodian Group, an incubator and accelerator of Australian underwriting agencies backed by global distributor of specialty insurance products and services, Amwins, has announced its fifth agency to market. Sync Underwriting, a cyber specialist, brings one of Australia’s leading cyber insurance experts, Richard Smith to market as Chief Executive Officer.\n\nSync Underwriting will enter the market with an exclusive cyber insurance product, tailored for the Australian small to mid-sized market. The Sync product has been built from the ground up, to address the changing needs Australian businesses face as the cyber landscape continues to develop in complexity and size.\n\n\"I am delighted to launch Sync Underwriting to the market. Having solely worked in the Australian cyber market for the last 8 years, it has been exciting to build a cyber product that reflects the real needs of Australian businesses and the broker market. We have worked closely with our capacity providers, Tokio Marine Nichido1, to develop a unique wording that positions us with strong differentiators. This, alongside our commitment to broker service, product development and strong technical cyber knowledge, will see Sync Underwriting grow to become a leading cyber agency in the coming years.\" says Richard Smith, CEO.\n\n“Given the rise in demand for cyber insurance protection, it was essential that Rhodian built a cyber agency that responded to the brokers' need to present a comprehensive offering to their clients. We believe that Sync brings a strong combination of expert underwriting and qualified capacity to the market, at exactly the right time. We welcome Sync to the growing Rhodian network of agencies. It is exciting to be launching our fifth agency in just under two years.\" Comment from Simon Lightbody, CEO Rhodian Group.\n\n**About Rhodian**\n\nRhodian is a network of underwriting agencies that creates independent opportunity and the collective capability to shape the future of the insurance industry. By selecting, incubating and supporting the next generation of agency leaders, Rhodian is combining new technologies, a shared success culture and the strongest talent to redefine Australia’s agency landscape. For more information, visit rhodian.com.au.\n\n**For more information about Sync Underwriting visit syncunderwriting.com.au**"},"title":null,"openGraph":{"description":{"plain":"Rhodian launches fifth agency, bringing a highly tailored cyber product to market.\nSydney, Australia (February 03, 2025) – Rhodian Group, an incubator and accelerator of Australian underwriting agencies backed by global distributor of specialty insurance products and services, Amwins, has announced its fifth agency to market. Sync Underwriting, a cyber specialist, brings one of Australia’s leading cyber insurance experts, Richard Smith to market as Chief Executive Officer.\nSync Underwriting will enter the market with an exclusive cyber insurance product, tailored for the Australian small to mid-sized market. The Sync product has been built from the ground up, to address the changing needs Australian businesses face as the cyber landscape continues to develop in complexity and size.\n\"I am delighted to launch Sync Underwriting to the market. Having solely worked in the Australian cyber market for the last 8 years, it has been exciting to build a cyber product that reflects the real needs of Australian businesses and the broker market. We have worked closely with our capacity providers, Tokio Marine Nichido1, to develop a unique wording that positions us with strong differentiators. This, alongside our commitment to broker service, product development and strong technical cyber knowledge, will see Sync Underwriting grow to become a leading cyber agency in the coming years.\" says Richard Smith, CEO.\n“Given the rise in demand for cyber insurance protection, it was essential that Rhodian built a cyber agency that responded to the brokers' need to present a comprehensive offering to their clients. We believe that Sync brings a strong combination of expert underwriting and qualified capacity to the market, at exactly the right time. We welcome Sync to the growing Rhodian network of agencies. It is exciting to be launching our fifth agency in just under two years.\" Comment from Simon Lightbody, CEO Rhodian Group.\nAbout Rhodian\nRhodian is a network of underwriting agencies that creates independent opportunity and the collective capability to shape the future of the insurance industry. By selecting, incubating and supporting the next generation of agency leaders, Rhodian is combining new technologies, a shared success culture and the strongest talent to redefine Australia’s agency landscape. For more information, visit rhodian.com.au.\nFor more information about Sync Underwriting visit syncunderwriting.com.au\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1742879062/rhodian/banner/sync-header_image__Screenshot_2025-03-25_at_4.04.12_pm_xxg2z2.png","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1742879062/rhodian/banner/sync-header_image__Screenshot_2025-03-25_at_4.04.12_pm_xxg2z2.png","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1742879062/rhodian/banner/sync-header_image__Screenshot_2025-03-25_at_4.04.12_pm_xxg2z2.png"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1742879062/rhodian/banner/sync-header_image__Screenshot_2025-03-25_at_4.04.12_pm_xxg2z2.png","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1742879062/rhodian/banner/sync-header_image__Screenshot_2025-03-25_at_4.04.12_pm_xxg2z2.png"}}}},"type":{"id":"65d566d1f7d2d452331bf0b4","name":"Press Release","slug":"press-release","__typename":"PostType"},"published":"2025-03-25T05:04:41.71","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"67cf98ab8218f118d171a1d6","name":"Why Retroactive Dates & Cyber Insurance Don’t Mix","path":"/posts/why-retroactive-dates-cyber-insurance-dont-mix","slug":"why-retroactive-dates-cyber-insurance-dont-mix","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Dwell Time\nIn 2024, espionage incidents had an average time to detect of 403.8 days and financially motivated incidents had an average time to detect of 23.7 days.* This time to detect period is known in the cyber security industry as ‘dwell time’ and measures the period during which cyber criminals have free access to a network – from the initial intrusion to detection.\n","text":"\n**Dwell Time**\n\nIn 2024, espionage incidents had an average time to detect of 403.8 days and financially motivated incidents had an average time to detect of 23.7 days.* This *time to detect* period is known in the cyber security industry as ‘dwell time’ and measures the period during which cyber criminals have free access to a network – from the initial intrusion to detection."},"content":{"text":"**Retroactive date**\n\nCyber policies commonly include a retroactive date, the intended effect of which is that cyber insurers have no liability for any acts, incidents or circumstances that were committed, occurred or arose prior to that date. The consequence of this retroactive date is that if a cyber incident occurs before the retroactive date, and is only detected some time after that date, then the Insured may not be covered under their policy.