Wealth Management and Family Office Security Guide

Wealth managers and family offices move large sums on instruction from a small number of very well-known people, often through a handful of staff, outsourced IT and personal devices, which makes them a near-perfect target for payment fraud, impersonation and privacy attacks. The attacker does not need to breach a bank. A spoofed email from a principal, a cloned voice note to an assistant, or a takeover of a family member's personal account is often enough to redirect a transfer or expose an address. This guide is for chief operating officers, compliance leads, IT providers and security advisers at single and multi-family offices, private banks' client teams and independent wealth managers. It covers the threat model, money movement controls, principal and family protection, privacy, staff and suppliers, the regulatory picture and a phased plan. It builds on the Executive Protection and Digital Footprint Guide and the Executive and VIP Device Protection Guide and does not repeat their device and footprint detail.

Key takeaways

Money movement is the crown jewel. Every instruction to pay, change bank details or move assets needs an out-of-band verification that an email, message or voice clone cannot satisfy.
The perimeter is the family, not the office. Principals, spouses, children, assistants and house staff hold accounts and devices that can be used to impersonate the principal or reach the office.
Privacy is a security control. Addresses, travel plans, asset holdings and family details enable fraud, extortion and physical risk, so minimise and compartmentalise them.
Small teams need written rules. A family office with six staff cannot rely on segregation of duties by headcount; it needs dual approval, call-back lists and hold periods set down in policy.
Suppliers carry the office's keys. Outsourced IT, custodians, fund administrators, lawyers and property managers are part of the attack surface and need contractual security terms.

Why wealth and family offices are different targets

Most corporate security assumes many users, a central IT team and money that moves through layered treasury controls. A family office inverts all three. The table sets out the differences that change the controls.

Factor	Typical corporate setting	Family office or wealth manager	Security consequence
Who gives instructions	Many approvers in a defined hierarchy	One principal or a few family members, often informally by phone or message	Impersonation of the principal is the main fraud route
Value per transaction	Mostly routine payments	Infrequent, very large transfers, capital calls, property and art purchases	One successful fraud can be a material loss
Staff numbers	Segregation by team	Handful of staff, each with broad access	Dual control must be designed in, not assumed
IT	Internal security team	Outsourced managed service provider, consumer devices, home networks	Supplier and personal-device risk dominate
Public profile	Company is visible, individuals less so	Principal and family are visible in press, registers, social media	Rich material for pretexting, doxxing and deepfakes
Regulation	Clear sector rules	Varies: some family offices fall outside adviser regulation, wealth managers serving clients usually do not	Baseline must be set by the office itself where law is silent

The threat model

Payment instruction fraud: email compromise or look-alike domains used to request a transfer or change payee details. The FBI's Internet Crime Complaint Center reported more than USD 55 billion in exposed business email compromise losses between October 2013 and December 2023, and recommends verifying payment and account changes through a separate channel. See the Email Identity and BEC Guide.
Principal impersonation with synthetic media: a cloned voice note or video call to an assistant or the chief financial officer asking for an urgent, confidential transfer. See the Executive Deepfake and CEO Fraud Guide.
Family account takeover: a child's or spouse's personal email, messaging or cloud account used to learn routines, find documents or message the office as a trusted contact. SIM swap is a common route to these accounts. See the SIM Swap Fraud Guide.
Extortion and virtual kidnapping: the FBI has warned that criminals alter photos taken from social media to fake "proof of life" in virtual kidnapping scams, and recommends a family code word and trying to reach the loved one before paying.
Doxxing and physical risk: addresses, school names and travel details aggregated from registers, property records and social posts. See the Executive Doxxing and Personal Data Exposure Playbook.
Insider and household staff risk: drivers, house managers, nannies and assistants with access to calendars, devices or home networks, sometimes targeted by bribery or social engineering.
Supplier compromise: a managed IT provider's remote tools, a lawyer's mailbox or a fund administrator's portal used as the way in.

Money movement controls

This is where to spend first. The controls below are NHI Mgmt Group recommendations for a family office or wealth manager; adjust thresholds to your asset base.

