In-depth guide · Security
Preventing payment fraud: CEO fraud, invoice fraud, changed bank details
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
Payment fraud usually reaches family offices through deceptively genuine emails or calls: supposed instructions from the family (CEO fraud), invoices with changed bank details or fake bank staff. A few consistent controls are effective: approval by two people, a call-back to a known number for every change of account, limits and trained staff. Once money is on its way, every minute counts: call the bank immediately.
The most common schemes
| Scheme | How it works | Warning signs |
|---|---|---|
| CEO fraud | An email or call "from the principal" demands an urgent, confidential payment | Time pressure, secrecy, unusual channel, new recipient bank |
| Invoice fraud | A genuine supplier invoice with a changed IBAN, often after an email account has been taken over | Notice of "new bank details", slightly altered sender address |
| Fake bank employee | A call about supposed security problems, asking for codes or approvals | Request to disclose credentials or approvals |
| Faked voice or video | Deceptively genuine voice of a family member by phone or video conference | Unusual instruction, pressure, request for an exception to the process |
Controls that work
- No payment solely on an instruction by email, message or phone – every instruction goes through the normal approval process.
- Two people for entry and approval, with limits per person.
- Every new or changed bank account is confirmed by telephone using a number already known – never using contact details from the notice itself.
- Changes to master data and payment approvals by different people.
- An agreed code word or call-back rule with the family for unusual instructions.
- Email protection with SPF, DKIM and DMARC, and two-factor sign-in for all accounts.
- Regular training with current examples; praise for every reported suspicion.
New help in the euro area
Since 9 October 2025, payment service providers in the euro area have had to check before euro transfers whether the payee's name and IBAN match (verification of payee under Regulation (EU) 2024/886). A warning in case of a mismatch is a strong signal – but it does not replace the family office's own controls, not least because it applies only to euro payments within its scope.
Immediate steps in an emergency
- Inform the ordering bank by telephone immediately and request a recall of the payment; every minute counts.
- Have your own bank warn the recipient bank.
- File a criminal complaint with the police; secure the evidence: emails with headers, invoices, payment orders.
- Check and secure the affected email accounts, change passwords, remove forwarding rules.
- Inform the insurer and document the incident.
Worked example (simplified)
On a Friday afternoon, the accounts team receives an email "from the principal": a participation must be secured confidentially by Monday with EUR 480,000, and a law firm will follow up with details. The employee notices the time pressure and the unusual recipient bank. Following the agreed rule, she calls the principal on his known mobile number – he knows nothing about it. The email came from a similar-looking domain. The incident is reported, the domain is registered with the bank as a warning and the example is used in the next training session.
Why good staff fall for it
Fraudsters exploit not ignorance but loyalty and helpfulness: anyone who wants to do the principal a favour bypasses the process under stress. That is why management must state expressly that no one – not even a family member – may demand an exception to the approval process, and that asking back is never a sign of mistrust. This attitude is the most effective control of all.
Rules for the family
Fraudsters target not only the team but also the family: fake messages to family members, supposed emergencies of children abroad, false investment offers. The family office should therefore agree a few simple rules with the family and record them in writing. Instructions to the family office are given only through agreed channels. For unusual or urgent instructions, the family office always calls back – and the family understands this not as mistrust but as protection.
For exceptions there is a code word that is never transmitted by email or message. Family members inform the family office if their email account or phone has been compromised or suspicious requests arrive. For the next generation, which often has less experience of such schemes, a short introduction belongs in the family programme.
In FLIORE
FLIORE enforces the four-eyes principle for payments with separate roles, logs changes to payee data and supports two-factor sign-in for all users. Afterwards, the audit trail shows completely who entered, changed and approved which payment.
At a glance
| Most common schemes | CEO fraud, invoice fraud with a changed IBAN, fake bank calls |
|---|---|
| Most effective control | Call-back to a known number for every account change, four-eyes approval |
| Euro area | Verification of payee since 9 October 2025 (Regulation (EU) 2024/886) |
Terms on this page
- Four-eyes principle
- Control principle under which important transactions, such as payments, are checked and approved by a second authorised person.
- Audit trail
- An unalterable log that records who created, changed, approved or deleted which data and when.
Frequently asked questions
What is CEO fraud?
Fraudsters pose as the principal, a family member or management and demand an urgent, confidential payment. The aim is to bypass the normal process under time pressure.
Can a misdirected payment be recovered?
Sometimes, if the bank is informed very quickly and the money has not yet been moved on. That is why the immediate call to the bank comes first.
Is the bank's verification of payee enough?
No. It applies only to euro transfers within its scope and does not detect every fraud. The family office's own controls remain indispensable.
How can one guard against faked voices?
With process rules rather than voice recognition: call-back to a known number, a code word for exceptions and no payment outside the approval process.
Who is liable in a fraud?
That depends on the case, the bank agreements and the due diligence observed. Documented controls considerably improve the family office's position.
How often should training take place?
At least annually, and additionally when new schemes become known. Short case examples work better than long lectures.
Should limits apply to instructions from the family too?
Yes. Limits protect the family against fraud in its name and the team against pressure in exceptional situations.
Are crypto assets particularly at risk?
Yes, because transactions generally cannot be reversed. Particularly strict approval rules, verified destination addresses and small test transfers before large transfers therefore apply to crypto assets.
Sources
- Regulation (EU) 2024/886 (instant payments, verification of payee) – EUR-Lex
- Swiss Federal Office for Cybersecurity (NCSC)
- German Federal Office for Information Security (BSI)
- Europol – CEO fraud and payment instruction fraud
- DMARC.org – email authentication (SPF, DKIM, DMARC)
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Operations, security & technology
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.