The Insider Threat: Why Boards Should Worry About Who Is Already Inside

Boards often picture cyber risk as an outside hacker. In associations, the bigger risk usually comes through someone who is already trusted with the money: staff, a manager, or a director. That is the insider threat, and it comes in two forms.

The insider who gets fooled

The most common insider means no harm. They receive an email that looks like it came from a vendor, the manager, or another association, asking that a payment go to a new account. This is an email compromise: a criminal posing as someone trusted to redirect a payment.

CASE STUDIES: A Condominium in Key Biscayne, received an invoice that appeared to come from the master association from an address one letter off and asked for payment to a new account. Staff paid it; the loss was $105,000, according to a police report, and the board discussed a special assessment.

A New York property management company reported that more than $18 million in client funds was lost after an email posing as a government agency changed wire instructions. One condo board is suing for its $1.3 million share; the board's lawsuit alleges the new instructions were not confirmed by phone.

Board members using personal email for association business add to the risk. Personal accounts are softer targets, and owners and managers can't easily tell a real message from a fake one.

The insider who steals

Less common, and harder to see, is the trusted person who takes advantage of their access. According to the Miami-Dade Sheriff's Office, which announced arrests in August 2026, investigators allege a $5.8 million scheme in which the owner of a property management company used companies he owned and undisclosed affiliated vendors to control associations' finances, and elderly board members were misled into signing documents they did not fully understand. The charges are allegations and the case is pending.

Separately, Miami-Dade prosecutors allege that a former licensed community association manager at a Brickell condominium billed the association for "ghost employees," misappropriating more than $140,000. The charges have not been proven. A license and background check did not prevent it.

Training and controls

Security awareness training is basic cyber hygiene and a best practice: teach staff, managers, and board members to spot phishing and look-alike emails. Training stops the insider who gets fooled. Financial controls stop the insider who steals. Several controls cover both:

• Call-back verification at a known number before any payment change.
• Dual approval for payments.
• The board's own read-only bank access.
• Independent reconciliation, and verification that invoiced work was done.
• Conflict-of-interest and vendor-ownership disclosure.
• Insurance and loan proceeds paid to the association.

Most management companies are partners who want these controls. They protect good managers, too. This is trust but verify.

Questions every board should ask:

• Who can change where a payment goes, and who must approve it?
• Does anyone call back at a known number before a payment change?
• Can a director see the bank accounts directly?
• Who reconciles the accounts, and is it someone who doesn't pay the bills?
• Do we know who owns the vendors we pay?
• Have our staff, manager, and directors had phishing training, and are directors using association email?

General information only, not legal advice.

TBC Advisory is an independent partner to Florida HOA and COA boards. We take a risk-based approach to creating actionable roadmaps that solve community problems. Book a free consultation at tbcadvisory.com/contact.

If an email asked your association to send next month's payment to a new account, what would stop it?