Security for Wealth Management: the anatomy of a BEC fraud and how to contain it

Why wealth management is a priority target for financial crime

A wealth management firm occupies a peculiar position on the risk map of the financial system: it does not necessarily hold custody of the assets — they are frequently held at brokerages, banks, and partner fiduciary administrators — but it concentrates something equally valuable, namely complete knowledge of who the clients are, how much each one has, where it is allocated, when liquidity is available, and through which channels the money moves. For an attacker, this knowledge is worth as much as direct access to the account, because it makes it possible to pick the right victim, at the right moment, with the right pretext.

The client profile amplifies the problem. Ultra-high-net-worth individuals, business-owning families, executives, and investors with significant assets are individual targets for spear phishing — tailored social engineering attacks based on public and private information collected patiently. Unlike mass phishing, spear phishing against a private client is written with the advisor's name, the firm's jargon, the transaction history, and, in many cases, the exact context of an investment or redemption that is about to happen.

Add to this the asymmetry of incentive. The average ticket of a successful fraud in this sector is extremely high: a single diverted investment can represent hundreds of thousands or millions of reais. From the criminal's economic standpoint, this justifies investing weeks in reconnaissance, buying access to compromised mailboxes on underground forums, and building lookalike domain infrastructure. The wealth attacker is patient, funded, and specific — and the defense must match that profile.

BEC: the scam that defines the threat in wealth management

BEC is the acronym for Business Email Compromise. It is the category of fraud that moves the most money in digital financial crime and the one that best describes the concrete risk facing a wealth management firm. The mechanics are deceptively simple, which is why they are so effective: the attacker gains visibility into an email conversation — by compromising the client's, the advisor's, or a third party's mailbox in the chain — and, at the moment a financial transaction is being negotiated, injects a fraudulent instruction that reroutes the money.

There are important variations. In direct compromise, the attacker has access to the real mailbox and replies from within the legitimate thread — this is the most dangerous scenario, because the fraudulent email comes from the genuine address. In spoofing and lookalike, they do not have access to the mailbox, but they create a near-identical domain (swapping a letter, using .com instead of .com.br, or visually similar characters) and impersonate the advisor or the client. In CEO fraud, they impersonate a figure of authority — the founding partner, the head of the desk — to pressure a subordinate into executing an urgent, confidential transfer outside the standard procedure.

What makes BEC so lethal in wealth is that it exploits the very nature of the service. The relationship between a private client and an advisor is built on trust and speed — the client expects an email instruction to be handled promptly, and the advisor is trained to serve. The scam turns that virtue into an attack surface. That is why the central countermeasure is not technological, it is procedural: instituting, without exception, out-of-band verification for any transaction or change of banking details.

Account takeover and the forwarding rule no one sees

Before a wire transfer fraud exists, there is almost always an account takeover — the seizure of control of an email account. The attacker obtains the credential through phishing, through a leaked reused password, or through brute force against accounts without MFA. But the step that defines a mature attack is what they do after getting in: they install silent persistence to keep visibility even if the victim changes the password.

The classic technique is the hidden forwarding rule. Inside the compromised mailbox itself, the attacker creates a rule that forwards copies of messages — usually filtering by words such as "transfer", "TED", "investment", "PIX", "contract", "banking details" — to an external address, and simultaneously moves those messages to a folder the victim does not check, or marks them as read. The result is that the advisor or client keeps using email normally, unaware that every financial conversation is being mirrored to the criminal in real time.

Other signs of account takeover that continuous monitoring should capture include: logins from geographies incompatible with the user's routine (impossible travel — two accesses in distant locations within a physically impossible interval), the use of legacy email protocols that bypass MFA, the creation of new application tokens, changes to password recovery methods, and anomalous spikes in the volume of sent or deleted items. In isolation each may be noise; correlated, they draw the attack.

Leakage of wealth data: the fuel for blackmail

The second major risk axis, alongside wire transfer fraud, is the leakage of wealth data. A wealth client base is a dossier of extremely high value: names, tax IDs, asset composition, corporate and family structures, offshore accounts, relationships with offshore entities and holding companies, spending and liquidity patterns. This body of information has its own market. It is not sold only for direct fraud — it feeds blackmail, extortion, express kidnapping, and the fine selection of the next BEC victims.

