A family office is, from a fraudster’s point of view, an unusually efficient target. It moves large amounts of money, often internationally, on the instructions of a small number of people who know each other well and trust each other’s emails and voice messages. It deals with lawyers, banks, yacht managers, builders and art dealers who invoice large sums. And its principals are visible enough that their names, travel plans and habits can be pieced together from public sources.
How the losses actually happen
- Payment diversion. An email that appears to come from a supplier, a law firm or a builder announces new bank details. The next invoice is paid to the fraudster.
- “CEO” and principal impersonation. A message — increasingly a cloned voice or a video call — from someone who sounds like the principal asks for an urgent, confidential transfer.
- Account takeover. A compromised email account or banking login is used to send instructions that look entirely genuine.
- Employee dishonesty. A trusted employee or contractor with payment authority diverts funds over time, often undetected for years.
- Ransomware and data theft. Systems encrypted, or private information about the family stolen and used for extortion.
Ask for a quote — it takes under a minute
Tell us the essentials. We reply in writing within 24 working hours and only ask for more if we need it.
Which policy answers which loss
These events sit across two families of insurance that are often confused.
Crime (fidelity) insurance
Crime policies cover the direct financial loss of money, securities or property caused by employee dishonesty, third-party fraud and, under specific extensions, social engineering — a transfer made by an employee who was deceived into making it. The social engineering extension is usually sub-limited and comes with conditions, such as call-back verification of changes to bank details. It is the clause most worth reading, because it is the loss most likely to happen.
Cyber insurance
Cyber policies cover the costs and liabilities of a cyber incident: incident response, forensic investigation, data restoration, business interruption, notification and regulatory costs under the GDPR, and liability to third parties whose data was compromised. Many include cyber extortion. Some include a limited amount for funds transfer fraud; most do not cover the money itself in the way a crime policy does.
The family, not just the office
Fraudsters also target the family directly — a child’s social media, a principal’s personal email, a spouse’s phone. Family cyber and fraud cover answers identity theft, online fraud and cyber bullying for the household, and can sit alongside the family office’s own policies.
Portugal and Spain
Both countries apply the GDPR, with the CNPD in Portugal and the AEPD in Spain as supervisory authorities. A family office that processes personal data about family members, staff and counterparties has notification duties if that data is breached, and the cost of meeting them is one of the most useful parts of a cyber policy. Fraud should always be reported to the police — the Polícia Judiciária in Portugal or the Policía Nacional or Guardia Civil in Spain — and insurers will normally require that report.
What underwriters look at
- Dual authorisation for payments above a threshold, and call-back verification of any change in bank details using a number already on file.
- Multi-factor authentication on email, banking and remote access.
- Segregation of duties between those who approve, those who pay and those who reconcile.
- Backups kept separately from the main systems, and a tested incident response plan.
- Training for family members and staff on impersonation and urgent-payment requests.
These controls matter twice: they reduce the chance of a loss, and many policies make them conditions of cover.
Frequently asked questions
Does cyber insurance pay back money stolen through a fake invoice?
Usually not in full. The transferred funds are typically a crime insurance loss, under a social engineering or funds transfer fraud extension. Some cyber policies include a limited amount; the wording decides.
What is social engineering cover?
An extension to a crime policy that covers money transferred by an employee who was deceived by a fraudulent instruction. It is usually sub-limited and subject to verification procedures that the family office must follow.
Are family members covered as well as the office?
A family office crime and cyber programme covers the office. The family’s own devices, accounts and identities are better answered by a family cyber and fraud policy, which can be coordinated with it.
Does the GDPR apply to a family office?
Yes, when it processes personal data about family members, staff and others. A breach can create notification duties to the CNPD or the AEPD and to the people affected, and a cyber policy can cover the cost of meeting them.
A written review of your fraud and cyber exposure
Tell us how payments are approved and which policies exist today. We reply in writing with where crime and cyber cover would respond, and where they would not.
This article is general information and does not constitute personalised, legal or tax advice. Cover, limits and exclusions are only those of the policy actually issued, after underwriting. Adler & Rochefort is a commercial brand of Ownizo, Unipessoal Lda., mediador registado na ASF n.º 425591790/3.
More on this subject: Family office insurance in Portugal and Spain · Family cyber and fraud insurance