A family office receives a payment instruction for a transaction it is already expecting. The sender is familiar, the amount is plausible and the deadline fits. A telephone call confirms the details. The payment can still be fraudulent if the attacker supplied both the instruction and the contact information used to verify it.
In this hypothetical example, a convincing payment request exploits information available through trusted relationships and established transaction routines.
How a convincing invoice fraud develops
A principal plans an acquisition from an established overseas counterparty. The family office knows the people involved and has dealt with the seller before. A revised invoice arrives at a busy point in the transaction.
The email matches previous messages and contains plausible banking details. Staff call the number provided, speak to someone who confirms the request and authorize the transfer. Only later does the real counterparty ask why the payment is outstanding.
The decisive weakness was not failure to place a verification call. It was failure to verify through a communication channel established independently of the incoming message.
How can criminals know so much about a transaction?
An attacker may gain access to a vendor's mailbox, examine a copied email chain or collect public information about the principal and the transaction. Social media, commercial announcements, professional profiles and travel disclosures can help establish relationships or timing.
The FBI explains that business email compromise commonly involves spoofed addresses, apparently legitimate instructions and, in some cases, access to real billing threads. The offender may not need to compromise the family office's own systems to become credible.
Why do callback checks sometimes fail?
A procedure saying 'telephone the sender' is not sufficient if the staff member calls a number introduced in the same untrusted message. The attacker can create a telephone contact, lookalike domain or message trail specifically to satisfy that check.
A sound procedure uses a preexisting vendor record, a separately verified number or another trusted channel. Changes to bank account details deserve stronger confirmation than routine correspondence.
Email authentication controls also matter, but they have limits. Domain protection and filtering may help identify direct impersonation. They do not automatically stop every lookalike domain or a message sent from a genuinely compromised mailbox.
What should a family office examine?
Map how staff receive, amend, confirm and release payment instructions. Establish who is authorized to approve changes and how contact details are maintained. Consider whether a principal's public footprint or a vendor's access makes an otherwise plausible request more convincing.
A useful review should test the entire workflow, not simply the technical email settings. Pressure created by travel, deadlines or a principal's direct request can change how people apply familiar controls.
The important distinction
A fraudulent invoice need not look unusual. It may look exactly like the instruction everyone expected to receive.
The purpose of family office risk assessment is to understand how those assumptions are formed and where independent verification must interrupt them. See also our Risk & Security capability.