Industry Alert: NIPR Warns of Active Phishing Campaign Targeting Producers

The National Insurance Producer Registry (NIPR) has issued an industry-wide alert regarding a phishing campaign targeting insurance producers with fraudulent invoice emails. These messages may appear to come from familiar domains such as NIPR, NAIC, or Stripe, but are not legitimate. As phishing tactics become more sophisticated, agencies, carriers, and producers must remain vigilant. Understanding how to identify suspicious communications and taking immediate action can help prevent financial loss, protect sensitive information, and maintain compliance across licensing operations.

What’s Happening

NIPR has identified an active phishing campaign targeting insurance producers through fraudulent emails referencing past due invoices. These emails are designed to appear legitimate, often using familiar branding and domains such as @nipr.com, @naic.org, or @stripe.

Despite their appearance, these emails are not sent from official NIPR accounts and should not be trusted. Their goal is to prompt recipients to submit payment or interact with malicious links.

What NIPR Is Doing

NIPR, in coordination with the NAIC, is actively responding to this threat and implementing measures to protect the industry.

• Monitoring and investigating phishing activity
• Posting alerts on NIPR.com and within the Licensing Center
• Communicating with clients to gather details and support the investigation
• Notifying state insurance commissioners
• Preparing additional outreach to industry contacts

Immediate Actions to Take

Organizations should take the following steps immediately to reduce risk:

• Share the NIPR’s phishing information webpage with all producers and staff
• Treat any unexpected invoice email as suspicious
• Do not click links, open attachments, or submit payments from unsolicited emails
• Contact NIPR directly at niprbillingdept@nipr.com to verify legitimacy

Why This Matters

Phishing attacks continue to evolve, often leveraging trusted industry names and routine processes to appear credible. Because licensing and compliance activities frequently involve transactions and documentation, these emails can be especially convincing.

Proactive communication, verification processes, and ensuring producers have access to accurate system notifications are essential to minimizing risk.

Summary

This phishing campaign serves as an important reminder that even trusted industry channels can be mimicked. Staying informed, verifying requests, and communicating quickly across your organization are critical steps in protecting your data and financial operations.

Share this blog on