A practical framework for verifying family-office payments, controlling changes to bank details and responding when an instruction or transfer looks suspicious.
Key Takeaways
- Authenticate the instruction separately from the message carrying it.
- Reverify beneficiary changes using previously established contact information.
- Keep preparation, approval and release intelligible and attributable.
- Apply exception controls to principals as well as employees.
- Prepare the bank-contact and incident-response route before money moves.
In This Briefing
- The authentic-looking message is the wrong starting point
- Build a beneficiary record before the deadline
- Make account changes a separate approval event
- Separate roles without creating ceremonial approval
- Do not exempt the principal from authentication
- Reduce the opportunities for an attacker to intervene
- Design the response before a transfer goes wrong
- Test the workflow against a realistic transaction
- A practical test: the genuine invoice with replacement bank details
- APX Decision Framework
- Frequently Asked Questions
- Sources & Further Reading
- APX Perspective
- APX Connect
The authentic-looking message is the wrong starting point
A professional-looking email is evidence that a message has been received. It is not sufficient evidence that the named person authorised the payment. An attacker may impersonate a sender, compromise an account or exploit a conversation already containing real transaction details. Familiarity with the subject can make an instruction persuasive without making it genuine.
The FBI’s business email compromise guidance describes this form of deception and recommends independent verification of changes to account details or payment procedures. The operational lesson is to verify the requested action, not merely the appearance of the email. A genuine mailbox can carry an unauthorised instruction.
Consider a property completion in which the solicitor has been corresponding for weeks. An unexpected instruction to use a replacement client account should trigger a fresh verification process even if the amount and completion date are correct. The question is who independently confirmed the destination and through which established channel. Repeating details back to the same compromised conversation does not resolve that question.
Build a beneficiary record before the deadline
A beneficiary record should explain who is being paid, why that person or entity is entitled to receive the funds and how its banking details were verified. The supporting record can be proportionate to the transaction, but should survive a change of employee. A saved account name alone cannot explain the authority behind the payment.
Where possible, establish the verification route when appointing an adviser or supplier. Record an independently obtained telephone number and the appropriate person to contact. Do not let an urgent email introduce both new banking details and the number supposedly needed to confirm them. The same principle applies to links, messaging accounts and contact cards supplied inside the disputed instruction.
The family should also distinguish the commercial counterparty from the receiving entity. A payment to an agent, escrow arrangement or related company may have a legitimate explanation, but that explanation deserves documentation. The aim is not to prohibit unusual structures. It is to prevent a plausible label from replacing evidence of who is entitled to the money.
Make account changes a separate approval event
Treat a change in destination as a change in risk, even where the invoice itself has already been approved. An approval to pay a supplier should not automatically authorise a newly supplied bank account. Define who may amend beneficiary records and who must verify the amendment before it can be used.
Useful controls make the change visible to the person releasing funds. If an administrator updates the record and the bank portal subsequently displays only a familiar supplier name, the approver may not realise anything changed. The workflow should expose the new details, the verification evidence and the date of the change at the point of decision.
An exception may occasionally be necessary, but it should be explicit. Record the reason, the person assuming responsibility and any additional check. Repeated exceptions indicate that the standard process does not fit the family’s operating reality. They should prompt redesign rather than becoming an informal parallel system that only experienced staff understand.
Separate roles without creating ceremonial approval
Dual approval is useful only if the second person performs an independent check. Two people pressing buttons on the same unverified evidence can preserve the original error. Define what the preparer establishes, what the approver reviews and what the releaser confirms at the bank.
A small office may not have enough employees to segregate every task internally. It can still examine how an authorised external professional, bank service or principal participates in the process. The arrangement needs to be workable during leave and travel. A nominal requirement that cannot be met at a deadline is likely to generate exceptions precisely when scrutiny matters most.
The approval record should connect the instruction, commercial evidence, beneficiary verification and release. It should also identify the legal entity whose money is being used. Moving funds from the wrong family company or trust can create a separate problem even if the recipient is genuine. Payment legitimacy and entity authority are related checks, not substitutes for one another.
Do not exempt the principal from authentication
A message apparently from a principal can exert more pressure than an unfamiliar supplier invoice. Staff may be reluctant to challenge a request framed as confidential or personally sensitive. The family should agree in advance that verification is a normal service to the principal, rather than an expression of mistrust.
Establish a practical route for urgent requests, including what happens if the principal cannot be reached through the usual channel. A travelling family member should know which staff can authorise action and what evidence they will request. An entirely new messaging account should not gain authority merely by referring to private facts.
Voice and video conversations can support verification, but should sit within an agreed process rather than becoming an automatic guarantee of identity. The objective is layered confidence: a known contact route, a recognisable decision context and documented authority. Where those layers do not align, the team needs permission to pause without being penalised for protecting the family.
Payment evidence: what each stage should establish| Stage | Evidence to retain | Question for the approver |
|---|
| Commercial approval | Contract, invoice or documented authorised purpose | Is the obligation genuine and approved? |
| Beneficiary verification | Independent contact route and verification record | Why is this account entitled to receive payment? |
| Entity authority | Mandate and named decision-maker | May this entity make this payment? |
| Release | Bank confirmation and approval trail | Did the transfer match the approved instruction? |
Reduce the opportunities for an attacker to intervene
Payment controls should sit alongside account and device security. The NCSC’s phishing guidance advocates a layered approach rather than relying entirely on users to identify deceptive messages. Family offices should ask their technical advisers how email protection, access controls and reporting arrangements support the payment process.
Access deserves particular attention when employees or advisers leave, change role or lose a device. Review who can see transaction correspondence, amend supplier details and authorise funds. An accurate access register is more useful than assuming that a long-standing provider manages every account involved.
