Most losses suffered by wealthy families through digital channels do not begin with sophisticated hacking. They begin with a convincing message: an email that appears to come from an advisor, a voice note that sounds like a family member, a request to update bank details. The defences that work are mostly habits, not technology. This guide sets out eight of them.
1. Verify before any money moves
Treat every request to pay, transfer or change bank details as unconfirmed until you have spoken to the person on a number you already hold. Do not use a number given in the message itself. Apply the same rule to requests that appear to come from your own family. Voice cloning tools can now imitate a person from a short recording, so agree a private word or question within the family that a caller can be asked to give. For large transfers, require approval from two people.
2. Secure your email first
Your main email account receives the password reset links for your bank, your investment platforms and your phone account. Whoever controls it can take over the rest. Give it a long password used nowhere else, and turn on two-step sign-in using an authenticator app or a physical security key. A code sent by SMS is better than nothing, but a phone number can be transferred to another SIM card by a fraudster.
3. Use a password manager
Reused passwords are the most common way one breach becomes several. A password manager creates and stores a different password for every account, so you only need to remember one. Set it up for each adult in the family, and use its sharing feature for joint accounts instead of sending passwords by message.
4. Keep devices current and separate
Install software updates when they are offered, since most of them close known security gaps. Lock every phone, tablet and laptop with a code or biometric, and turn on device encryption and remote wipe. Consider keeping one device for banking and investment matters only, with no social media and no shared family use. Away from home, use mobile data or a trusted VPN in place of hotel, airport or lounge Wi-Fi.
5. Decide who sees what
Personal assistants, household staff, drivers, accountants and junior advisors often see more than their role requires. Give each person their own login with only the access they need, and avoid shared passwords. Remove access on the day someone leaves. Review the list once a year.
6. Reduce your public footprint
Addresses, travel dates, schools, vehicle details and photographs of property help someone build a picture of a family’s routine. Post about travel after you return, not while you are away. Switch off location tagging. Ask family members, including teenagers, to keep accounts private, and check what company registries and old press articles already disclose.
7. Send documents through a secure channel
Email and messaging apps are suited to conversation, not to passports, bank statements, tax returns or signed instructions. Once sent, copies sit in several inboxes and backups outside your control. Use the secure client area your advisor provides, and ask for the same from your lawyer and accountant.
8. Know what to do if something goes wrong
Speed matters. If a payment has been made in error or under false instruction, call your bank immediately, since a transfer can sometimes be recalled if it is reported quickly. Change the passwords of the affected accounts from a different device. Tell your wealth manager so that other accounts and counterparties can be alerted. Keep the messages and call records, and report the matter to the police or the relevant cybercrime unit.
Questions to ask anyone who holds your information
- Who in your firm can see my information, and how is that decided?
- How do you confirm an instruction that appears to come from me?
- How do you send me documents, and where are they stored?
- Which outside providers handle my data?
- What would you do, and how quickly would you tell me, if my data were exposed?
Your legal rights
Many jurisdictions now give individuals the right to know what personal data an organisation holds about them, to have it corrected and to object to certain uses. Examples include the Mauritius Data Protection Act 2017, South Africa’s Protection of Personal Information Act, the Nigeria Data Protection Act 2023, Kenya’s Data Protection Act 2019 and the European Union’s GDPR. Families with members and assets in several countries are usually covered by more than one.
This guide is general information and not a substitute for professional security advice tailored to your circumstances.