HOA Cybersecurity for Boards: Wire Fraud, Ransomware, and...

When we built BoardStack, one of the first problems we set out to solve was the financial control gap that makes HOA boards easy targets. Boards collect assessments, hold reserve funds, and write large checks to vendors, often with informal approval processes that rely on trust rather than procedure. That is exactly the environment wire fraud scammers target.

This guide covers the four categories of cyber risk that HOA boards face, the controls that address each one, and a step-by-step incident response process for when something goes wrong.

The four cyber risks HOA boards actually face

Wire fraud via business email compromise

BEC wire fraud is the highest-dollar threat most HOA boards will encounter. The attack is simple: an attacker sends an email that appears to come from a vendor the HOA pays regularly, or from a fellow board officer, and asks for a wire transfer or a bank account update.

The attack succeeds not because of sophisticated malware, but because HOA boards often lack written procedures for wire authorization. A treasurer who receives an email from what looks like the roofing contractor saying “please update our bank account for the upcoming $47,000 draw” has no documented process telling them to pick up the phone and call the contractor at a number already in the records.

The anatomy of a typical HOA BEC attack:

1. Attacker researches the HOA through public records, meeting minutes posted online, or social media.
2. Attacker identifies a vendor that receives regular large payments.
3. Attacker registers a lookalike domain or spoofs the vendor’s email address.
4. Attacker sends a payment account change request or urgent wire request.
5. Treasurer updates records or initiates wire without out-of-band verification.
6. Funds transfer to the attacker’s account. Recall window is typically 24-72 hours.

Ransomware against management systems

Ransomware enters most small-organization environments through a phishing email. A board officer or property manager opens an attachment or clicks a link, and the malware encrypts files on that device, and potentially any network drives or cloud folders synchronized to it.

For an HOA, ransomware can encrypt:

• Accounting records and the general ledger
• Owner contact and payment information
• Governing documents, meeting minutes, and contracts
• Reserve study and vendor bid files

Cloud-based management software reduces local exposure significantly, but boards that run HOA business through personal email accounts, local spreadsheets, or shared Dropbox folders carry real ransomware risk on those personal devices.

Owner PII breaches

HOAs hold more personally identifiable information than most boards realize. A typical community database includes owner names, mailing and email addresses, phone numbers, ACH bank account information for dues collection, credit card tokens, and sometimes social security numbers for lien filings or collection matters.

If that data is exposed through a breach, whether from a ransomware attack, a compromised email account, or a misconfigured shared document, state breach notification laws are likely to apply. The notification obligation falls on the HOA board as the entity that collected and held the data, not the software vendor unless the contract explicitly shifts that duty.

Vendor payment change fraud

This attack is a subset of BEC but deserves separate mention because it is extremely common and the defense is specific. An attacker impersonates an existing vendor and submits a request to change the bank account on file for future payments. The HOA processes the next invoice normally, but the payment goes to the attacker.

The defense is a written policy: any bank account change for an existing vendor must be verified by a phone call to a number already in the HOA’s vendor records, not any number provided in the change request.

Core cybersecurity controls for HOA boards

Dual-control wire authorization

Every outgoing wire transfer should require two separate authorized individuals, acting through separate communication channels, to both initiate and approve the payment.

A workable process:

1. The person requesting the wire (treasurer or manager) contacts the payee at a phone number from the HOA’s existing records to confirm amount, date, and account number.
2. The treasurer then enters the wire in the bank’s online portal as a pending transaction.
3. A second authorized approver, typically the board president, logs into the bank portal independently and approves the pending transaction.

Neither the initiating call nor the portal approval should rely on contact information from the wire request itself. The verification call goes to the number already on file.

Most community banks and credit unions can configure dual-approval wire workflows in business online banking at no additional cost. This is the most important single control an HOA can implement.

Multi-factor authentication on financial accounts

Every bank account, payment platform, and management software login that can initiate or approve a financial transaction should require MFA. Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are more secure than SMS codes because SMS is vulnerable to SIM-swap attacks.

A board member whose bank account login is protected only by a password is one phishing email away from a compromised session. MFA does not prevent every attack, but it eliminates the large class of attacks that rely solely on stolen credentials.

Steps to implement:

1. Log into each financial account and check security settings.
2. Enable MFA if available. Prefer authenticator apps over SMS.
3. Confirm that the bank requires MFA for wire initiation and approval, not just login.
4. Document which accounts have MFA and review annually when the board transitions officers.

Written vendor payment change procedures

Produce a one-page policy that covers:

• Any request to change a vendor’s payment account (bank account, routing number, or payment method) must be verified by phone call to the vendor’s number in the HOA’s vendor register before the change is applied.
• The board secretary or manager updates the vendor register only after that verification is documented.
• Requests arriving by email, including emails that appear to come from the vendor, are not sufficient authorization on their own.

This policy should be approved by the board, stored in the governing document archive, and reviewed with any incoming board officer during the transition.

Cyber insurance

Standard HOA insurance packages, including most D&O policies, do not cover:

• First-party funds transfer fraud losses
• Ransomware recovery and system restoration
• Breach notification costs (legal fees, notification mailings, credit monitoring)
• Regulatory fines for breach notification failures

Standalone cyber insurance policies or cyber endorsements added to the community association policy fill these gaps. When evaluating a policy, boards should confirm it covers funds transfer fraud (some cyber policies exclude it as a “crime” loss covered separately), breach notification expenses, and first-party data recovery.