\n\nYour clients should be aware of the impact of retroactive dates and be very clear as to what the impact may be of their inclusion within their policy. In particular, if the retroactive date is the “Inception Date”, then coverage is only provided for incidents that occur after that date and the threat of Dwell Time may mean that coverage is excluded. Alternatively, there are leading polices in the market that do not contain retroactive dates.\n\n**Sync Underwriting & Retroactive Dates**\n\nSync Underwriting’s approach to this matter is simple – if your client buys a cyber policy and at the time of purchase they are unaware that they have suffered a cyber incident, then when they do discover the incident, their policy should provide coverage, regardless of when the cyber incident occurred. Therefore, there is no retroactive date within the Sync Underwriting policy and no mention of one.\n\n**Example**\n\nIn the graphical example below, we compare how Sync Underwriting’s policy compares with Insurer B’s, which has the inception date as the retroactive Date. In the example, the cyber intrusion occurs 3-months prior to the inception date but was not detected until after the policy incepted. Sync Underwriting’s policy provides coverage, however Insurer B’s may not respond.\n\n\n<ImageAsset id=\"67cf99278218f118d171a1df\" />\n\n\n* CyberCX 2025 Threat Report"},"title":null,"openGraph":{"description":{"plain":"Dwell Time\nIn 2024, espionage incidents had an average time to detect of 403.8 days and financially motivated incidents had an average time to detect of 23.7 days.* This time to detect period is known in the cyber security industry as ‘dwell time’ and measures the period during which cyber criminals have free access to a network – from the initial intrusion to detection.\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1741658094/rhodian/banner/time-bomb_image__iStock-488677006_tnbidi.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1741658094/rhodian/banner/time-bomb_image__iStock-488677006_tnbidi.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1741658094/rhodian/banner/time-bomb_image__iStock-488677006_tnbidi.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1741658094/rhodian/banner/time-bomb_image__iStock-488677006_tnbidi.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1741658094/rhodian/banner/time-bomb_image__iStock-488677006_tnbidi.jpg"}}}},"type":null,"published":"2026-05-14T05:32:02.43","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"67eb7b76ab8387072860c8e8","name":"C'mon Cyber Insurance - Be Fair Dinkum ","path":"/posts/cmon-cyber-insurance-be-fair-dinkum","slug":"cmon-cyber-insurance-be-fair-dinkum","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"I’ll let you into a well-known secret about cyber insurance claims. They usually happen because a security control in the business fails due to human error. Nothing fraudulent, malicious or sinister — just everyday people being fallible and cyber-criminals taking advantage of the situation. \n","text":"I’ll let you into a well-known secret about cyber insurance claims. They usually happen because a security control in the business fails due to human error. Nothing fraudulent, malicious or sinister — just everyday people being fallible and cyber-criminals taking advantage of the situation. "},"content":{"text":"Several examples of how cyber claims can happen: \n\n1)\tAn employee opens a phishing e-mail and unwittingly provides a criminal with log-in details. A few days later the business has the forensic experts in, trying to investigate how their network has been encrypted by bad actors; \n\n2)\tA company’s IT service provider switches off Multi-Factor Authentication due to a troubleshooting issue, but then forgets to enable it again. A Microsoft 365 e-mail account is then compromised, and phishing e-mails are sent out to hundreds of contacts;\n\n3)\tThe Financial Controller is away on leave. Their assistant receives a change of bank account e-mail request from a supplier advising the payment is urgent and must be made by close of business. The Financial Controller is uncontactable. The assistant phones the supplier to verbally authenticate the change request, as per the Financial Controller’s normal process, however there is no answer. It’s Friday afternoon and the inexperienced assistant is anxious ‘to do the right thing’ and makes the payment. Unfortunately, the change request emanated from a criminal and not the genuine supplier. The payment has been stolen. \n\n#  A call for greater transparency****\n\nCyber insurance should respond to each of the above, and the good thing is, most policies do. However, exclusions, conditions precedent, write-backs and claims conditions in some wordings, may rear their head and indemnity may be questioned. \n\nA couple I’ve come across recently:\n\n1)\tSocial engineering fraud cover that will only pay 10% of the sub-limit if the identity of a person requesting the change of bank account is not authenticated. \n\nIn practice,  if the identity of third parties requesting change of bank account was always properly authenticated, social engineering fraud claims would disappear. No more need for that insurance cover. \n\n2)\tClaims Conditions that state that Insureds must require service providers to maintain security of the Insured’s systems and maintain backups. \n\nThe question is, how do SME’s police this? With great difficulty, as they are reliant on what they are being told by their service providers. \n\nI wonder if these vital sections of the policy are being highlighted to the broker and therefore onto the Insured? \n\nAlso, I’m no expert on the Unfair Contracts Act, but I wonder………..?\n\nInsurance can be a grudge purpose, so brokers do sometimes face scepticism from clients in respect of this new type of policy that they suddenly need. The IT security industry has slowly moved from a cynical view of cyber insurance a few years ago to now understanding its benefits. It would be a great shame if that cynicism returns. \n\nSo, c’mon Cyber Insurance. At the exact time the Insured needs the support of their broker and the Insurer, they don’t want to be discovering these clauses. \n\nLet’s be fair dinkum."},"title":"C'mon Cyber Insurance - Be Fair Dinkum","openGraph":{"description":{"plain":"Richard Smith, CEO of Sync Underwriting calls for greater awareness and  transparency in cyber policy wordings to ensure brokers and their clients fully understand their coverage, ultimately advocating for fairness in cyber insurance at the time it is needed most.  \n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1743648003/rhodian/banner/man-sitting-at-computer-looking-worried_thumbnail__iStock-1355037936_bnyqol.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1743648003/rhodian/banner/man-sitting-at-computer-looking-worried_thumbnail__iStock-1355037936_bnyqol.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1743648003/rhodian/banner/man-sitting-at-computer-looking-worried_thumbnail__iStock-1355037936_bnyqol.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1743648003/rhodian/banner/man-sitting-at-computer-looking-worried_thumbnail__iStock-1355037936_bnyqol.