Artificial intelligence is transforming cybercrime, making scams more convincing than ever. For family offices, where trust and discretion are central to daily operations, this shift demands a fundamental rethink of how sensitive decisions are verified.
AI-powered fraud no longer relies on poorly written phishing emails or suspicious messages. Today’s criminals can convincingly imitate voices, faces and even live video calls, making it increasingly difficult to distinguish between genuine requests and sophisticated deception.
AI is targeting trust, not just technology
Traditional cybersecurity has focused on protecting networks, devices and systems from hackers. But AI has shifted the battlefield. Instead of breaking into systems, fraudsters are increasingly manipulating people.
Using publicly available photos, videos and audio clips, criminals can create highly realistic deepfakes that imitate trusted individuals. As a result, even experienced professionals can be persuaded to approve transactions or disclose confidential information.
The danger is no longer limited to technology failures—it lies in exploiting human trust.
A costly lesson in AI deception
One of the clearest examples occurred in 2024 when engineering firm Arup lost around $25 million after an employee in Hong Kong was deceived by an AI-generated video conference.
Initially, the employee suspected a phishing attempt after receiving instructions from someone claiming to be the company’s chief financial officer. However, those concerns disappeared after joining a video meeting where the CFO and several familiar colleagues appeared to confirm the request.
The people on the call looked and sounded authentic, but they were entirely AI-generated deepfakes created from publicly available material. By the time the deception was uncovered, the money had already been transferred.
The incident demonstrated that traditional warning signs are no longer reliable. Familiar faces, voices and email addresses can all be convincingly replicated.
Why family offices are particularly exposed
Family offices often operate differently from large corporations. Decisions are made quickly, relationships are built on trust, and there are typically fewer layers of approval.
These strengths can also create vulnerabilities.
Cybercriminals understand that an urgent request appearing to come from a family principal, adviser or trusted executive may bypass the checks that would normally exist within larger organisations.
Rather than attacking computer systems directly, fraudsters increasingly target the people responsible for making financial decisions.
Privacy has become a critical security measure
The information families share publicly can unintentionally provide criminals with the material needed to create convincing impersonations.
Photos, interviews, conference appearances, social media posts and online biographies all contribute to a digital footprint that AI can use to recreate someone’s voice, appearance or communication style.
This challenge affects everyone connected to a family office—from principals and younger family members to household staff, advisers and external professionals.
Reducing unnecessary public exposure is no longer simply about protecting privacy; it has become an essential part of managing cybersecurity risk.
Verification must become routine
Employee awareness remains important, but awareness alone is no longer enough.
The Arup employee questioned the initial email, yet ultimately trusted what appeared to be confirmation from familiar faces during a video call.
The critical safeguard was missing: independent verification.
Leading family offices are increasingly adopting procedures that require sensitive requests to be confirmed through separate communication channels. Any instruction involving payments, banking details or transfers should be independently validated before action is taken.
One of the simplest and most effective safeguards is to call a trusted contact using a previously verified phone number—not one included in the request itself.
This small step can prevent even the most sophisticated AI impersonation from succeeding.
Building resilience for the future
As AI-driven attacks become more advanced, preventing every incident is no longer realistic.
Instead, family offices need to focus on resilience—the ability to detect threats quickly, respond effectively and recover with minimal disruption.
That means establishing clear verification protocols, maintaining incident response plans, working closely with trusted cybersecurity specialists and ensuring everyone within the family’s ecosystem understands the risks.
Ultimately, cybersecurity is no longer just an IT responsibility. It has become a leadership issue.
Family offices have always protected wealth and legacy. In the AI era, they must also protect trust by ensuring that every important request is verified before action is taken.
Trust remains essential—but in today’s environment, trust must always be accompanied by verification.