Secure document storage

Meeting minutes, owner rosters, and financial records held in personal email inboxes or ad-hoc shared folders create unnecessary breach exposure. Boards should store HOA records in a system that has access controls, audit logs, and encryption at rest. Purpose-built HOA management software provides this by default. A shared Google Drive folder does not, unless permissions are configured carefully and reviewed regularly.

Phishing awareness for board officers

The most effective phishing defense is a board that recognizes the attack patterns:

• Urgent wire requests from board officers or vendors, especially requests that bypass normal approval steps
• Bank account change requests from existing vendors
• Emails asking for login credentials or asking a user to click a link to “verify” their account
• Lookalike sender domains ([email protected] when the real vendor is [email protected])

Board orientation, when new officers join, is the right time to cover these patterns. It does not need to be a formal training session: a ten-minute walkthrough of the wire fraud and vendor payment change procedures is sufficient.

Incident response: step-by-step

If your HOA suspects it has been the target of wire fraud, a ransomware attack, or a PII breach, the following table provides a structured response sequence.

Evaluating your management software vendor’s security posture

The HOA’s management software vendor holds a copy of the same owner data the board does. Before contracting with a vendor, and at each renewal, boards should ask:

• Does the vendor have a SOC 2 Type II report or equivalent third-party security audit? Can they share it?
• Who holds the encryption keys for data at rest?
• What is the vendor’s breach notification procedure and timeline?
• Does the contract place breach notification obligations on the vendor, the HOA, or both?
• Does the vendor carry cyber insurance that covers client data?
• What is the contractual limit on the vendor’s liability if a breach occurs?

A vendor that cannot answer these questions clearly is a risk that should factor into the contracting decision.

What boards with fiduciary duty exposure should do now

Board members have a fiduciary duty to act in the interest of the community. A wire fraud loss or a PII breach that results from a failure to implement basic controls, dual-control authorization, MFA, and a written vendor payment policy, is the kind of decision that personal liability claims attach to.

Directors and officers insurance provides some protection, but most D&O policies exclude intentional acts and, critically, exclude first-party financial losses from fraud. Cyber insurance fills that gap. A board that carries neither a written wire control policy nor cyber insurance, and then loses $200,000 in a BEC attack, faces a difficult conversation with the homeowners who funded that reserve account.

The controls described in this guide are not expensive or technically complex. Dual-control wire authorization and a vendor payment change policy are written procedures, not software purchases. MFA is a free feature on most bank and software platforms. Cyber insurance for an HOA typically costs less than the HOA pays for a single landscape maintenance cycle. The fiduciary argument for implementing them is straightforward.

We built BoardStack to give self-managed boards a secure, purpose-built platform for financial management and records, one where access controls, audit logs, and fund separation are enforced at the system level rather than left to manual procedures. But the controls in this guide apply regardless of what software your board uses. Start with the wire authorization policy and MFA. Those two changes address the majority of the dollar-loss risk most HOA boards face.

DEFINITION

Business Email Compromise (BEC)

A fraud scheme in which an attacker impersonates a trusted party via email to trick the target into transferring money or sensitive information to a fraudulent destination. BEC attacks rely on social engineering rather than malware and are often targeted at organizations that make regular wire transfers. The FBI IC3 reports BEC as one of the costliest categories of cybercrime by dollar loss.

DEFINITION

Dual-Control Authorization

A financial control requiring that two separate authorized individuals, using separate communication channels or system roles, must both act to complete a sensitive transaction such as a wire transfer. Dual control eliminates the single-point-of-failure that makes wire fraud easy: an attacker must compromise two people simultaneously rather than one.

DEFINITION

Multi-Factor Authentication (MFA)

A login security method that requires at least two distinct verification factors before granting access: typically something you know (password) and something you have (authenticator app code, hardware token, or SMS one-time passcode). MFA significantly raises the cost of credential-based attacks because a stolen password alone is insufficient to log in.

DEFINITION

Ransomware

Malicious software that encrypts the victim's data and demands payment, usually in cryptocurrency, to provide the decryption key. Ransomware attacks on small organizations, including homeowner associations, often begin with a phishing email that tricks a user into executing a malicious attachment or clicking a link that downloads the malware.

DEFINITION

Breach Notification Law

A state or federal statute requiring organizations that hold personal information to notify affected individuals and, in some cases, state regulators within a specified period after discovering that personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. Forty-seven states plus D.C. have enacted some form of breach notification law, and the definitions of covered personal information vary by state.

DEFINITION

Phishing

A social engineering attack delivered via email (or SMS, in which case it is called smishing) in which the attacker crafts a message that appears to come from a trusted source and induces the recipient to click a malicious link, open a malicious attachment, or provide credentials or sensitive data. Phishing is the most common entry point for both BEC fraud and ransomware infections.

DEFINITION

Cyber Insurance

An insurance product that covers financial losses arising from cyber events, including first-party losses such as ransomware recovery and business interruption, third-party liabilities such as breach notification costs and regulatory fines, and funds transfer fraud. Standard community association insurance policies, including most D&O policies, do not cover these losses without a specific cyber endorsement.