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1743648003/rhodian/banner/man-sitting-at-computer-looking-worried_thumbnail__iStock-1355037936_bnyqol.jpg"}}}},"type":{"id":"67eb7629ab8387072860c8df","name":"Opinion","slug":"opinion","__typename":"PostType"},"published":"2025-06-10T01:42:19.83","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"67f5be77424327e9ff1060d6","name":"How negative media can impact reputation","path":"/posts/how-negative-media-can-impact-reputation","slug":"how-negative-media-can-impact-reputation","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"In today’s digital landscape, a cyber incident doesn't always end with system recovery — it can spiral into a reputational crisis. \n","text":"In today’s digital landscape, a cyber incident doesn't always end with system recovery — it can spiral into a reputational crisis. "},"content":{"text":"In Australia, a new method of publicising cyber-attacks has evolved. Journalists are scouring the Dark Web and BreachForums for businesses that have had sensitive information stolen or that are being held to ransom. The journalist then contacts the breached business for comment – in some cases this can be the first time the business is aware of the breach. Articles are then published in the cyber media naming the impacted business, providing updates as the story develops. The incentive for journalists of this approach is obvious in that they are able to publish breaking news content.\n\nCyber insurance policies provide coverage for the impact on businesses profitability as a direct result of a cyber event. This usually includes the loss of profit the business may suffer over the next year and expenses incurred to maintain normal operations.  \n\nHowever, let’s take the following scenario, using an online retailer: \nAn online retailer suffers a ransomware attack, which is well maintained by the incident response team provided through their cyber insurance policy. The insurer’s IT forensic experts isolate the affected system, contain the attack and eradicate the ransomware. Due to the lack of available evidence, it is difficult to determine if any customer information had been stolen by the threat actor and legal advice is presented to the insured which concluded that there was no eligible data breach to report as it is difficult to find that the serious harm threshold was met under the Privacy Act. \n\nThree months later, the retailer is contacted by a cyber journalist regarding claims being made by an unknown hacker online that the retailer’s customer data is being listed for sale on BreachForums. It is difficult to verify the accuracy of the hacker’s claims. The journalist publishes an article about the breached customer information on their news website naming the retailer, and the news quickly spread across various media channels. The retailer started to get enquiries from customers about the safety of their information and online orders quickly declined. \n\nIn this scenario, the lost revenue suffered by the retailer was as a direct result of the adverse media event arising from a security breach and not a direct result of the security breach. This distinction may cause cyber insurance policies to respond in varying ways to this scenario. \n\nSync Underwriting’s Reputational Harm coverage reimburses our Insureds for profit lost as the direct result of an adverse media event arising from a security breach. Coverage is automatically included in all policies to the full Limit of Liability. \n"},"title":null,"openGraph":{"description":{"plain":"In today’s digital landscape, a cyber incident doesn't always end with system recovery — it can spiral into a reputational crisis. In Australia, a new trend has emerged where journalists uncover cyber breaches via the Dark Web before businesses are even aware they’ve been targeted. As these incidents make headlines, the reputational damage can lead to significant financial loss — even when the technical impact is well-managed. This article explores how adverse media coverage can harm a business's reputation and bottom line, and how specialized cyber insurance policies like Sync Underwriting’s Reputational Harm coverage can help bridge that gap.\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1744158114/rhodian/banner/news-articles-being-viewed-on-mobile-phone_thumbnail__iStock-1477858506_h9mptu.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1744158114/rhodian/banner/news-articles-being-viewed-on-mobile-phone_thumbnail__iStock-1477858506_h9mptu.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1744158114/rhodian/banner/news-articles-being-viewed-on-mobile-phone_thumbnail__iStock-1477858506_h9mptu.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1744158114/rhodian/banner/news-articles-being-viewed-on-mobile-phone_thumbnail__iStock-1477858506_h9mptu.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1744158114/rhodian/banner/news-articles-being-viewed-on-mobile-phone_thumbnail__iStock-1477858506_h9mptu.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2025-06-10T01:42:39.00","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"683fd1f9973eb444e1b07528","name":"Cyber Ransom Payments – why cyber insurance is essential","path":"/posts/cyber-ransom-payments-why-cyber-insurance-is-essential","slug":"cyber-ransom-payments-why-cyber-insurance-is-essential","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Ransomware Payment Reporting Rules\nThe Cyber Security Act 2024 (“The Act”) has established a ransomware and cyber extortion payment obligation on reporting entities (annual turnover exceeding $3 million). Under the legislation, starting 30th May 2025, Australian businesses are now legally required to report any ransomware payments. There is no grace period for compliance. \n","text":"**Ransomware Payment Reporting Rules**\n\nThe Cyber Security Act 2024 (“The Act”) has established a ransomware and cyber extortion payment obligation on reporting entities (annual turnover exceeding $3 million). Under the legislation, starting 30th May 2025, Australian businesses are now legally required to report any ransomware payments. There is no grace period for compliance. \n"},"content":{"text":"**Why Cyber Insurance is Essential**\n\nPayment of ransoms brings increased regulatory risk and scrutiny, meaning cyber insurance is now an essential tool in guiding businesses through their legal requirements:\n\n1)\tThe Act provides that a civil penalty of 60 penalty units, presently $19,800, may apply where a reporting business entity does not make a mandatory ransomware payment report when they are obligated to do so;\n\n2)\tRansom payments may trigger breaches of sanction laws, which can be a serious criminal offence, punishable by potential fines for entities of the greater of 10,000 penalty units ($3.13 million as of 1st July 2023) or three time the value of the illegal transaction. \n\nOn 23rd January 2024, the Australian government imposed autonomous sanctions against Aleksandr Ermakov, a Russian national implicated in the October 2022 Medibank Private data breach. \n\nIn May 2024, Australia imposed a targeted financial sanction on Russian citizen Dmitry Yuryevich Khoroshev for his senior leadership role in the LockBit Ransomware Group. This sanction makes it a criminal offence to provide assets to Dmitry Yuryevich Khoroshev, or to use or deal with his assets.