DFS Alert: Phishing Scam Targeting Regulated Entities

NY DFS Industry Letters

Published January 22nd, 2026

Detected February 12th, 2026

Summary

The New York Department of Financial Services (DFS) issued an alert regarding a phishing scam targeting regulated entities. The notice advises entities to exercise caution with unexpected communications and verify legitimacy before taking action.

View original document View source feed page

What changed

The New York Department of Financial Services (DFS) has issued a cybersecurity threat alert to its regulated entities and individuals, warning them of a sophisticated phishing scam. The scam involves emails falsely claiming to be from DFS personnel, urging recipients to open files, make payments, or share missing information. The alert specifically identifies a fraudulent email domain ([@]myportal.dfs.ny.gov.cazepost.com) and contrasts it with legitimate DFS email domains ([@]dfs.ny.gov or [@]public.govdelivery.com).

Regulated entities are strongly advised to exercise extreme caution with unsolicited communications from DFS, especially those requesting immediate payment, attachments, or account credentials. They should verify the legitimacy of such emails by directly contacting their primary DFS point of contact or the DFS Consumer Assistance Unit, rather than using contact information provided within the suspicious email. The DFS also reiterates the importance of ongoing personnel training, simulated phishing exercises, and technical controls like email filtering to mitigate such threats.

What to do next

Review email header information for suspicious communications claiming to be from DFS.
Verify the legitimacy of any unexpected DFS communication requesting payment, attachments, or credentials by using direct contact information, not links or contacts in the email.
Continue regular personnel training and simulated phishing exercises.

Source document (simplified)

Industry Letter

Date: January 22, 2026

To: DFS-Regulated Entities and Individuals

Re: Cybersecurity Threat Alert – Email Phishing Scam Targeting DFS Regulated Entities

The Department of Financial Services (“DFS”) is alerting regulated entities and individuals to use caution before responding to outreach from individuals falsely claiming to represent DFS.

DFS recently became aware of phishing emails purporting to come from DFS personnel urging regulated entities to open files, make payments, and/or claims to share a file that is missing to prompt further engagement. DFS urges all regulated entities to closely review email header information, including the email address used to transmit the email.

Legitimate DFS emails will be sent only from [@]dfs.ny.gov or [@]public.govdelivery.com. At least some of the messages claiming to be from DFS were sent from [@]myportal.dfs.ny.gov.cazepost.com. Emails from this domain are not legitimate.

If you receive unexpected communications from DFS requesting immediate payment, to open an attachment, or to enter account credentials, you should confirm the legitimacy of the email before taking action. Do not use contacts or links provided in these communications. Instead, directly reach out to DFS via your primary point of contact or the DFS Consumer Assistance Unit .

As always, regulated entities and individuals should exercise caution when asked to provide sensitive information, open attachments, enter account credentials, change payment instructions, or issue payments. DFS urges regulated entities and individuals to continue regular personnel training and simulated phishing exercises in addition to technical controls such as email filtering and alerts for external emails.