Map the instruction, approval and execution separately
Identify who may request a payment, who approves it and who can execute it. Include assistants, outside advisers and staff covering absences. The same person may fill several roles in a small office, which makes documented verification especially valuable. Record which entities and accounts a person’s authority covers; familiarity with the family does not automatically confer authority across every structure.
Give changes a stronger verification path
New beneficiaries, altered bank details and unusual urgency deserve a defined check. Use a pre-agreed contact route that is independent of the incoming request, and record the confirmation with the payment file. A reply to the same suspicious conversation does not provide that independence. Design an escalation route for times when the principal is travelling or unavailable, so pressure does not force staff to invent an exception.
Do not make appearance the approval control
A convincing message, voice or video may still need verification. The practical response is to make authority and confirmation independent of how realistic the communication looks or sounds. Staff should be able to pause a transaction without being penalised for asking. Scenario exercises can test a changed supplier account, a last-minute instruction and a request apparently forwarded by a trusted adviser.
Protect the accounts behind trusted identities
Review the email, devices and recovery methods used by people in the payment chain. Use appropriately strong authentication and a clear process for lost devices or changes in assistants. The NCSC’s guidance for high-risk individuals offers useful account and device protection principles; the family office’s controls should be tailored to its own exposure and working arrangements. Technical protection and payment verification support each other.
Prepare a coordinated response to suspected fraud
Define the finance, bank, IT and adviser contacts before an incident. If a suspicious instruction has led to a payment, contact the bank promptly through a known route and coordinate technical investigation through the designated lead. Preserve relevant communications and record actions through an agreed process. The investigation should distinguish how the instruction arrived, which account or domain was involved and how the payment decision was made.
Review the process when relationships change
Offboarding, a new adviser, a new entity or a change of banking arrangements should trigger a review of authority and contact records. Periodically test whether the team can reach the right people and retrieve the supporting information. The goal is a verification process people can follow under pressure, with clear ownership and a documented route for exceptions.
Further reading
Put the guidance to work
Strengthen access controls, secure communications, and digital protection for organisations and executives.
Identity & executive security