\n\nIn October 2024, Australia imposed sanctions on three Russian nationals linked to the Evil Corp cybercrime group. \n\nIn February 2025, additional cyber sanctions were imposed in response to the 2022 cyberattack against Medibank Private. The Government imposed these cyber sanctions on the Russian entity, ZServers, and five Russian cybercriminals who provided the network infrastructure and services used to host and release the data stolen from Medibank. \n\nThese examples of “cyber incident” sanctions may have significant implications for businesses falling victim to a ransomware attack and their consideration of facilitating a ransom payment. Cyber insurance policies provide Insureds with access to the leading cyber and privacy lawyers in Australia. As a benefit under the policy, an Insured facing ransom payment and reporting considerations receives legal advice in respect of the potential to breach sanction laws;\n\n\n3)\tAs well as providing expert cyber legal advice, the best cyber insurance policies also access specialist ransomware negotiators that act for and negotiate on behalf of the Insured. Their role is to understand the intricacies of the attack and negotiate terms that can minimise damage and recover data. Often, it is not necessary to pay a ransom, but regardless, this expertise provides the Insured with the best possible outcome given the situation.\n\n"},"title":null,"openGraph":{"description":{"plain":"Ransomware Payment Reporting Rules\nThe Cyber Security Act 2024 (“The Act”) has established a ransomware and cyber extortion payment obligation on reporting entities (annual turnover exceeding $3 million). Under the legislation, starting 30th May 2025, Australian businesses are now legally required to report any ransomware payments. There is no grace period for compliance. \n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1749519561/rhodian/banner/ransomware_image__iStock-1472024368_1_wzigbw.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1749519561/rhodian/banner/ransomware_image__iStock-1472024368_1_wzigbw.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1749519561/rhodian/banner/ransomware_image__iStock-1472024368_1_wzigbw.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1749519561/rhodian/banner/ransomware_image__iStock-1472024368_1_wzigbw.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1749519561/rhodian/banner/ransomware_image__iStock-1472024368_1_wzigbw.jpg"}}}},"type":{"id":"67eb7629ab8387072860c8df","name":"Opinion","slug":"opinion","__typename":"PostType"},"published":"2025-06-10T00:00:00.00","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"687495a2780e551ac5cfe25f","name":"The Qantas Breach: A Wake-Up Call on Third-Party Privacy Risks","path":"/posts/the-qantas-breach-a-wake-up-call-on-third-party-privacy-risks-1","slug":"the-qantas-breach-a-wake-up-call-on-third-party-privacy-risks-1","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"This month, Qantas confirmed a cyber incident that compromised the personal data of up to six million customers. The breach didn’t stem from Qantas’ internal systems, but rather from a third-party customer service platform operated offshore. This incident is a stark reminder that privacy risks don’t stop at the firewall—they extend deep into the vendor ecosystem.\n","text":"This month, Qantas confirmed a cyber incident that compromised the personal data of up to six million customers. The breach didn’t stem from Qantas’ internal systems, but rather from a third-party customer service platform operated offshore. This incident is a stark reminder that privacy risks don’t stop at the firewall—they extend deep into the vendor ecosystem."},"content":{"text":"**Why this Matters for Australian Businesses?**\n\nThis breach highlights several critical issues:\n\n•\tVendor vulnerabilities: The attack didn’t target Qantas directly—it exploited a trusted third-party provider;\n\n•\tOffshore risk exposure: Many Australian businesses outsource IT and customer service functions overseas, where cybersecurity maturity may be lower;\n\n•\tRegulatory accountability: Under the Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme, Qantas remains responsible for protecting customer data—even when handled by a vendor;\n\n•\tReputational damage: Qantas’ stock dropped and public trust took a hit, despite the breach occurring outside its core systems.\n\n**What is the OAIC’s position on third party breaches?**\n\nWhere more than one party could potentially report a breach, the Office of the Australian Information Commissioner (“OAIC”) expects that only one notification be made under the Notifiable Data Breaches (“NDB”) scheme, to avoid duplication and confusion. The entity with the most direct relationship to the affected individuals is expected to notify. \n\n**Lessons for Australian Businesses** \n\nThe Qantas incident underscores the need for robust third-party risk management:\n\n•\tBe certain that your cyber insurance provides coverage for third party vendor breaches;\n\n•\tMap your vendor ecosystem: Know who has access to sensitive data and where it’s stored;\n\n•\tConduct due diligence: Assess vendors’ compliance with standards like ISO/IEC 27001, Essential Eight, and APRA CPS 234;\n\n•\tEmbed privacy clauses: Contracts should include breach notification timelines, data handling protocols, and audit rights.\n\n•\tSimulate breach scenarios: Test how quickly you can respond if a vendor is compromised.\n\n**Final Thought**\n\nThe Qantas breach is not an isolated event—it’s part of a growing pattern where third-party failures become first-party liabilities. As cybercriminals grow more sophisticated, Australian businesses must shift from a culture of compliance to one of resilience and proactive governance. Because when a vendor slips, it’s your brand, your customers, and your legal standing that take the fall.\n\n**For further information, please contact:**\n\nRichard Smith\n\nRichard.Smith@syncuw.com.au\n\nMobile – 0477 377797"},"title":null,"openGraph":{"description":{"plain":"This month, Qantas confirmed a cyber incident that compromised the personal data of up to six million customers. The breach didn’t stem from Qantas’ internal systems, but rather from a third-party customer service platform operated offshore. This incident is a stark reminder that privacy risks don’t stop at the firewall—they extend deep into the vendor ecosystem.\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1752543447/rhodian/banner/qantas_image__Qantas_Data_Breach_m3l5la.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1752543447/rhodian/banner/qantas_image__Qantas_Data_Breach_m3l5la.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1752543447/rhodian/banner/qantas_image__Qantas_Data_Breach_m3l5la.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1752543447/rhodian/banner/qantas_image__Qantas_Data_Breach_m3l5la.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1752543447/rhodian/banner/qantas_image__Qantas_Data_Breach_m3l5la.