From a regulatory standpoint, this data is personal data protected by the General Data Protection Law (LGPD). Although the LGPD treats specific categories as "sensitive" (racial origin, religious conviction, health, biometrics, among others), the financial data of a private client, given the context and the magnitude of the risk its leakage represents, demands the highest level of protection and justifies being handled as critical information. An incident that leaks this base generally constitutes a situation of relevant risk or harm to the data subjects, triggering the duty to notify the ANPD and those affected.

The leak is rarely an isolated event. In many investigations, the database is exfiltrated months before any visible fraud, and used surgically: the attacker knows that client X has a redemption scheduled, knows the name of the advisor who handles them, knows the approximate amount. When the BEC arrives, it already comes calibrated with real data. That is why protection against leakage — access control, encryption, exfiltration prevention, and monitoring — is not a front separate from fraud: it is the same war, played earlier.

Insider threat: the risk that lives inside

Not every threat comes from outside. In wealth management, legitimate access to ultra-sensitive information is distributed among advisors, desk operators, back-office areas, compliance, and technology. The insider threat can be malicious (an employee who decides to exfiltrate the client base to sell it, or who collaborates with external fraudsters) or unintentional (someone who falls for phishing, shares credentials, or handles data negligently).

Internal risk is especially delicate in this sector because trust is part of the product. The controls, therefore, must be designed to reduce opportunity and increase traceability without turning the operation into an environment of permanent distrust. The principle of least privilege — each person accesses only what their role requires — is the foundation. On top of it are built segregation of duties (whoever initiates an operation is not the one who approves it) and the immutable audit trail of who accessed which data and when.

Decripte's 24x7 SOC treats the insider threat with the same behavioral lens used for the external attacker: what matters is the deviation from the pattern. An advisor who always accesses five accounts a day and suddenly exports the entire base in the early hours of a Friday triggers the same alert as a login from a foreign IP. The defense does not presume guilt — it observes anomaly and investigates.

How Decripte detects and contains a fraud in progress

The difference between a scare and a loss, in a wire transfer fraud, is measured in minutes and hours. Once the fraudulent instruction is executed and the money leaves, the recovery window closes quickly: the attacker moves the funds through a chain of mule accounts, often scatters it across withdrawals and PIX, and within a few hours the trail becomes hard to reverse. That is why containment must be immediate — and why Decripte's containment SLA of up to 1 hour is a core capability, not a contractual detail.

Detection, ideally, happens before the transfer. The 24x7 SOC monitors the signals that precede the scam — the newly created forwarding rule, the impossible login, the recently registered lookalike domain resembling the firm's, the spike in emails about payment. When these signals correlate, the team acts on the preparation of the attack, closing the door before the fraudulent instruction reaches the client or the back office.

When the fraud is already under way, the response combines three simultaneous fronts: technical (revoking sessions, ejecting the attacker from the mailbox, removing malicious rules, resetting credentials with MFA), financial (engaging the financial institution for a freeze and recall, guiding the client, filing a police report), and narrative containment (establishing which conversation is legitimate and which is fraudulent, re-establishing a trusted communication channel outside the compromised email). Coordinating these fronts under pressure is exactly what a mature Incident Response plan delivers.

Compliance as trust infrastructure

In wealth management, compliance is not merely an obligation — it is part of the value proposition. The private client entrusts their wealth to whoever demonstrates governance. Decripte structures the firm's compliance so that it is, at the same time, real defense and a commercial asset.

The LGPD is the central axis: mapping the personal data processed, the legal basis for each processing activity, retention and disposal policies, access controls and encryption, and an incident response plan that addresses the duty to notify the ANPD. For firms regulated by the CVM and related to the Central Bank, sector-specific cybersecurity and continuity requirements are added. Where there is card processing, PCI-DSS applies. And ISO 27001 certification provides the information security management system framework that organizes all of this in an auditable way.

Decripte treats compliance as a consequence of good controls, not as documentary theater. Real security is implemented first — MFA, monitoring, out-of-band verification, segregation of duties — and then what actually exists is documented and audited. This path produces certifications that withstand the scrutiny of a sophisticated client and a regulator, rather than paperwork that collapses at the first incident.

