With our ever-increasing digital footprints and the ease with which bad actors can obtain personal information online, cybersecurity has become an important focus for high-net-worth households. These households have more to lose, and they also tend to have more entry points: adult children, multiple advisors, and aging parents who may be less attuned to newer scam tactics.
The scams worth actually worrying about
- Impersonation of your advisor or bank. Fraudsters increasingly spoof real phone numbers and email addresses to request a wire ‘on your behalf.’
- Business email compromise. A hacked email account is used to send a convincing, well-timed request to move money, often timed around a real transaction you’re expecting.
- Elder-targeted fraud. Aging parents are often targeted directly, sometimes repeatedly, once a scammer identifies them as a soft target.
- Deepfake voice calls. Cloned voice technology can now convincingly mimic a family member in apparent distress, asking for money to be sent quickly and quietly before anyone has time to verify the story.
A practical checklist
- Enable multi-factor authentication on every financial and email account, not just the ones that require it
- Agree on a verbal verification phrase with your advisor for any wire or unusual transfer request, or freeze your investment accounts against withdrawals with your bank or custodian, if they offer this feature
- Use a password manager rather than reused or written-down passwords
- Set up account alerts for logins and transfers above a threshold you choose
- Freeze credit at each of the three major credit reporting agencies (Equifax, Experian, and TransUnion) for household members who aren’t actively applying for new credit
- Have a specific, low-pressure conversation with aging parents about how your family will verify any request for money, in advance of it happening
Why the usual advice falls short for wealthy families
Most consumer fraud advice assumes one account and one decision-maker, which isn’t how most families actually manage money. Between adult children, aging parents, and more than one advisor, there are more places for a convincing request to enter the picture. An aging parent wiring money to help a grandchild in trouble, or an adult child approving a transfer that looks routine, are realistic entry points that a strong password does nothing to close.
How this plays out in practice
Illustrative example, not an actual client: a widowed mother in her eighties got a late-night call from someone who sounded exactly like her grandson. He was upset, said his wallet and phone had been stolen while he was traveling, and needed $8,000 wired as soon as the bank opened so he could get home. He asked her not to tell his parents because he was embarrassed. The next morning, she was getting ready to go to the bank when she remembered the rule her daughter had set up months earlier: any request for money, from anyone, gets a callback to a number already saved in her phone before a dollar moves. She called her grandson directly. He was at home, getting ready for work, and had no idea what she was talking about. The voice on the first call had most likely been cloned from videos he had posted online.
None of these safeguards require a technical background or a large budget. They require a family to have an uncomfortable conversation before there’s any pressure attached to it, and to agree in advance on exactly what verification will look like so no one has to improvise it during an actual attempt.
If money has already moved
Speed matters more than anything else in the first hour. Call your bank’s or custodian’s fraud line immediately and ask for a wire recall, even though recalls succeed only sometimes and less often the longer you wait. File a report with the FBI’s Internet Crime Complaint Center the same day, since some recoveries depend on a paper trail that starts quickly. Change the passwords on any account connected to the request, not just the one used for the transfer, since a single compromised email is often the doorway to several accounts at once. None of this guarantees the money comes back, but each hour of delay measurably lowers the odds that it will.
If the stolen funds can’t be recovered and you’ve notified the authorities, the next step is to contact your property and casualty insurance company to see what coverage it provides for this type of theft and whether a claim should be filed. Most insurers include basic coverage and some assistance with this type of loss, but coverage varies widely. We recommend reviewing your policy with your advisor and insurance professional so you understand what’s covered and whether your coverage should be adjusted.
Have questions? Ask your advisor for a copy of Cybersecurity Q&A: Protecting Yourself Online, our answers to the questions clients ask most about passwords, scams, devices, Wi-Fi and payments.
Important Disclosures
Investing involves risk, including possible loss of principal. Investment decisions are subject to market, currency, economic, and business risks and will not always be profitable. There is no guarantee that risk can be successfully mitigated or otherwise avoided.
Past performance is no guarantee of future results.
Nothing discussed in this material should be considered an offer to buy or suggestion to sell securities.
Statements using “if,” “may,” “can,” “should,” “will” or similar may be forward looking and are not intended as an opinion, projection, or estimate regarding the market, CooksonPeirce, or its products.
Cookson Peirce & Co., Inc. is an SEC registered investment adviser. Registration does not imply a certain level of skill or training. See Form ADV at adviserinfo.sec.gov.
About CooksonPeirce
CooksonPeirce is a Pittsburgh-based, 100% employee-owned registered investment adviser founded in 1984, with more than $3 billion in assets under management.