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2025-07-15T05:19:39.49","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"68898060f982b772337253e4","name":"What is Precautionary Shutdown Cover?","path":"/posts/what-is-precautionary-shutdown-cover","slug":"what-is-precautionary-shutdown-cover","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Precautionary Shutdown Cover offers a safety net for businesses that choose to shut down systems before a cyber incident causes damage. It’s like pulling the fire alarm before the flames spread—and still being covered.\n","text":"Precautionary Shutdown Cover offers a safety net for businesses that choose to shut down systems before a cyber incident causes damage. It’s like pulling the fire alarm before the flames spread—and still being covered."},"content":{"text":"**Key Benefits**\n\n•\t**Business interruption protection:** Covers lost profit when systems are shut down to prevent a cyber-attack.\n\n•\t**Reputation management:** Helps mitigate reputational damage by supporting early action and transparency.\n\n•\t**Encourages proactive risk management:** Empowers businesses to act swiftly without fearing insurance won't respond.\n\n**Examples of when it applies**\n\n•\t**Ransomware threat detected before encryption begins:** A company’s IT team spots suspicious activity linked to a known Ransomware strain. They shut down servers pre-emptively to isolate the threat. Even though no files were encrypted, the business interruption costs are covered.\n\n•\t**Third-party IT supplier breach:** A retailer learns that its cloud provider has suffered a cyber event. To prevent exposure, they shut down their own systems temporarily. Precautionary Shutdown cover helps with lost revenue during the downtime.\n\n•\t**CERT Australia recommends shutdown:** A business is advised by the Computer Emergency Response Team to halt operations due to a credible threat. They comply and the cyber insurance policy covers the financial impact. \n\n**Why It’s a Game-Changer**\n\nTraditional cyber insurance often requires proof of damage or breach. This coverage flips the script—rewarding smart, preventative action rather than punishing caution. \n\n**Sync Underwriting & Precautionary Shutdown Cover**\n\nSync Underwriting provides Precautionary Shutdown Cover in every policy by default, to the full Limit of Liability. \n\n**For further information, please contact:**\n\n**Richard Smith**\n\nRichard.Smith@syncuw.com.au\n\nMobile – 0477 377797\n\n"},"title":null,"openGraph":{"description":{"plain":"Precautionary Shutdown Cover offers a safety net for businesses that choose to shut down systems before a cyber incident causes damage. It’s like pulling the fire alarm before the flames spread—and still being covered.\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1753842771/rhodian/banner/shutdown_image__iStock-1382372866_axmd7z.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1753842771/rhodian/banner/shutdown_image__iStock-1382372866_axmd7z.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1753842771/rhodian/banner/shutdown_image__iStock-1382372866_axmd7z.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1753842771/rhodian/banner/shutdown_image__iStock-1382372866_axmd7z.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1753842771/rhodian/banner/shutdown_image__iStock-1382372866_axmd7z.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2025-07-30T23:40:25.22","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"69682713e7f112536bc92def","name":"From Silver Bullet to Speed Bump: MFA Phishing and the New Reality for Cyber Insurers","path":"/posts/from-silver-bullet-to-speed-bump-mfa-phishing-and-the-new-reality-for-cyber-insurers","slug":"from-silver-bullet-to-speed-bump-mfa-phishing-and-the-new-reality-for-cyber-insurers","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"","text":""},"content":{"text":"# **Introduction**\nOver the last decade, Multi-Factor Authentication (“MFA”) has increasingly been held up as one of the most effective controls against cyber-crime. During the ‘hard’ cyber insurance market in Australia in 2020 and 2021, insurers started to focus more closely on cyber security controls because of rising claims and insureds were required to confirm that MFA was implemented on key systems such as remote access and VPN’s. Insurers now expect MFA, as part of baseline eligibility requirements and this is reflected in modern cyber proposal and application forms.  \n\nInsurers pushed hard for this MFA adoption and with good reason. MFA dramatically reduces losses from basic credential theft and has become a cornerstone requirement of cyber insurance underwriting.\n\nToday, however, the threat landscape is shifting. Attackers are no longer simply stealing passwords; they are actively targeting MFA itself. The rise of MFA Phishing techniques is forcing cyber insurers to rethink assumptions about risk, controls and loss prevention.\n\n \n# **The Rise of MFA Phishing**\nAttackers are adapting quickly. Threat actors are now working around MFA, using techniques such as:\n\n•\tMan-in-the-middle phishing pages that capture credentials and MFA tokens in real time;\n•\tSession and authentication token theft, allowing attackers to bypass MFA entirely once a user is logged in.\n\nCrucially, many of these attacks succeed even when MFA is technically enabled. \n\n\n# **What This Means for Cyber Insurers**\nFor insurers, MFA Phishing may result in a steady increase in claims driven by Business E-Mail Compromise (“BEC”) and Cloud account takeovers. The implications for cyber insurers may be significant:\n\n**Additional Underwriting Criteria**  \nInsurers may be required to assess in greater detail how MFA is implemented and how resistant it is to phishing. They may be forced from asking “Do you have MFA?” to questions around Conditional Access, E-Mail protections and phishing-related MFA. In the SME market, which currently places a great emphasis on trying to create a frictionless sales process, such additional underwriting questions will create challenges for insureds and SME-specialist brokers.\n\n\n**Vulnerability Scans**  \nMany insurers use external attack-surface scanning to automatically scan a business’s external facing assets. Such tools do have a limited use, but these vulnerability scans cannot directly detect MFA phishing tools or techniques. MFA Phishing does not exploit a software vulnerability within the insured’s environment; instead, it relies on external phishing infrastructure and social engineering to intercept user credentials and authentication tokens in real time. As a result, a clean vulnerability scan does not necessarily indicate a reduced risk of MFA-related compromise, BEC or Cloud account takeover.\n\n\n**Artificial Intelligence (“AI”)**  \nRight now, MFA Phishing tends to be targeted because it’s more complex to set up (reverse proxies), riskier for attackers (short-lived infrastructure) and most profitable when aimed at high-value users (finance or execs), so attackers are picking their targets. However, AI will massively reduce the cost of operating MFA Phishing at scale.