Thoroughbred Racing Association of Oklahoma (TRAO)

11 hours ago

Message from National HBPA below in full:

𝐂𝐨𝐦𝐛𝐢𝐧𝐚𝐭𝐢𝐨𝐧 𝐀𝐈 𝐬𝐨𝐜𝐢𝐚𝐥 𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫𝐢𝐧𝐠 𝐚𝐧𝐝 𝐏𝐡𝐨𝐧𝐞 𝐂𝐚𝐥𝐥𝐬

Attention NHBPA Board Members and Affiliate Executive Directors,

I want to bring an increasingly serious issue to your attention that could have a very real financial impact on our affiliates, horsemen, and anyone within our industry who has authority to move money.
This is not a hypothetical threat. It is happening now.

I recently received a warning from our insurance professionals at Gallagher regarding a significant increase in AI-driven social engineering attacks combined with telephone scams. In the past eight weeks alone, three Gallagher clients—including one HBPA member—were victimized. The losses were $1,488,967, $183,312, and $26,995.

The FBI is involved in these cases, but the unfortunate reality is that once money leaves an account, it can be moved through multiple accounts within minutes, making recovery extremely difficult.
What concerns me most is how sophisticated and accurate these attacks have become.

How the scam works:
These attacks are not necessarily obvious phishing emails with misspelled words or suspicious links. In the cases described to Gallagher, the criminals had accurate bank information, payroll information, checking-account information, employee names, and other personnel details.

The initial email or text message was then followed quickly by a phone call from someone claiming to be:
• Your bank or financial institution
• Your payroll company
• Your law firm or other professional adviser
• Another trusted business contact
The caller creates a sense of urgency and may ask the recipient to:
• Authorize access to an account
• Transfer funds
• Change banking information
• Replace a pending check or wire with a new transfer
• Provide or confirm information necessary to complete a transaction

Because the information being used is accurate, the request can appear completely legitimate.
That is what makes this particularly dangerous.

The Gallagher office that helps the HBPA has historically averaged one to three social engineering claims a year. Having three claims in an eight-week period is unusual, and the FBI has indicated etc. Having three significant claims occur in an eight-week period is highly unusual, and the FBI has indicated that the increase in AI-assisted social-engineering attacks during 2026 has been immense.

I want every HBPA affiliate and horsemen to take this seriously. For our industry, this is especially important because many trainers and small businesses have a relatively small number of people handling financial matters. A trainer, bookkeeper, office manager, or other authorized employee may have the ability to move significant amounts of money.

Do not assume that because someone knows your account information, your payroll information, or the names of your employees that the request is legitimate. In fact, the accuracy of that information may be part of the attack.

I strongly encourage every affiliate to review its financial procedures immediately and encourage your horsemen to do the same.

At a minimum:
𝟏. 𝐄𝐬𝐭𝐚𝐛𝐥𝐢𝐬𝐡 𝐚 𝐯𝐞𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐩𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞 𝐟𝐨𝐫 𝐚𝐧𝐲 𝐫𝐞𝐪𝐮𝐞𝐬𝐭 𝐭𝐨 𝐦𝐨𝐯𝐞 𝐦𝐨𝐧𝐞𝐲.
Do not rely solely on an email, text, or incoming phone call. If someone asks you to transfer funds or change payment instructions, independently contact that person or company using a known telephone number, not a number provided in the message.
𝟐. 𝐓𝐫𝐞𝐚𝐭 𝐮𝐫𝐠𝐞𝐧𝐜𝐲 𝐚𝐬 𝐚 𝐰𝐚𝐫𝐧𝐢𝐧𝐠 𝐬𝐢𝐠𝐧.
If someone is pressuring you to act immediately because a payment, payroll, wire, account, or transaction is supposedly at risk, stop and independently verify the request.
𝟑. 𝐑𝐞𝐯𝐢𝐞𝐰 𝐰𝐡𝐨 𝐡𝐚𝐬 𝐚𝐮𝐭𝐡𝐨𝐫𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐭𝐨 𝐦𝐨𝐯𝐞 𝐦𝐨𝐧𝐞𝐲.
Affiliates, trainers, and businesses should know exactly who can initiate or approve transfers and what dollar limits apply.
𝟒. 𝐑𝐞𝐯𝐢𝐞𝐰 𝐲𝐨𝐮𝐫 𝐢𝐧𝐬𝐮𝐫𝐚𝐧𝐜𝐞 𝐜𝐨𝐯𝐞𝐫𝐚𝐠𝐞.
This is particularly important. Gallagher advises that horsemen and organizations should review their crime and cyber insurance policies for adequate social-engineering coverage. Social-engineering losses can have different coverage triggers from traditional theft or embezzlement, and some policies contain sublimits that may be substantially lower than the policy's primary limit.
If a trainer's bookkeeper or employee is authorized to move money, the applicable insurance limits should be reviewed in relation to the maximum amount that person is authorized to transfer.
𝟓. 𝐃𝐨𝐧'𝐭 𝐚𝐬𝐬𝐮𝐦𝐞 𝐭𝐡𝐞 𝐛𝐚𝐧𝐤 𝐰𝐢𝐥𝐥 𝐚𝐛𝐬𝐨𝐫𝐛 𝐭𝐡𝐞 𝐥𝐨𝐬𝐬.
Bank agreements can place significant responsibility on the account holder when an authorized user has actually approved a transaction. That makes prevention and proper insurance coverage even more important.

Please share this with your Board members and horsemen. As an organization representing horsemen and our affiliates, I believe we have a responsibility to make sure this information gets out before one of our members experiences a devastating loss.

AI has created tremendous opportunities, but this is one of its darker applications. Criminals can now combine highly accurate information with convincing emails, text messages, and phone conversations to impersonate people and organizations we trust. This has become a risk-management priority and not something to address after an incident occurs.

Please take a few minutes to review your own financial controls and insurance coverage, and I encourage each affiliate to discuss this with its Board, staff, financial personnel, and insurance professional.

Gallagher is also developing additional guidance and "tip sheets" for its clients, and I will share additional information as it becomes available.

Please pass this info along.
Eric ... See MoreSee Less