BMA Public Warning – Fraudulent Email Domain: BMA-BM.com (2025-08-14)

Summary

This is a public warning notice from the Bermuda Monetary Authority alerting regulated entities and the public to a fraud scheme using the spoofed email domain bma-bm.com. Fraudsters used this domain to send fake payment instructions that misdirected funds intended for the Authority to an unrelated account in another jurisdiction.

• Genuine domain: Authentic BMA emails always come from the domain @bma.bm, not @bma-bm.com.
• Fee and payment details: The Authority posts its official fees and payment instructions on its own website; any instruction to send funds elsewhere should be treated as fraudulent.
• Verification steps: Recipients with doubts about a communication should not open attachments or trust contact details in a suspicious email, and should instead call a known representative or the Authority's main number to verbally confirm.
• Payment queries: Queries about payments to the Authority should be directed to finance-receivables@bma.bm.
• Action taken: The Authority has moved to have the fraudulent domain suspended and has added it to its public warning list at www.bma.bm/warning-list.

The notice is informational and warns of an active fraud risk rather than imposing new regulatory requirements, though it reiterates existing expectations around verifying payment instructions.

Key obligations

• Regulated entities and the public should verify that emails claiming to be from the Authority use the domain @bma.bm before acting on them.
• Recipients with doubts about a communication should refrain from opening attachments or trusting contact details in the suspicious email and instead verbally confirm content via a known contact or the Authority's main number.
• Any instruction to send funds to an institution other than those specified in the Authority's published fee and payment instructions should be treated as fraudulent and not acted upon.

Applies to

regulated entities, general public