\n\nAI can already mimic internal tone, formatting and workflows, and personalise lures at scale. That means MFA Phishing does not need to be “handcrafted” per target. Phishing-as-a-Service platforms already exist, but AI will be able to add auto-generated look-alike domains, AI-written login pages that clone real portals and rapid redeployment to evade detection. This will turn MFA Phishing into a volume business, not a bespoke attack. MFA Phishing volume businesses will be able to deploy thousands of highly plausible messages across multiple organisations at once, but each message will still feel targeted to the recipient. \n\n**Looking Ahead**  \nMFA remains a critical control but it is no longer the Silver Bullet it once was. For cyber insurers, the rise of MFA Phishing marks a turning point: how do they move from broad, control-based underwriting to a more nuanced assessment of identity resilience.\n\nThe evolution will also present challenges for brokers, many of whom are still adjusting to understanding basic MFA deployment. Insurers will need to take a proactive role in educating brokers and insureds on the very real risks of MFA Phishing and the value of layered identity defences. Ongoing and upskilling will be critical for all to keep pace. \n\n\n"},"title":null,"openGraph":{"description":{"plain":"Introduction\nOver the last decade, Multi-Factor Authentication (“MFA”) has increasingly been held up as one of the most effective controls against cyber-crime. During the ‘hard’ cyber insurance market in Australia in 2020 and 2021, insurers started to focus more closely on cyber security controls because of rising claims and insureds were required to confirm that MFA was implemented on key systems such as remote access and VPN’s. Insurers now expect MFA, as part of baseline eligibility requirements and this is reflected in modern cyber proposal and application forms.  \nInsurers pushed hard for this MFA adoption and with good reason. MFA dramatically reduces losses from basic credential theft and has become a cornerstone requirement of cyber insurance underwriting.\nToday, however, the threat landscape is shifting. Attackers are no longer simply stealing passwords; they are actively targeting MFA itself. The rise of MFA Phishing techniques is forcing cyber insurers to rethink assumptions about risk, controls and loss prevention.\nThe Rise of MFA Phishing\nAttackers are adapting quickly. Threat actors are now working around MFA, using techniques such as:\n•    Man-in-the-middle phishing pages that capture credentials and MFA tokens in real time;\n•    Session and authentication token theft, allowing attackers to bypass MFA entirely once a user is logged in.\nCrucially, many of these attacks succeed even when MFA is technically enabled. \nWhat This Means for Cyber Insurers\nFor insurers, MFA Phishing may result in a steady increase in claims driven by Business E-Mail Compromise (“BEC”) and Cloud account takeovers. The implications for cyber insurers may be significant:\nAdditional Underwriting CriteriaInsurers may be required to assess in greater detail how MFA is implemented and how resistant it is to phishing. They may be forced from asking “Do you have MFA?” to questions around Conditional Access, E-Mail protections and phishing-related MFA. In the SME market, which currently places a great emphasis on trying to create a frictionless sales process, such additional underwriting questions will create challenges for insureds and SME-specialist brokers.\nVulnerability ScansMany insurers use external attack-surface scanning to automatically scan a business’s external facing assets. Such tools do have a limited use, but these vulnerability scans cannot directly detect MFA phishing tools or techniques. MFA Phishing does not exploit a software vulnerability within the insured’s environment; instead, it relies on external phishing infrastructure and social engineering to intercept user credentials and authentication tokens in real time. As a result, a clean vulnerability scan does not necessarily indicate a reduced risk of MFA-related compromise, BEC or Cloud account takeover.\nArtificial Intelligence (“AI”)Right now, MFA Phishing tends to be targeted because it’s more complex to set up (reverse proxies), riskier for attackers (short-lived infrastructure) and most profitable when aimed at high-value users (finance or execs), so attackers are picking their targets. However, AI will massively reduce the cost of operating MFA Phishing at scale.\nAI can already mimic internal tone, formatting and workflows, and personalise lures at scale. That means MFA Phishing does not need to be “handcrafted” per target. Phishing-as-a-Service platforms already exist, but AI will be able to add auto-generated look-alike domains, AI-written login pages that clone real portals and rapid redeployment to evade detection. This will turn MFA Phishing into a volume business, not a bespoke attack. MFA Phishing volume businesses will be able to deploy thousands of highly plausible messages across multiple organisations at once, but each message will still feel targeted to the recipient. \nLooking AheadMFA remains a critical control but it is no longer the Silver Bullet it once was. For cyber insurers, the rise of MFA Phishing marks a turning point: how do they move from broad, control-based underwriting to a more nuanced assessment of identity resilience.\nThe evolution will also present challenges for brokers, many of whom are still adjusting to understanding basic MFA deployment. Insurers will need to take a proactive role in educating brokers and insureds on the very real risks of MFA Phishing and the value of layered identity defences. Ongoing and upskilling will be critical for all to keep pace. \n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1768436267/rhodian/banner/mfa-phishing_thumbnail__MFA_image_copy_qkdcj3.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1768436267/rhodian/banner/mfa-phishing_thumbnail__MFA_image_copy_qkdcj3.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1768436267/rhodian/banner/mfa-phishing_thumbnail__MFA_image_copy_qkdcj3.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1768436267/rhodian/banner/mfa-phishing_thumbnail__MFA_image_copy_qkdcj3.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1768436267/rhodian/banner/mfa-phishing_thumbnail__MFA_image_copy_qkdcj3.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2026-05-14T05:39:25.83","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"69684603e7f112536bc92e0a","name":"Why Payment Controls Matters More Than Ever","path":"/posts/why-payment-controls-matters-more-than-ever","slug":"why-payment-controls-matters-more-than-ever","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Lessons from the November 2025Conveyancer Scamand Mobius v Inoteq\n","text":"Lessons from the November 2025Conveyancer Scam  \nand Mobius v Inoteq\n"},"content":{"text":"The November 2025 conveyancer misdirection scam and Mobius Group Pty Ltd v Inoteq Pty Ltd both highlighted a hard truth for business: when money is voluntarily transferred to a fraudster, the responsibility is on the payer to verify payment details.  \n \n# The November 2025 Conveyancer Misdirection Scam  \nIn the November 2025 case, a property purchaser was tricked into transferring settlement funds to a fraudster impersonating their conveyancer. A claim was brought against the conveyancer by the purchaser alleging that the conveyancer ought to be held liable. The NSW Civil and Administrative Tribunal (“NCAT”) ultimately did not shift liability to the conveyancer. Despite the scam occurring in a conveyancing context, the loss sat with the party who made the payment. NCAT effectively said: \n\n* The purchaser made the payment;\n* The purchaser received warnings about payment redirection scams;\n* The purchaser did not independently verify the bank details.\n\n# Mobius v Inoteq  \nMobius Group Pty Ltd (the Plaintiff), an electrical engineering contractor, entered into an agreement with Inoteq Pty Ltd (The Defendant) to perform electrical works on a Rio Tinto project. Mobius issued invoices for the work, but a fraudster gained access to Mobius’ e-mail account and sent a fraudulent e-mail to Inoteq, instructing them to change the bank account details for payment. Inoteq paid the invoice ($235,000) to the fraudulent account. Mobius sought payment of the outstanding amount ($192,000) from Inoteq, leading to the litigation. \n\nThe court held that Inoteq was liable for the outstanding amount of $192k. \n\nThe judgment leaned heavily on four ideas:  \n\n**1. Control sits with the payer**  \nInoteq controlled the bank account and authorised the transfer.  \n**2. E-mail is not a safe authority for changing bank details**  \nA fraudulent email — even from a real, compromised address — is not valid notice.  \n**3. Verification attempts were inadequate**  \nInoteq’s limited attempt to verify the change (a failed phone call) was not enough before releasing funds.  \n**4. Risk of fraud in payments is foreseeable**  \nThe court treated invoice redirection fraud as a known commercial risk — not a freak event.\n\n# Cyber Insurance takeaway  \nThe two cases above highlight that the law will not automatically rescue a payer just because fraud was involved and courts and tribunals expect positive verification, not passive reliance on e-mail.\n\nSocial Engineering Loss Cover within a cyber insurance policy is often the only place these losses land. Social Engineering Loss Cover (sometimes called Funds Transfer Fraud) is designed to cover direct financial loss suffered when an employee, director or officer is deceived or manipulated into transferring funds to a fraudulent bank account. Common triggers include Business Email Compromise (“BEC”), fake invoice scams and impersonation of trusted suppliers. \n\nHowever, cyber insurers will provide Social Engineering Loss Cover based upon Insureds having payment controls implemented within the business and Insureds have a legal obligation to accurately disclose the extent of such controls. \n\n\n"},"title":null,"openGraph":{"description":{"plain":"Lessons from the November 2025Conveyancer Scamand Mobius v Inoteq\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1768441309/rhodian/banner/payment-controls_thumbnail__Payment_Controls_ql2hnx.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1768441309/rhodian/banner/payment-controls_thumbnail__Payment_Controls_ql2hnx.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1768441309/rhodian/banner/payment-controls_thumbnail__Payment_Controls_ql2hnx.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1768441309/rhodian/banner/payment-controls_thumbnail__Payment_Controls_ql2hnx.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1768441309/rhodian/banner/payment-controls_thumbnail__Payment_Controls_ql2hnx.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2026-01-15T06:28:27.69","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"69bb831a44c3277966ffc76e","name":"Precautionary Shutdown Cover","path":"/posts/precautionary-shutdown-cover","slug":"precautionary-shutdown-cover","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Cyber risk isn’t defined by the attacks that succeed, it’s defined by the decisions made before they do. The problem is, most policies still only respond after the damage is visible.\nTo see how this plays out in practice, the comparison below highlights where traditional cyber policies fall short and how Sync responds earlier, before loss crystallises.\n","text":"Cyber risk isn’t defined by the attacks that succeed, it’s defined by the decisions made before they do. The problem is, most policies still only respond after the damage is visible.\n\nTo see how this plays out in practice, the comparison below highlights where traditional cyber policies fall short and how Sync responds earlier, before loss crystallises."},"content":{"text":"**Cover Comparison**\n\n<ImageAsset id=\"69bb82c644c3277966ffc76a\" />\n\n\nNote:\nInsurer X is a large cyber insurer in the Australian market.\n\nThis is where Sync’s approach is deliberately different. By recognising precautionary shutdown as a valid response, Sync gives brokers a solution that aligns with how cyber risk is actually managed in real time.\nIf you have clients where downtime risk sits ahead of confirmed breach, Sync provides a clearer, more practical response.\n\nCyber risk isn’t defined by the attacks that succeed, it’s defined by the decisions made before they do. The problem is, most policies still only respond after the damage is visible.\n\n**Call 1800 316 706 or visit syncunderwriting.com.au**"},"title":null,"openGraph":{"description":{"plain":"Cyber risk isn’t defined by the attacks that succeed, it’s defined by the decisions made before they do. The problem is, most policies still only respond after the damage is visible.\nTo see how this plays out in practice, the comparison below highlights where traditional cyber policies fall short and how Sync responds earlier, before loss crystallises.\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1774218744/rhodian/banner/precautionary-shutdown_image__Screenshot_2026-03-23_at_9.32.19_AM_nvdhla.png","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1774218744/rhodian/banner/precautionary-shutdown_image__Screenshot_2026-03-23_at_9.32.19_AM_nvdhla.png","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1774218744/rhodian/banner/precautionary-shutdown_image__Screenshot_2026-03-23_at_9.32.19_AM_nvdhla.png"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1774218744/rhodian/banner/precautionary-shutdown_image__Screenshot_2026-03-23_at_9.32.19_AM_nvdhla.png","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1774218744/rhodian/banner/precautionary-shutdown_image__Screenshot_2026-03-23_at_9.32.19_AM_nvdhla.png"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2026-03-24T06:34:50.78","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"6a028962700f961f6d7f25ea","name":"Deepfake Fraud: The claims your clients wont see coming","path":"/posts/deepfake-fraud-the-claims-your-clients-wont-see-coming","slug":"deepfake-fraud-the-claims-your-clients-wont-see-coming","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"Deepfake-enabled fraud is no longer theoretical, it is already impacting businesses globally.  \n","text":"Deepfake-enabled fraud is no longer theoretical, it is already impacting businesses globally.  "},"content":{"text":"**Case Study: WPP plc Deepfake Attack **\n\nAttackers impersonated the CEO and senior executives of WPP plc using AI-generated voice and video. After initial contact via WhatsApp, a highly convincing Microsoft Teams call was staged to reinforce legitimacy, with the aim of inducing a confidential payment and extracting sensitive information.This type of multi-channel, highly coordinated deception is becoming more common and more effective.\n\n**What's changing**\n\nDeepfake-enabled fraud:\n\n* Targets people, not systems\n* Bypasses traditional controls\n* Can trigger rapid fund transfers without suspicion\n\n*\"In many cases, there is no system breach, which is where coverage gaps can emerge.\"*\n\n**How the Sync Cyber Wording Responds **\n\nSync’s cyber wording is designed to address this exposure under Cyber Crime – Social Engineering Loss. The cover responds to: Financial loss resulting from a fraudulent instruction that misleads an employee and results in funds being transferred.\n\nImportantly:\n\n* No system breach required\n* Applies where an employee is deceived\n* Responds to modern attack methods, including:\n* Email impersonation\n* Voice cloning\n* Video deepfake\n \n**Why this matters**\n\nAs these attacks become more sophisticated, clarity around how policies respond is critical. Ensuring coverage aligns to how losses actually occur is becoming a key part of cyber placement.\n\n**Working through a cyber risk?**\n\nTalk to Sync about how these exposures are being covered in practice. \n\n**Call us today on 1800 299 444 or email CEO Richard Smith: richard.smith@syncuw.com.au **"},"title":null,"openGraph":{"description":{"plain":"Deepfake-enabled fraud is no longer theoretical, it is already impacting businesses globally.  \n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1778551288/rhodian/banner/deepfake-fraud_image__iStock-2200516160_evnwt2.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1778551288/rhodian/banner/deepfake-fraud_image__iStock-2200516160_evnwt2.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1778551288/rhodian/banner/deepfake-fraud_image__iStock-2200516160_evnwt2.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1778551288/rhodian/banner/deepfake-fraud_image__iStock-2200516160_evnwt2.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1778551288/rhodian/banner/deepfake-fraud_image__iStock-2200516160_evnwt2.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2026-05-12T02:06:32.48","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}},{"data":{"id":"6a277c8e173589151c1f7bdb","name":"Could AFCA Become Cyber Insurers' Silent Partner?","path":"/posts/could-afca-become-cyber-insurers-silent-partner","slug":"could-afca-become-cyber-insurers-silent-partner","__typename":"Post","_schema":{"label":"Post","pluralLabel":"Posts"},"intro":{"plain":"The Australian Financial Complaints Authority (“AFCA”) is rarely considered part of the cyber insurance landscape. However, its evolving approach to fraud-related complaints raises an interesting question:\nCould AFCA become an unexpected ally of cyber insurers and deliver better outcomes for insureds?\n","text":"The Australian Financial Complaints Authority (“AFCA”) is rarely considered part of the cyber insurance landscape. However, its evolving approach to fraud-related complaints raises an interesting question:\n\nCould AFCA become an unexpected ally of cyber insurers and deliver better outcomes for insureds?\n"},"content":{"text":"**The Challenge of Cyber Crime**\n\nBusiness Email Compromise, Social Engineering Loss and Push Payment Loss continue to cause significant losses for Australian businesses. Historically, once funds were transferred to fraudsters and dispersed through mule accounts, recovery prospects were often limited. As a result, these losses were generally treated as final: the insured suffered the loss and the cyber insurer paid the claim.\n\n**AFCA's Expanding Focus**\n\nAFCA is increasingly scrutinising the conduct of banks in fraud-related matters. This includes transaction monitoring, the management of mule accounts and, in some cases, whether a bank had a \"duty to inquire\" before processing an unusual or suspicious transaction. AFCA's expanded jurisdiction over receiving banks further broadens the potential for accountability across the payment chain.\n\n**Why This Matters**\n\nFor cyber insurers, fraud losses have traditionally been high-severity claims with limited recovery opportunities. However, where a bank may have failed to identify suspicious activity or intervene appropriately, potential recovery avenues may now exist.\nThis is good news for insureds. Cyber insurance can provide immediate financial support and specialist assistance following a fraud loss, while the insurer pursues recovery opportunities in the background.\n\n**The Takeaway for Brokers**\n\nAFCA's expanding role does not reduce the value of cyber insurance; it may enhance it.\nAs scrutiny of banks increases, opportunities for recovery may improve, allowing insurers to provide immediate support to clients while pursuing the banks after the event. The result may be a future where AFCA is not a substitute for cyber insurance, but a valuable partner in helping businesses recover from cyber-enabled fraud.\n\n\n"},"title":null,"openGraph":{"description":{"plain":"The Australian Financial Complaints Authority (“AFCA”) is rarely considered part of the cyber insurance landscape. However, its evolving approach to fraud-related complaints raises an interesting question:\nCould AFCA become an unexpected ally of cyber insurers and deliver better outcomes for insureds?\n"},"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1780972481/rhodian/banner/banking-fraud_image__iStock-1177224590_ynwlea.jpg","url2x":null,"thumbnails":{"card":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_480/v1780972481/rhodian/banner/banking-fraud_image__iStock-1177224590_ynwlea.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_960/v1780972481/rhodian/banner/banking-fraud_image__iStock-1177224590_ynwlea.jpg"},"bubble":{"url":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_64/v1780972481/rhodian/banner/banking-fraud_image__iStock-1177224590_ynwlea.jpg","url2x":"https://res.cloudinary.com/shapeable/image/upload/c_limit,w_128/v1780972481/rhodian/banner/banking-fraud_image__iStock-1177224590_ynwlea.jpg"}}}},"type":{"id":"67eb766aab8387072860c8e4","name":"Insights","slug":"insights","__typename":"PostType"},"published":"2026-06-09T03:57:54.92","authors":[{"openGraph":{"image":{"url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null}},"_schema":{"label":"Person","pluralLabel":"People"},"id":"6736a6cd9a5f4ad160fb7b1e","name":"Richard Smith","slug":"richard-smith","path":"/people/richard-smith","organisation":{"id":"669760a52512c86d90027d65","name":"Sync Underwriting"},"linkedin":"https://www.linkedin.com/in/richard-smith-203147145/","photo":{"id":"image_rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht","url":"https://res.cloudinary.com/shapeable/image/upload/v1732166607/rhodian/person/richard-smith_photo__Richard_Smith_1_lfltht.webp","url2x":null,"type":"image/webp"}}]}}]}}}