The most effective fraud attempts right now don’t look like fraud. They look like us.

We spent a good part of September on this one — a client webinar on safeguarding your family and your wealth from current cybercrime tactics, and then a follow-up note a few days later when our custodian flagged a scheme that was picking up steam. It’s the most engagement we’ve had on a topic in a while, which tells us something. People are feeling it.

So here’s the short version, written down in one place.

What’s Actually Happening

The tactic making the rounds is impersonation. Someone calls, texts, or emails claiming to be from your custodian or from an advisory firm — sometimes ours by name. There’s usually a story attached: a suspicious charge, a login from an unfamiliar place, an account that’s been compromised. The story is designed to do one thing, which is to get you moving quickly.

The part that unsettles most people is that caller ID can be made to display a real number. The number on your screen can say Schwab. It can say Ridgeline. That’s spoofing, it’s not difficult to do, and it means the one verification step most of us rely on by reflex is no longer worth anything.

Add to that what artificial intelligence has done to the texture of these attempts. The clumsy email with the odd grammar is mostly gone. What’s replaced it is clean, specific, and personalized — and in the more aggressive cases, a voice on the phone that sounds like someone you know. The tools that make a scam convincing got cheap and easy at the same time.

The Four Things That Never Happen

This is the part worth committing to memory, because it turns a judgment call into a simple test. Your custodian and your advisor will never contact you out of the blue to:

  • Ask for your password, a one-time code, or a verbal password
  • Ask you to confirm fraud by clicking a link
  • Request remote access to your computer or your phone
  • Tell you to move money into a “safe” account

That last one deserves its own sentence. There is no safe account. It is not a thing that exists. Anyone who uses that phrase is trying to take your money, full stop.

What to Do When Something Feels Off

Hang up. Don’t reply. You are allowed to be rude to someone who called you — you owe an unexpected caller exactly nothing, including politeness.

Then call back on a number you already trust. Not the number that called you, not the number in the email, not the number the caller gives you when you say you’d like to verify. The number on your statement, or in your client portal, or in your own phone’s contacts. This single habit defeats nearly every version of this scam, because the whole scheme depends on keeping you on their line.

Never give your Social Security number, date of birth, account numbers, or login credentials to someone who contacted you. The direction of the call matters more than anything that’s said during it.

And treat urgency itself as the warning sign. Real institutions are slow. They send letters. They are fine with you calling back tomorrow. Pressure to act in the next ten minutes is not a sign that the situation is serious — it’s a sign that someone needs you to stop thinking.

A Few Structural Protections

Beyond the habits, there are a handful of settings worth putting in place once so they can work in the background.

View-only access for family. Most custodians offer an online permission that lets another person see account activity without being able to transact or change anything. It works well for an adult child helping with oversight, or for a spouse who isn’t the one in the accounts day to day. If you’d like that set up, tell us and we’ll take care of it.

A verbal password with your advisor. Not one we’ll ever call and ask you for — one you can use to confirm it’s really us, in the direction that matters.

Multi-factor authentication everywhere it’s offered, with an authenticator app rather than text messages where you have the choice. Text codes can be intercepted by someone who takes over your mobile number.

A family code word. Low-tech, and increasingly useful. If a voice that sounds like your grandchild calls in distress asking for money, the code word ends the conversation in four seconds.

A freeze on your credit at all three bureaus. It’s free, it’s reversible, and there’s very little reason not to.

The Posture We’d Recommend

We’d rather field a hundred unnecessary calls than miss the one that mattered. That’s not a figure of speech — please use the phone. Nobody here is going to be annoyed that you checked, and nobody is going to think less of you for having almost fallen for something clever. These attempts are convincing by design, built by people who do this full-time, and getting fooled is not a referendum on your intelligence.

If something seems off, call us at (919) 782-0494. If it turns out to be nothing, we’ll have had a nice conversation.

A few places worth bookmarking, if you want to read further:

If you missed the webinar, the recording, the slides, and a supplementary resource from a digital privacy firm went out to clients by email in late September — reply to that note, or call us, and we’ll resend the links.