EMAIL SECURITY FOR INSURANCE BROKERSPremiums,
paid to the right account.
A broker sits between clients, insurers and premium finance providers, so one convincing email about new bank details can turn up in any of those relationships.
Dear Alex,
Please be advised that Ashcombe Premium Finance has changed its bank account. With effect from today, please send all premium remittances and settlements to our new accountnote 1, and update the details held on your system.
Note 1: Every payment moved to a new account
Account name: Ashcombe Premium Finance Ltd Sort code: 11-22-33 Account number: 12345678
Our signed letter confirming the change is available to view here: https://ashcombe-docs.example/secure/bank-letternote 2
Note 2: The proof is behind a link elsewhere
Please do not send any further payments to our previous account. If you have any questions, reply to this emailnote 3 and a member of the team will respond.
Note 3: Questions kept to email, not the phone
Kind regards, Credit Control Team Ashcombe Premium Finance
High riskJatzo's result for this fictional email
What moved the score
- Payment change with a warning sign+28
- Supplier payment details changed+16
- Business email compromise pattern+14
Invoice and mandate fraud, as UK Finance recorded it.
- £41.3 millionlost to invoice and mandate fraud in 2025
- 2,305cases recorded in the year
- 68%of the losses came from business accounts
Criminals intercept emails or take over an email account, then pose as a supplier, a solicitor or a builder with new bank details. UK Finance, Annual Fraud Report 2026, June 2026 (opens in a new tab)
What insurance brokers worry about.
And what Jatzo does about each, in the inbox your team already uses.
Premiums paid to a criminal
In one published claims case, a criminal with a broker's email login hid the client's replies and told the client to pay the premium to a new account.
What Jatzo does
The check flags a change of bank details with a warning sign beside it, such as replies going to another address, before anybody pays.
Every planClients' personal and financial details
A broker holds clients' claims history, finances and identity documents. One phished password can expose them, and a serious breach must be reported to the ICO within 72 hours.
What Jatzo does
The check flags fake sign-in requests and requests for a sign-in code before anybody types anything. Jatzo keeps the findings, never the email or its attachments.
Every planShowing what the firm does about it
When an insurer, a client or an auditor asks what the firm does about suspicious email, the answer needs to be a record, not a reassurance.
What Jatzo does
The proof pack gives your compliance officer a dated record of the checks made, the training completed and the domains watched. It is a record, not a certificate.
Business Pro
How it unfolds for insurance brokers.
A mailbox taken over
A criminal gets the login to an email account in the chain, such as a broker's.
Replies are hidden
The real replies are hidden, so nobody notices the conversation has been taken over.
- Check it here
New details arrive
An email gives new bank details for a premium, a claim payment or a premium finance provider.
The money goes
Unless somebody rings the payee on the number held on your system, the money goes to the criminal.
The gold mark is where Jatzo's check fits: somebody has the email open and nothing has been paid yet.
The check before you pay.
Six steps, every time. Print it, put it by whoever pays the invoices, and agree that nobody skips it because somebody senior is in a hurry.
Download the one-page checklist (PDF)Never change an insurer's, client's or premium finance provider's bank details because of an email alone.
Ring them on the number held on your system, not one in the email.
Tell every client in writing that your bank details will never change by email, and repeat it on renewal notices.
A second person approves any change to payee details before a premium or claim payment goes.
For a first payment to new details, send a small amount and have the payee confirm receipt by phone.
If money has gone, ring your bank's fraud line at once, then report to Report Fraud on 0300 123 2040 or reportfraud.police.uk (Police Scotland on 101 in Scotland).
What the firm gets.
It does not replace the call. It makes sure somebody makes it. Jatzo adds a check beside the message in Outlook and Gmail, at the moment somebody decides whether to pay, reply or click, and your existing email protection stays as it is.
Check before a premium or claim moves
Every planAnybody unsure about an insurer's, client's or premium finance provider's new bank details presses Check in Outlook or Gmail for a score out of 100 with the reasons.
Your compliance officer hears at once
Business and Business ProWhen anybody checks a message scoring High risk or above, an email goes to addresses you choose at your own domain, such as your compliance officer's.
A dated record of what you do
Business ProBusiness Pro builds a dated proof pack of checks made, training completed and domains watched, and an activity log records reports to IT and changes to the team.
Addresses made to look like yours
Business ProDomain Watch, on Business Pro, looks for new web addresses registered to look like your firm's, the kind a fake renewal email to your clients could come from.
See what is aimed at the firm
Business and Business ProThe organisation threat report counts the checks that reached Suspicious or above by kind of attack, the last 30 days against the 30 before, and names nobody.
For the invoices the firm pays
Separate licence, from £129 a yearInvoice Fraud Checker, a separate Windows program, compares the bank details on each invoice with the ones you confirmed for that supplier.
Which plan fits: an example
For insurance brokers with 10 people, we suggest Business Pro: £120 a month, or £1,200 a year paid annually.
That is £12 a person a month.
The proof pack and the activity log give your compliance officer a dated record of what the firm does about suspicious email, and both are on Business Pro.
Business Pro includes the threat report, so you know what is being aimed at the firm and whether it is getting worse: every email your team checked that came back Suspicious or above, by kind of attack, the last 30 days against the 30 before, naming nobody. At the start of each month a report goes by email to the addresses you choose, saying what was checked and what is still waiting.
- The Check button in Outlook, including on a phone, and in Gmail, for everybody in the team.
- Staff do nothing. Whoever looks after your email adds it once, for everybody.
- Nothing to replace. Your email, and the protection it already has, stay as they are.
- Jatzo keeps the score and the findings for up to 90 days, never the email or its attachments.
- Pay monthly, or a year in advance for ten months' price.
The Invoice Fraud Checker is a separate licence, from £129 a year. About the Invoice Fraud Checker
What your sector's own bodies say.
Each point is linked to where it was published, with its date.
A firm must maintain adequate policies and procedures to counter the risk that it might be used to further financial crime.
Report Fraud replaced Action Fraud in December 2025. The number, 0300 123 2040, did not change. GOV.UK, Report Fraud: new service from City of London Police, December 2025 (opens in a new tab)
Questions insurance brokers ask.
Does Jatzo read our client files or the rest of the mailbox?
No. Jatzo reads only the email somebody chooses to check, and the add-in cannot reply, forward, move, delete or change anything in the mailbox. It keeps the subject line, the score and the findings for up to 90 days, never the message or its attachments. Links in it are checked against Google Web Risk.
Does Jatzo make us compliant with the FCA's rules?
No tool does that on its own. SYSC 6.1.1R asks a firm for adequate policies and procedures against financial crime, and those stay yours. Jatzo gives staff a check on suspicious email and, on Business Pro, a dated record of it.
Who can see what our staff check?
Every check made in the team goes to the team. The admin and moderators can see all of them, for up to 90 days; members see their own. On Business Pro the activity log also records reports to IT and changes to the team.
Will our IT company need to do anything?
A little, once. Whoever looks after your email proves your domain with one DNS record. For Microsoft 365 they then upload one file in the admin centre, which needs the Exchange Administrator or Global Administrator role, and Microsoft takes 24 to 72 hours to add the button. For Google Workspace they install Jatzo for the domain. Staff do nothing.
Check the next email that makes you pause.
For other businesses: Law firms; accountants; estate and letting agents; construction firms and architects; manufacturers, wholesalers and distributors; recruitment agencies; marketing and digital agencies; healthcare practices and charities.