Protect the verification records themselves. If a shared contact list can be silently amended by anyone who prepares payments, it may cease to provide an independent reference. The office should know who can change trusted contact details and how those changes are checked. This connects a seemingly administrative task to the integrity of the entire payment workflow.
Design the response before a transfer goes wrong
If a transfer appears suspicious, contact the sending bank immediately through an established route and ask it to initiate the appropriate fraud response. Preserve the transaction identifiers, timestamps, beneficiary details and communications. Recovery is uncertain and should never be assumed in a policy or an investment decision.
The response also needs someone responsible for containing the underlying compromise. Merely changing the recipient for the next payment may leave a breached account active. Technical investigation, legal advice, reporting obligations and insurer notification should be considered with the relevant specialists. Avoid destroying useful evidence while trying to tidy up the incident.
Prepare a contact sheet that remains accessible if email is unavailable. It should identify bank fraud contacts, internal authority and the professional support the office expects to use. A rehearsed response need not be elaborate. It needs to make the first decisions clear when staff are under pressure and unsure whether the incident is isolated.
Test the workflow against a realistic transaction
Select a completed payment and reconstruct it from the original obligation to the bank release. Can someone uninvolved in the transaction identify who approved the expense, who verified the beneficiary and who authorised payment by the correct entity? Missing evidence should be treated as a process finding rather than filled in retrospectively from memory.
Then test a difficult version: an adviser changes bank details shortly before a deadline while the principal is travelling. Ask staff to describe what they would actually do. If everyone assumes someone else would call the adviser, the office has identified a gap before an attacker exploits it.
Review near misses as well as losses. A suspicious instruction intercepted by an attentive employee is useful evidence about the workflow. It should lead to a repeatable protection, not simply praise for individual vigilance. Controls become more durable when the office learns from ordinary exceptions and shares the resulting change with everyone who handles payments.
A practical test: the genuine invoice with replacement bank details
Consider a hypothetical invoice that has already passed commercial approval. The supplier then emails that its account has changed and asks for same-day payment. The amount, project and contact name are all familiar. The new information concerns only the destination of the money.
A well-defined process separates the earlier approval from the new account decision. The preparer flags the change, an authorised person contacts the supplier through the established independent route and the result is recorded before release. If the known contact cannot be reached, the office follows its exception procedure rather than treating urgency as verification.
The approver should see both the proposed beneficiary and the evidence supporting the change. If the bank portal conceals the alteration behind an existing supplier name, the office needs another way to make it visible. The practical question is whether the final decision-maker understands what changed.
Afterwards, examine the workflow rather than judging success only by whether this payment was genuine. Was the trusted number readily available? Did staff know who could pause the transaction? Could a substitute approver understand the record? This kind of rehearsal reveals whether the control is usable at a deadline. The scenario is illustrative, not a report of an APX incident or evidence of a particular fraud rate.
The rehearsal should also test availability. If the primary approver is on a flight and the bank's normal relationship contact is absent, can the substitute team still locate the required information? Keep emergency contacts and delegated authority current without distributing unnecessary account information. The office should distinguish a genuine alternative route from a bypass that removes the underlying check. That distinction gives staff a practical way to maintain service while preserving the reason the control exists.
APX Decision Framework
- List all channels through which payment requests arrive.
- Document trusted verification contacts independently of invoices.
- Require separate verification for changed beneficiary details.
- Define the substance of each approval rather than only the number of approvers.
- Agree the principal’s urgent-request procedure.
- Keep bank fraud contacts available outside the normal email system.
- Reconstruct a real payment and rehearse a suspicious change.
Frequently Asked Questions
Is a familiar email address enough to authorise payment?
No. A familiar address does not establish that a particular instruction is authorised. Verify the payment and any change to its destination through the agreed independent process.
Does dual approval prevent payment fraud?
It can help, but only if the approvals involve meaningful checks. Two approvals based on the same compromised instruction may reproduce the same error.
What should the office do first after identifying a suspicious transfer?
Contact the sending bank immediately using established contact details, preserve the evidence and activate the incident-response process. The next steps depend on the bank, jurisdiction and circumstances; recovery cannot be guaranteed.
Sources & Further Reading
APX Perspective
Payment security is strongest when staff can explain the reason for each check. A rigid checklist that everyone bypasses at completion is less useful than a disciplined process built around the family’s actual transactions.
APX’s view is that the principal sets the tone. If independent verification is expected even for a senior family member’s instructions, employees can protect the family without negotiating their authority on every urgent occasion. The practical objective is a reliable connection between a genuine obligation, an authorised decision and the correct receiving account.
APX Connect
Reviewing payment controls, adviser access or the response to a suspicious instruction?
APX members can use APX Connect to request confidential introductions to relevant cybersecurity specialists, banking contacts, operational-risk advisers and relevant legal professionals. Requests are reviewed by APX before an introduction is made.
For cybersecurity, banking and operational-risk specialists: APX also works with professional contributors seeking to share specialist intelligence and expertise with a curated private network.
Request an Introduction
Continue Your Journey
I Want to Acquire
Explore private-market and specialist asset opportunities available through the APX network.
Browse Listings
I Want to Sell
Present a business or specialist asset to relevant members through APX.
Partner With APX
I Need an Introduction
Request a confidential connection to a suitable cybersecurity, banking or operational-risk professional.
APX Connect
I Want to Publish
Share specialist payment security and private-wealth operating intelligence with the APX network.
Become an APX Partner
APX Intelligence is published for informational and editorial purposes only. This article does not constitute personal investment, financial, legal, tax or professional advice. The suitability and treatment of any arrangement depend on its documents, jurisdiction and the parties involved. Requirements and market practices can change. Obtain current advice from appropriately qualified independent specialists before committing capital, signing an agreement or changing an existing arrangement.
