---
title: Deepfake wire requests and AI phishing aimed at family offices
description: Family office wire fraud now uses deepfake voices, fake video calls and AI-written email. FBI and FinCEN numbers, the Arup case, and callback rules that work.
canonical: https://privatesuperintelligence.si/blog/deepfake-wire-fraud-family-offices/
last-updated: 2026-10-15
---

# Deepfake wire requests and AI phishing aimed at family offices

Family office wire fraud follows an old script: someone who looks like the principal, a banker or a fund manager asks for an urgent, confidential payment. AI makes the script harder to spot, because the email now reads like the principal wrote it and the voice on the phone can be a clone. The defense is a payment rule that ignores how convincing the request feels: confirm every new or changed payment instruction through a channel you already trust, before money moves.

## How big the problem is

The FBI's Internet Crime Complaint Center (IC3) tracks business email compromise (BEC), the fraud category that covers fake payment requests. Its 2025 annual report counts:

| Measure (IC3, 2025) | Figure |
| --- | --- |
| BEC complaints | 24,768 (21,442 in 2024) |
| BEC losses | $3,046,598,558 (about $2.77 billion in 2024) |
| BEC losses where the complaint referenced AI | over $30 million |
| All complaints referencing AI, any crime type | 22,364, with losses of $893,346,472 |
| Losses to "distress" scams using cloned voices of loved ones | over $5 million |

The IC3 defines BEC as fraud carried out "by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications." That last phrase matters. A video call is now one of the channels an attacker can fake.

Family offices are part of the target group. Deloitte's Family Office Cybersecurity Report 2024 found that 93% of the family offices that had been attacked had received phishing emails, and nearly a quarter had faced social engineering.

## What a deepfake payment request looks like

The best documented case comes from Arup, the British engineering firm. CNN reported in May 2024, citing Hong Kong police, that a finance worker in Arup's Hong Kong office received an email from what looked like the company's UK office asking for a secret transaction. He suspected phishing. Then he joined a video call with people who looked and sounded like the chief financial officer and colleagues he recognized, and every one of them was a deepfake. He sent HK$200 million (about $25.6 million) across 15 transactions.

Arup told CNN that "fake voices and images were used" and that "none of our internal systems were compromised." Rob Greig, Arup's global chief information officer, said the company faces "invoice fraud, phishing scams, WhatsApp voice spoofing, and deepfakes," and that their number and sophistication "has been rising sharply in recent months."

Notice what failed. No password was stolen and no system was hacked. A careful employee doubted the email, and a faked meeting overcame his doubt. Swap the CFO for a principal and the finance worker for a family office controller, and you have the scenario to plan for.

FinCEN, the U.S. Treasury's financial crimes unit, describes the same pattern in alert FIN-2024-Alert004 (November 13, 2024): criminals "have reportedly used GenAI tools to target companies by impersonating an executive or other trusted employee and then instructing victims to transfer large sums." The FBI's December 2024 public service announcement adds that criminals "generate videos for real time video chats with alleged company executives."

## Where family offices are exposed

A family office moves large sums on short notice, often on the say-so of one or two people. Common openings:

- **The principal's request.** "I'm in a meeting, wire this today, keep it between us." Urgency and secrecy are the two features the Arup email had.
- **Capital calls.** A fake notice from a fund manager with new bank details lands in the same week as a real one. Our guide to [capital call tracking](/blog/capital-call-tracking/) covers how to match each notice to the commitment it belongs to.
- **Vendor and household payments.** An "updated invoice" from a contractor, a school, a yacht manager or an aviation provider.
- **Family members.** The IC3 notes that voice cloning is used to "mimic the sound of a loved one in distress," and the scams are spreading to other family members and close friends.
- **Next-generation family members and staff with public profiles.** The FBI advises limiting your online presence, for example by making social media accounts private and restricting followers to people you know.