Control	What good looks like	Small office (under 10 staff)	Larger office or wealth manager
Instruction channels	Instructions accepted only through named channels, never by text, social media or personal email alone	Written list signed by each principal	Channel rules in client agreements and onboarding
Out-of-band verification	Call-back to a number held on file, never to a number in the request; a pre-agreed passphrase for principals	Every payment above [threshold] and every new payee	Risk-tiered, with recorded call-backs
Dual approval	Two people approve; the requester cannot approve their own instruction	Principal plus one staff member, or two staff with principal confirmation	Maker-checker in the payment system
Bank detail changes	Verified by call-back, then a hold period before first use	[48-hour] hold	Hold plus independent verification team
Bank-side controls	Payee allow-lists, transfer limits, positive pay and hardware-token approval in banking portals	Set with each bank	Centrally managed per custodian
Urgency and secrecy rule	Any request marked urgent and confidential triggers extra verification, not less	Written into policy	Tested in exercises

See the Payment Verification Policy Template for wording and the Dual control and four-eyes approval guide for design. If a fraudulent transfer goes out, the FBI's advice is to contact the bank immediately to request a recall and to file a complaint with IC3; in the UK, report to Report Fraud (which replaced Action Fraud on 4 December 2025) at reportfraud.police.uk or on 0300 123 2040, or in Scotland to Police Scotland on 101.

Protecting principals and family

Accounts and authentication

Phishing-resistant sign-in: passkeys or security keys on email, banking, cloud storage and messaging for principals, family members and staff. New Zealand's NCSC guidance for high-profile individuals recommends physical security keys or passkeys over SMS codes and warns never to approve an MFA prompt you did not trigger.
Carrier locks: number transfer and SIM change locks with each mobile carrier, and phone numbers removed from account recovery where an alternative exists.
Password manager with shared vaults: separate vaults for the principal, the family and the office, with individual access for each assistant rather than shared passwords. The NCSC guidance says to give others individual access limited to their role and remove it when they leave.
Account inventory: a register of the family's important accounts (banking, email, domains, social media, property and utility portals) with the owner, recovery method and who else can access it.

Family protocol

Code word: a family code word for emergencies and money requests, never written in messages or email.
Children and young adults: privacy settings reviewed, location sharing limited to family, and a clear rule that no one asks the office for money through social media.
Travel: travel shared after the fact, not before; use mobile data or a personal hotspot rather than hotel Wi-Fi; carry travel devices for high-risk destinations. See the Executive and VIP Device Protection Guide.
Home networks: the residence network managed as part of the office estate, with separate networks for family, guests, staff and building systems such as cameras and door entry.

Privacy and information minimisation

For a principal, a leaked address or asset list is a fraud and safety risk as well as a privacy issue. Treat it as both.

Know what is public: run a footprint review covering company and land registers, planning applications, charity filings, court records, press and social media. Record what can be removed and what cannot. See the Executive Protection and Digital Footprint Guide.
Compartmentalise: use separate email addresses and phone numbers for public, financial and family use, and keep holding structures and property ownership details on a need-to-know basis within the office.
Classify family data: identity documents, account statements, wills, medical information and security arrangements labelled and stored with restricted access and encryption.
Privacy management: where the office or wealth manager processes client data under GDPR or similar law, a privacy information management system helps. See the ISO/IEC 27701 Privacy Information Management Guide.
Breach readiness: know who decides on notifying regulators and the people affected, and where client data sits with suppliers.

Staff, household and insiders

Pre-employment screening: proportionate checks for office and household staff with access to money, devices, calendars or the residence, within employment law.
Least privilege for assistants: delegated mailbox and calendar access rather than shared credentials; payment initiation separated from approval.
Joiners and leavers: access removed the day someone leaves, including household staff's door codes, Wi-Fi keys, shared vault entries and building system accounts.
Training that fits the role: assistants and finance staff trained on voice cloning, call-back rules and urgency pressure. See the Security Awareness for Executives and Assistants Guide and the Business Email Compromise Awareness for Finance Teams Guide.
Speak-up route: a way for staff to report pressure or an odd request without going through the person who made it.

Suppliers and outsourced IT

Many family offices have no in-house IT. The managed service provider (MSP) holds administrator access to every device and mailbox, so it is the largest single risk.

Supplier	What they can reach	Contract and oversight points
Managed IT provider	All devices, mailboxes, cloud tenants, remote access tools	Named administrators with phishing-resistant MFA, no shared admin accounts, logs available to the office, incident notification within an agreed time, right to audit
Custodians and banks	Assets and payments	Instruction channel rules, payee allow-lists, transfer limits, authorised signatory list kept current
Fund administrators and accountants	Statements, capital calls, tax data	Secure portals instead of email attachments, call-back for any change to payment details
Lawyers and property managers	Transaction documents, completion funds, residence access	Verified bank details confirmed by call-back before completion transfers
Security and concierge firms	Itineraries, residence plans	Confidentiality terms, data minimisation, secure communications

See the Third-Party Risk Management Guide for a supplier tiering method.

