Family office
Payment fraud in family offices: why one phone call beats every filter
The most expensive cyber attack on a wealthy family often involves no malware at all. It is an e-mail — sometimes a call or a video meeting — asking someone to pay: urgently, discreetly and to a new account. Family offices, yacht management and estate staff are ideal targets. Large payments are routine, many suppliers are involved, and the principal is often travelling.
Leeward Private3 min read
How the fraud works
Two patterns account for most cases. In CEO fraud, the attacker poses as the principal or a senior person and asks for an urgent, confidential transfer — an acquisition, a charter deposit, a payment that cannot wait until Monday. In invoice fraud, the attacker poses as a real supplier — a shipyard, a broker, an architect, a provisioning company — and announces new bank details shortly before a genuine invoice is due.
The messages convince because they are built on real information: names from a website, a project mentioned on social media, an e-mail thread taken from a supplier's mailbox. Sometimes the e-mail really does come from the supplier's address — because that account has been taken over.
Why filters and training are not enough
Spam filters stop a lot, but not a well-written message from a genuine, compromised mailbox. Look-alike domains differ by a single letter. With generative AI the language is flawless, and voices and faces can be imitated: in 2024 an employee of the engineering firm Arup in Hong Kong transferred around 25 million US dollars after a video call in which the 'colleagues' were deepfakes.
Training helps people recognise pressure and urgency. But under stress — on a Friday evening, with the principal apparently waiting — careful people make mistakes too. What works reliably is not a judgement call but a rule that applies every single time.
The call-back rule
Every change of bank details and every unusual or urgent payment request is confirmed by phone — using a number from your own records or the existing contract, never one from the e-mail, invoice or message that contains the request.
The rule works because it moves verification to a channel the attacker does not control. A fraudster can fake an e-mail, a letterhead and even a voice on an incoming call. They cannot answer the number that has been in your files for years.
A few details decide whether it holds in practice:
- No exceptions for seniority. The rule applies above all when a request seems to come from the principal.
- Known numbers only. A number in the e-mail signature or on the new invoice is part of the attack.
- Two people for large payments. Above a defined amount a second person approves — configured in online banking, not only on paper.
- A first payment to new bank details waits until the call-back has been documented.
- Put it in writing. A short payment policy gives staff permission to say 'not without the call-back' — even to the principal.
Protect the accounts behind the payments
Many cases begin with a taken-over e-mail account — your own or a supplier's. Phishing-resistant sign-in with passkeys or hardware security keys for e-mail, cloud and banking closes the most common door. On your own domain, SPF, DKIM and a strict DMARC policy make it much harder for anyone to send e-mail in your name.
If money has already gone
Speed decides. Call your bank at once and ask for a recall of the transfer — the sooner the bank acts, the better the chance of stopping or freezing the funds. Report the case to the police, keep the e-mails including their headers, and check whether a mailbox has been compromised. Otherwise the next attempt is already prepared.
The Leeward Private programme puts these rules into practice for the family and the family office: payment policy, call-back process, account security and a short briefing for everyone who can move money.