How families and family offices are defrauded

The common thread

It is tempting to read fraud as a technical failure. In this setting it rarely is. No security product would have refused these transactions, because they looked legitimate: someone with the authority to move money did so, on an instruction they had every reason to believe.

So the useful question is not which product to buy. It is which decision, in your own arrangements, currently turns on a message. Each pattern below is set out the same way: how it works, the tell, and the control that defeats it.

1. Deepfake payment authorisation

A family office administrator takes a call, or joins a short video meeting with the principal. The voice is right. The manner is right. There is a transaction in progress that the caller clearly knows about, and a payment needs to go today, to a new account, quietly, because the other side is sensitive about it. Synthesising a convincing voice takes very little source material, and a principal who speaks at conferences or appears on video has supplied plenty.

The tell. Authority, urgency and secrecy in one instruction, with a reason attached not to check: the principal is boarding a flight, the lawyers are waiting, or the request is framed as a test of discretion. Genuine instructions do sometimes arrive urgently. They do not usually arrive explaining why they must not be confirmed.

The control. Verification out of band, on a number you already held before the instruction arrived. Not the number in the signature, not the number read out on the call, and never a callback through the channel the instruction came in on. The fraudster controls the channel they chose. They cannot control the one you chose earlier.

2. Business email compromise

The quietest of the five, and usually the longest running. An attacker reaches a real mailbox, usually through a credential taken from an earlier breach or a convincing sign-in page, then does nothing visible for weeks. They read. They learn who instructs whom, which supplier is owed what, how payments are worded and when the principal is unreachable. When a payment is genuinely due, the instruction arrives from the real address, in the right style, with new bank details and a plausible explanation.

The tell. A change of bank details, in any form, at any point in an otherwise normal relationship. Also replies that arrive slightly out of thread, or messages that vanish from a mailbox. Rules that silently file or forward correspondence are a common fingerprint of this pattern, and almost nobody looks at them.

The control. A standing rule that a change of payment details is never accepted on the strength of an email, however convincing the thread. Then two supporting measures: a periodic audit of mailbox forwarding and rules across the family and its businesses, and hardware security keys or equivalent phishing-resistant authentication on the mailboxes that matter, which removes the credential theft that starts most cases. Breached credentials usually surface in the collections that dark web monitoring watches, which is where a warning, if one comes at all, tends to come from.

3. SIM swap

A great many institutions treat a mobile number as proof of identity. If someone persuades an operator to move that number to a SIM they control, they inherit the codes that reset the email account, and the email account resets nearly everything else. The victim sees the phone lose signal and assumes it is a network problem. By the time the number is restored, the useful window has closed.

The tell. A phone that drops to no service without explanation, on a normal day in a normal place, particularly if password reset messages or unexpected sign-in notifications appear around the same time on other devices. Treat sudden loss of mobile service as a security event first and a network fault second.

The control. Take the phone number out of the recovery path: remove SMS as a reset factor wherever the provider allows it, and move to an authenticator application or, better, a hardware key. Where the operator offers port protection, a porting PIN or an account note requiring in-person authorisation, take it. This is a short piece of work with a disproportionate effect, and it is the item on this list most often left undone. The SIM swap guide covers the mechanics and the carrier-side protections in full.

4. The compromised assistant

The personal assistant's account is often better connected than it is protected. They hold the calendar, the contacts, the travel plans and the correspondence, and, crucially, they are believed. An instruction that appears to come from the assistant carries the principal's authority without the principal's involvement. Attackers know this, and the assistant is frequently the first account they go for rather than the last.

The tell. Requests arriving through the assistant that depart from ordinary practice: an unfamiliar counterparty, a change of destination account, a payment that must be made while the principal is travelling. It is also worth noticing where an assistant holds access nobody ever decided to give them, accumulated over years because it was convenient at the time.

The control. Three things, in order. Least privilege: delegated mailbox and banking access should be explicit, reviewed, and revoked when the reason for it ends. Separate approval: the person who prepares a payment should not be the person who releases it. And training that names this pattern openly. Assistants are targeted because of their position, not because of any failing, and a briefing that says so plainly is far likelier to produce a raised hand than one that implies blame.

5. Invoice fraud

A builder, an architect, a yacht manager, a school or a law firm sends a real invoice for real work. Somewhere between their system and yours the bank details are altered, either because their mailbox was compromised or because the document was intercepted and reissued. Everything else about the invoice is correct, because everything else about it is genuine. The loss is usually discovered weeks later, when the supplier chases a payment they never received.

The tell. There often is not one on the face of the document, which is what makes this pattern effective. The context is where it shows: a first payment to a new supplier, details that differ from those held on file, an account name that does not quite match the trading name, or an invoice arriving as a fresh email rather than in the existing thread.

The control. Verify bank details by telephone before the first payment to any new supplier, using a number obtained independently of the invoice, and record who confirmed them. Hold those details on file and treat any later change as a fresh verification, not an update. Above an agreed threshold, require dual approval. Property and construction projects deserve particular attention: the sums are large, the parties numerous and the correspondence long.

The one page that turns this into a rule

Every control above reduces to the same instruction: confirm on a channel the other party did not choose, before the money moves. Families and family offices generally know this. What they usually do not have is a written procedure that says it, which everyone has read, and which an assistant can point to when a principal is impatient.

Vigilance is not a control. It depends on the alertness of one person on a particular afternoon, and it fails precisely when the pressure is highest. A written, adopted procedure is a control, because it removes the judgement call. Nobody is deciding whether an instruction feels genuine. They are following the rule, and the rule is the same for everyone, including the principal.

The payment verification protocol is a one page template for exactly that: which payments require verification, on which channel, who may approve, and where the confirmation is recorded. It is deliberately short, because a procedure nobody reads protects nobody. Adapt it, date it, and make sure the people who press the button have a copy.

Sources

• National Cyber Security Centre, Phishing attacks: defending your organisation, which covers spear phishing and whaling and sets out a layered approach to mitigation.
• National Cyber Security Centre, Multi-factor authentication for your corporate online services, on choosing authentication factors and the limitations of SMS.
• Report Fraud (formerly Action Fraud), Mandate fraud, the UK reporting body's description of payment diversion and business email compromise.
• Payment Systems Regulator, APP scams, on authorised push payment fraud and the reimbursement requirements placed on payment firms.
• Ofcom, Scam calls and messages, on telephone and mobile network fraud and how to report it.
• Stop! Think Fraud, the UK government fraud campaign, for guidance to circulate to family members and staff.

Where this sits

Read on its own, this is a list of five things to check. Read properly, it is a question about how instructions travel between a family, its office, its businesses and its advisers, and where along that path money moves on the strength of a message. That question is rarely answerable from inside any single relationship, because each provider sees only their own part of it.

A family cyber review looks at the whole position in one piece and puts the findings in writing.