Regulation that may apply

US registered advisers and broker-dealers: the SEC's 2024 amendments to Regulation S-P require covered institutions, including SEC-registered investment advisers and broker-dealers, to have an incident response programme for unauthorised access to customer information and to notify affected individuals as soon as practicable and no later than 30 days after becoming aware of an incident. Larger entities had to comply by 3 December 2025 and smaller entities by 3 June 2026.
US single-family offices: the SEC's 2011 family office rule (Release IA-3220) excludes qualifying family offices from the definition of investment adviser under the Investment Advisers Act. An office relying on it may sit outside Regulation S-P, which means its security baseline has to be set by its own policy.
Data protection: offices in the UK and EU, or handling data of people there, fall under UK GDPR or EU GDPR for client, family and staff data.
Anti-money laundering: regulated wealth managers have suspicious activity reporting duties; in the UK, reports go to the National Crime Agency through the SAR Portal.

This section summarises selected rules and is not legal advice; confirm scope with counsel for each entity in the structure.

How to implement

Weeks 1 to 4, stop the money loss route: write instruction channel rules, set up call-back lists and passphrases with each principal, turn on dual approval and payee allow-lists at each bank, and add a hold on bank detail changes.
Weeks 2 to 8, lock down identities: passkeys or security keys for principals, family and staff on email, banking and cloud; carrier locks; password manager with individual vault access; remove shared credentials.
Months 2 to 3, suppliers: review the MSP contract, admin accounts and remote access tools; agree incident notification; confirm custodians' and administrators' verification procedures.
Months 3 to 4, privacy: footprint review, removal requests, data classification and compartmentalised contact details.
Months 4 to 6, test: run a tabletop exercise around a cloned-voice transfer request and a family account takeover; run an approved simulated instruction fraud against staff. Fix what fails.

Rollback and exceptions: if a hold period blocks a genuine time-critical transaction, the policy should allow a principal to release it through the passphrase call-back plus a second approver, recorded, rather than suspending the control.

Decision guidance

In-house versus outsourced security: an office with fewer than about 20 staff rarely needs an in-house security team, but does need a named accountable person and an independent review of the MSP at least yearly.
Synced passkeys versus security keys: synced passkeys suit family members who will not carry a key; principals and finance staff who approve payments should have hardware security keys.
Shared office for several families: multi-family offices need tenant-style separation of data, vaults and approval chains for each family.

Detection and measurement

Monitor: mailbox rule creation and forwarding, sign-ins from new countries or devices on principal and finance accounts, changes to payee or bank details, carrier port or SIM change alerts, new look-alike domain registrations, and MSP administrator activity.
Metrics: share of payments above threshold with a recorded call-back (target 100%); share of principals, family members and staff on phishing-resistant MFA; number of shared credentials remaining (target zero); time to remove leavers' access; simulated instruction fraud pass rate; footprint items removed versus identified.

Framework mapping

Area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Identities and authentication for principals, family and staff	PR.AA-01, PR.AA-03	AC-2, IA-2, IA-5
Money movement and dual approval	PR.AA-05	AC-2
Insider and household staff risk	PR.AA-05	PM-12
Family and staff training	PR.AT-01, PR.AT-02	AT-2
Supplier and MSP oversight	GV.SC-06, GV.SC-07	SA-9
Data protection and privacy	PR.DS-01	SC-28
Monitoring and response	DE.CM-03, RS.CO-02	SI-4, IR-4

Common failure patterns

Calling back the number in the email. Verification only works against contact details held independently.
Exempting the principal. Staff skip controls when the principal is impatient; the attacker counts on it. The principal must sign the rules and accept the call-back.
Ignoring family members' accounts. A teenager's compromised account can reveal travel and be used to message the office.
One MSP admin account for everything. A single shared administrator credential at the IT provider gives an attacker the whole estate.
Paper rules, no test. Policies that have never been exercised fail on the first convincing voice call.
Over-sharing with suppliers. Itineraries and asset lists sent by plain email to concierge, security and travel firms.

Practitioner checklist

Instruction channel rules and call-back lists signed by every principal.
Dual approval and payee allow-lists enabled at every bank and custodian.
Hold period on all bank detail changes, released only by verified call-back.
Passkeys or security keys for principals, family and staff on email, banking and cloud.
Carrier number transfer and SIM change locks on all family and finance phones.
Family code word agreed and an emergency protocol for kidnapping or extortion claims.
Individual password vault access; no shared credentials with assistants or the MSP.
MSP contract with named admins, MFA, log access and incident notification.
Footprint review completed and repeated at least yearly.
Tabletop exercise on a cloned-voice transfer request run within the last 12 months.

Wealth Management and Family Office Security Guide: Fraud, Privacy and Principals