The digital transformation of financial services brings convenience to our clients and enhances the way we do business. However, these advances also provide cyber criminals with the opportunity to defraud online individuals and steal valuable information and/or financial assets. Individuals who are less equipped with cybersecurity knowledge are more vulnerable to becoming victims of cyber threats and online fraud.
Cyber criminals may impersonate or claim affiliation with Morgan Stanley and create fraudulent websites, email domains, mobile applications, social media accounts and e-commerce accounts; send emails or text messages; and make phone calls to, among other things, solicit business and/or monetary payments from individuals. It is important to be aware of these types of fraud.
At Morgan Stanley, we have a suite of controls and processes to protect our clients and our infrastructure. The following resources are intended to help individuals to further protect themselves from cyber threats.
Learn More
Phishing Emails remain a highly successful way for cyber criminals to defraud and steal personal information. These emails seem to come from a trusted source. The email usually asks you to click on a link or download an attachment. The link typically takes you to a website that seeks to steal your personal information or attempts to entice you to download malicious software (or “malware”) onto your computer. The malware can provide hackers with your personal documents and information, such as a tax return or even capturing your logins, passwords etc.
Other types of social engineering attacks are smishing and vishing that also aim to steal sensitive information, but they differ from phishing in the communication channel used. Smishing attacks are delivered through fraudulent text messages (SMS), and vishing relies on deceptive phone calls.
Business Email Compromise (BEC) is an online fraud committed through spoofed or compromised email accounts, similar to phishing, however more targeted and sophisticated. You may receive an email that appears to be from a known source or trusted sender requesting information or a fund transfer. Typically, there is an unexplained urgency and/or a request for a change of payment instructions.
Generally, payment instructions should be authenticated using a separate more secure channel. For example, in addition to email verification, details may be confirmed verbally by calling a trusted phone number (i.e., a call-back verification). Be sure to check for anomalies in payment instructions and compare any banking information update request emails against past legitimate emails.
Important Notice – Give special attention to the email domains of incoming emails. Emails from Morgan Stanley will always be from one of our official email domains, not from public domains (e.g., @gmail.com, @icloud.com). If you are uncertain or have reason to believe that an email is fraudulent, contact your Morgan Stanley Client Representative immediately.
Deepfakes are realistic video, audio, or text messages created using artificial intelligence to impersonate trusted individuals or organizations. To protect yourself, always verify unexpected requests for sensitive information or payments—especially if received via phone, email, or video. Look out for signs such as mismatched lip movements, odd lighting, or unusual urgency. Use multi-factor authentication, keep software updated, and never rely solely on voice or video for identity verification. If in doubt, confirm requests through a separate trusted channel.
Online Investment Scams are fake opportunities that appear to be low risk with an unrealistically high return. Cyber criminals often use social media platforms such as online chat groups, fake investment comparison sites, gaming or gambling websites, even dating applications to find potential victims. Cybercriminals often create spoofed domains or fake mobile applications, impersonating trusted contacts or brands. High-yield bonds and cryptocurrency investments are two of the most common types of online investment scams.
Generally, investment decisions should not be made based solely on information promoted through a social media platform, especially if investment opportunities seem too good to be true. Seek professional advice about any investment opportunity and always authenticate details of an investment before transferring funds.
Important Notice – Morgan Stanley does not send unsolicited investment offers via email and does not conduct business over social media. If you receive information regarding an investment opportunity offered by or affiliated with Morgan Stanley from anyone other than your existing Morgan Stanley financial advisor/sales representative, Contact your Morgan Stanley Client Representative immediately.
Social Media Impersonations occur when a cyber criminal creates an account on a social media platform, impersonating an individual or an organization. They use the fake account to gather sensitive information or to solicit business and/or payments from victims.
Important Notice – It is important to confirm the identity of any person in online communications before providing them with any personal or financial information. If you suspect or have any doubts that a person or organization claiming to represent Morgan Stanley is fraudulent, contact your Morgan Stanley Client Representative immediately.
Recruitment Scams take the form of job openings, job application coaching or interview training. The cybercriminal often charges a fee for an interview or opportunity. They may also pose as career consultants or staff of a targeted organization.
Important Notice – Morgan Stanley does not offer interviews, internships, jobs, job application coaching, interview trainings or any form of career consultancy through third parties, nor do we offer “pay-to-work” internship arrangements. If you suspect that an employment offer or related service is fraudulent, contact your Morgan Stanley Client Representative immediately
Identity Theft occurs when a cybercriminal uses someone else’s personal information to commit online fraud, such as applying for a bank loan or credit card application, using a stolen identity. The personal information could be stolen through phishing or other online scams.
Ransomware is a type of malware that accesses, locks and encrypts your files, until you pay a ransom to retrieve the encrypted files.
Credential Stuffing occurs when a criminal steal account credentials to access your online account. You are more vulnerable to this attack if you’re cycle usernames and passwords across different online platforms.
More Helpful Tips
- Do not click on links, open attachments, scan QR codes or contact senders if you cannot confirm the authenticity of the sender. Never provide personal information to an unknown party. If an email requests you to take action on a link or attachment, independently verify the sender’s identity
- Bookmark important and often-visited banking and brokerage websites in your internet browser to avoid inadvertently entering login credentials on a fraudulent website (i.e., misspelled domain).
- Enable multi-factor authentication (MFA) to log onto any websites or applications that have access to your personal information. This additional layer of protection helps to verify your identity.
- Keep your software, operating system and internet browser up to date. Software companies continuously improve security, so install as soon as they are available.
- Run a reputable antivirus product on all of your devices regularly, including your desktop, laptop, tablet and mobile device. This will help guard against new malware and address any existing infections.
- Only download applications from legitimate app stores and never from a third-party app store, website or QR code. Third-party app stores or pop-up applications are more likely to contain malware.
- Do not use identical or similar passwords across multiple websites and applications, vary your passwords and avoid writing them down. If one account is compromised, all your accounts could be at risk.
- Avoid using public Wi-Fi hotspots in unsecure locations, such as coffee shops, airports and hotels. Instead, use a private mobile network and create a personal Wi-Fi hotspot with your phone. If you do use public Wi-Fi, rely on a virtual private network (VPN) to prevent your internet activities from being intercepted.
- Be selective of the personal information that you share on social media. Make sure your security settings are as secure as possible. Never share your personal information or login credentials with anyone.
Contact Us
Please contact your Morgan Stanley Client Representative immediately if you encounter: websites, mobile applications, e-commerce accounts or social media accounts using the Morgan Stanley name, or receive emails, text messages or phone calls from Morgan Stanley that you find suspicious. Alternatively, further information for WM Clients only can be found here: Security Center | Morgan Stanley