## The callback rules that stop a fake principal

These controls work against a perfect deepfake, because none of them depend on spotting the fake.

| Rule | How it works |
| --- | --- |
| Call back on a number you already hold | Hang up, then call the person on the number in your own records. Never use a number, link or meeting invite from the request itself. The FBI gives the same advice: hang up and call the organization directly. |
| Treat any change of bank details as a new payee | New or changed wire instructions trigger a callback and a holding period, however routine the sender. |
| Two people release every wire | One person prepares the payment and a second approves it. The approver confirms the callback happened. |
| Agree a family code word | The FBI suggests a secret word or phrase that family members use to verify identity. Keep it off email and messaging apps. |
| Secrecy is a red flag, never a reason | Write into the policy that a request to keep a payment confidential from the controller is grounds to stop. |
| A video call is not verification | Faces and voices on screen can be generated. Verification happens on a separate channel you started. |
| Use phishing-resistant multi-factor authentication | FinCEN lists MFA, including phishing-resistant MFA, as a best practice against deepfake identities. |

FinCEN's red flags are written for banks checking customers, but two translate to a family office: the other party asks to switch channels during a verification check, or blames "technical glitches" for why the camera or line keeps failing. Either should end the call and start a callback.

## If a wire has already gone

The IC3 says "time is of the essence." Contact your bank at once and ask for a recall of the funds, then file a complaint at ic3.gov with the full transaction details, whatever the amount. In 2025 the IC3's Recovery Asset Team worked 3,900 incidents through its Financial Fraud Kill Chain process and froze $679,013,183, a 58% success rate.

## Where AI assistants fit

An AI assistant can help you defend the office, within limits you set. It can check whether a capital call matches the commitment and the bank details you have on file, flag a payment request that arrived with new instructions, and draft the callback note. It should never release a wire on its own. Keep the approval with people, and give the assistant the permission to draft and flag but not to pay. The [family office cybersecurity guide](/blog/family-office-cybersecurity-and-ai/) covers the wider set of AI controls.

## Private SuperIntelligence

Private SuperIntelligence from Mitosis Labs is an AI concierge for family offices, enterprises and private clients: the most capable AI, trusted with everything. It works across the family's own email, documents and data, answers with citations, and acts within permissions the office sets, so a payment can stay a draft until a person approves it. See [AI for family offices](/family-offices/).

## Frequently asked questions

### What is deepfake wire fraud?

It is a payment fraud in which criminals use AI-generated voice or video to impersonate a trusted person, such as a principal or CFO, and request a wire. FinCEN described the pattern in its November 2024 alert FIN-2024-Alert004.

### How much does business email compromise cost?

The FBI's IC3 recorded $3,046,598,558 in BEC losses across 24,768 complaints in 2025. Businesses reported over $30 million in losses to BEC scams involving AI.

### Can you spot a deepfake on a video call?

Sometimes, but you shouldn't rely on it. The Arup employee saw colleagues he recognized, and the call still turned out to be fake, so verify through a callback on a number you already hold.

### What should a family office do after a fraudulent wire?

Call your bank right away and request a recall, then file a complaint at ic3.gov with the transaction details. The IC3 froze 58% of the funds in the incidents its Recovery Asset Team worked in 2025.

### Does a family code word help?

The FBI recommends one. A secret word or phrase, agreed in person and never sent by email, gives family members and staff a quick check that a cloned voice cannot pass.


## Related reading

- [Private AI for family offices](/blog/private-ai-for-family-offices/)
- [Consolidated reporting across custodians, without the Excel export](/blog/family-office-consolidated-reporting/)
- [Tracking K-1s across 30 entities](/blog/k-1-tracking-across-entities/)
- [Capital call notices: catching every one, across every trust and LLC](/blog/capital-call-tracking/)
- [The family office technology stack](/blog/family-office-technology-stack/)
- [Family office operations, and where AI changes the staff math](/blog/family-office-operations-and-ai/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [2025 IC3 Annual Report (FBI Internet Crime Complaint Center, 2026)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, PSA (FBI IC3, December 3, 2024)](https://www.ic3.gov/PSA/2024/PSA241203)
- [FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions, FIN-2024-Alert004 (FinCEN, November 13, 2024)](https://www.fincen.gov/sites/default/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf)
- [British engineering giant Arup revealed as $25 million deepfake scam victim (CNN, May 16, 2024)](https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk)
- [Arup victim of multimillion-dollar deepfake video scam in Hong Kong (Dezeen, May 17, 2024)](https://www.dezeen.com/2024/05/17/arup-victim-deepfake-video-scam/)
- [The Family Office Cybersecurity Report 2024, full report PDF (Deloitte, 2024)](https://www.deloitte.com/content/dam/assets-shared/docs/services/deloitte-private/2024/family-office-cybersecurity-report-2024.pdf)