Pentest and offensive validation: discover before the criminal does

Controls are only worth something if they work under attack. Decripte's Pentest simulates, in an authorized and controlled way, exactly what a real adversary would do against the firm: spear phishing campaigns against advisors and staff, account takeover attempts, exploitation of lookalike domains, testing of client portals and partner integrations, and assessment of the anti-fraud process's resistance to a BEC scenario.

The value of a pentest in this sector is not only in finding a technical flaw in a portal — it is in testing the human and procedural link, which is where the fraud actually happens. A well-designed exercise answers concrete questions: if an attacker sends an email changing banking details to the back office, does the out-of-band verification procedure hold the operation? If an advisor's mailbox is compromised in a lab, does the monitoring detect the forwarding rule? Does the trained private client identify the lookalike?

The pentest findings feed directly back into the design of controls and the training roadmap, closing the cycle of discover, fix, and validate again. Security in wealth is not a project with an end — it is a continuous regime of testing and adjustment, because the adversary does not stop either.

Anatomy of a BEC diverting a private client's investment (anonymized real example)

How Decripte responds to a fraud incident in wealth management

Incident response in the wealth management sector is a race against the financial clock: the goal is to stop the fraud before the money leaves, or recover it while it is still traceable. Decripte executes this response in coordinated steps, with a containment SLA of up to 1 hour.

1. Triage and immediate activation: upon receiving the alert — from the SOC, the client, or the firm — Decripte classifies the severity and activates the Incident Response team, establishing a secure communication channel outside the potentially compromised email.
2. Transaction containment: the number one priority is to prevent the money from leaving. Decripte instructs the suspension of any suspicious payment and, if the transfer has already occurred, immediately engages the financial institution for a freeze and recall attempt, within the SLA of up to 1 hour.
3. Out-of-band verification: confirmation by voice, on a previously registered number, of whether the instruction and the banking details are legitimate. It is the step that definitively separates the real operation from the fraud.
4. Ejecting the attacker: active sessions are revoked, credentials are reset with phishing-resistant MFA, and forwarding rules and any persistence mechanisms installed in the compromised mailbox are removed.
5. Forensic investigation and scoping: Decripte reconstructs the attack timeline — when the attacker got in, what they saw, what they exfiltrated — to scope the extent of exposed data and the impact.
6. Assessment of regulatory duties: with the scope defined, the controller is advised on the obligation and the content of the notification to the ANPD and the affected data subjects, in accordance with the LGPD and applicable regulations.
7. Recovery and secure resumption: the legitimate financial flow is resumed through a verified channel, with details confirmed out of band, and trusted communication with the client is re-established.
8. Lessons learned and hardening: the incident report is produced and the controls that prevent recurrence are deployed — mandatory out-of-band verification, email monitoring, and expanded FIDO2 MFA.

How Decripte structures a wealth management firm's security

Incident response puts out the fire; structure prevents the next one. Decripte organizes wealth management security around pillars that attack the root cause of fraud — the dependence on blind trust in email — and build lasting resilience.

Recommended plans for Wealth Management and Private Banking

Frequently asked questions

Sector terms

BEC (Business Email Compromise)

Fraud in which the attacker compromises or imitates an email account to insert themselves into a legitimate financial conversation and reroute a transfer to an account under their control. It is the main financial threat against wealth management firms.

Out-of-band verification

Confirmation of an instruction through a channel independent of the one on which it was received — for example, calling a previously registered number to validate a payment order that arrived by email. It is the most effective control against BEC.

Account takeover (ATO)

Seizure of control of a legitimate account (email, portal) by an attacker, usually followed by silent persistence, such as the installation of hidden forwarding rules to mirror financial conversations.

Spear phishing

A highly targeted social engineering attack, tailored to a specific victim based on information collected about them, in contrast to mass phishing. Common against private clients and advisors.

Insider threat

A threat originating from within the organization, whether malicious (an employee who exfiltrates or collaborates with fraud) or unintentional (negligence, falling for phishing). Critical in wealth due to the distributed access to ultra-sensitive data.

Lookalike domain

A domain created to resemble that of a legitimate organization, with subtle differences (a swapped letter, a different extension, similar characters), used to deceive victims in phishing and BEC attacks.