Weekly Real Estate News
Summary
MBA has arranged cybersecurity support for its members through FTI Consulting.
Mortgage lenders looking for outside help with cybersecurity incidents now have a new option through the Mortgage Bankers Association, which has arranged preferred access to services from FTI Consulting for its members.
The association announced the arrangement October 9. It covers three broad areas: identifying urgent security weaknesses, looking for exposed systems or compromised credentials, and obtaining professional assistance during and after a cyber incident. The offering is designed for targeted engagements rather than requiring a comprehensive audit or a standing consulting contract.
The distinction is important for smaller independent mortgage banks and lenders that may not maintain full-time incident-response teams. A cyberattack can interrupt loan origination, expose borrower information and disrupt connections to settlement agents, credit vendors and other service providers. When a problem occurs, the time needed to find qualified specialists can become part of the operational risk.
Rick Hill, MBA’s vice president of industry technology, said cyber incidents can interrupt production and undermine consumer confidence. The association presents the FTI relationship as a way to make specialist support easier for members to reach when a security issue demands prompt action.
What the new benefit does—and does not—promise
Preferred access is not the same as free cybersecurity coverage. MBA’s release does not disclose the price of assessments or response services, the scope of any discounts, guaranteed response times or a minimum level of service. Member companies will need to confirm commercial terms and availability directly before assuming a particular engagement is covered.
Nor does the arrangement transfer a lender’s responsibility for safeguarding customer information. A third-party consultant may help investigate a compromised account, assess an exposed system or advise on incident containment, but company management still must make decisions about notifications, remediation, vendor coordination and regulatory obligations.
Mortgage businesses rely on interconnected software and data exchanges. A loan may pass through a customer relationship management system, point-of-sale platform, loan origination system, credit reporting service, automated underwriting tools and closing partners. Security controls must account for that chain rather than treating the lender’s own network as the only point of exposure.
Credential theft and business email compromise are especially relevant to housing transactions because sensitive documents and payment instructions move between parties under tight deadlines. An outside monitoring service can help detect certain threats, but it does not replace staff training, access restrictions, independent verification of payment instructions or a tested recovery plan.
What lenders should evaluate
Before using the program, a lender should establish who can authorize an emergency engagement, what information may be shared with the consultant, how attorney-client privilege or confidentiality will be handled where relevant, and who is responsible for preserving evidence. It should also understand the consultant’s escalation process and whether subcontractors may access borrower data.
For mortgage executives, an incident-response plan is most useful when it has been rehearsed. That means keeping current contacts for technology vendors and outside counsel, defining backup communication methods and identifying which systems are critical to funding and servicing loans. A preferred-provider relationship can support those preparations but cannot substitute for them.
The MBA–FTI arrangement arrives as the industry debates how to govern new artificial-intelligence tools and strengthen oversight of service providers. ALTA’s updated Best Practices framework, released this month for the title industry, similarly places attention on vendor oversight and security controls, although the two programs serve different audiences and purposes.
The confirmed announcement is a new member benefit offering access to specialized cybersecurity support. The association has not published independent outcomes, adoption numbers or evidence that the arrangement has reduced the frequency or severity of attacks. Those measures will be needed to assess its impact over time.
