A family office can harden its own systems thoroughly and still send the family’s most sensitive documents to a place it has no control over. The office’s mail runs on a managed platform with a second factor on every account, and then the statement, the tax return, the signing packet and next month’s travel arrangements go to a family member’s personal email address, which sits outside every control the office maintains. The office is not an island, and the most important traffic leaving it goes to the family.
Where the documents end up
An attachment does not arrive and disappear. It stays in the sender’s sent folder and in the recipient’s inbox, and in our experience most personal mailboxes keep it until someone deletes it, which for most people is never. Over a few years a family member’s personal account becomes an archive of the family’s affairs: account statements, entity documents, passport scans sent for a booking, and the office’s own correspondence, which shows how the office writes, who signs what, and whom it pays.
That archive is what an attacker reaches with one password. The United Kingdom’s National Cyber Security Centre lists what a criminal can do with access to someone’s email, including “access private information about you (including your banking details)”, “post emails and messages pretending to be from you (and use this to trick other people)” and “reset all your other account passwords (and get access to all your other online accounts).” An attacker in no hurry need not act at once, either, because “a common tactic used by cyber criminals is to set up a forwarding rule, which means that they will automatically be sent a copy of all emails sent to your account.”
What follows is often fraud. In the United States, the FBI describes business email compromise as “frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds,” and counted $55.5 billion in exposed losses, a figure that includes attempted as well as completed fraud, across 305,033 incidents reported to it between October 2013 and December 2023. A family member’s mailbox is valuable to that kind of criminal for the same reason it is valuable to the family: it holds the context that makes a forged instruction convincing.
Change what is sent
The change that matters most costs the family nothing, and it is to stop sending sensitive documents as attachments. Send a link to the document held in the office’s own system instead, which the family member opens after signing in and which the office can withdraw, expire or check. The document stays where the office’s controls apply, and the personal mailbox holds a link that is useless to anyone who cannot also sign in.
Regulators addressing professionals who send sensitive files to clients point in the same direction. The United States Internal Revenue Service tells tax professionals to “send only password-protected and encrypted documents if files must be shared with clients via email,” and the United Kingdom’s Information Commissioner’s Office notes that encrypted email requires “configuration in advance,” which it says is “particularly the case when communicating with people external to your organisation.” Encrypting email to a family can be done, and in our experience it seldom survives the first family member who cannot open a message on a phone in an airport, which is why we recommend changing what is sent rather than how it is wrapped.
Protect the accounts that receive what remains
Some things will still arrive by email, and each family member’s personal account remains the route to everything else they hold online. Two-step verification on every family member’s primary email account, and on whichever account would be used to recover it, is the most valuable single setting the family can change, and the NCSC’s guidance on turning it on is written for exactly that reader. The recovery details matter as much as the second factor: the phone number and backup address an account falls back on should be current and held by the family member, not by a former assistant or an address nobody checks.
We recommend that the office treat this as a scheduled piece of work for each family member, done once and carefully, with a record of who is covered, rather than as advice offered in a meeting. The same record supports digital continuity planning, which needs to know which accounts exist and how each is recovered.
Agree the channels in advance
The strongest arrangement remains the one this firm has recommended for years: an office-provisioned account for family business, which sits inside the office’s controls, its security settings and its process for removing access. Some families take it up gladly, and many will not for every member, and a rule the family ignores protects nothing.
Where the family will not move, the workable arrangement in our experience is a short written agreement on channels covering what the office will send and how, which channel each family member will use to give the office instructions, and what the office will never act on without confirming it another way. That last point is where communication meets money, and the confirmation rules are set out in wire transfer authorization controls and verifying someone you know.
The agreement should also reach the office’s outside advisors. An accountant or attorney who emails a family member’s personal address is creating the same archive, and asking how they deliver documents to the family belongs in the security review the office runs on its advisors.
What to build
- An inventory of what goes out. List what the office sends to family members by email, and to which addresses.
- Links instead of attachments. Move statements, tax documents, entity papers and identity documents to a system that requires sign-in, and send links to it.
- A second factor on every family member’s email. Include the recovery account, and confirm the recovery details while doing it.
- An offer of office-managed accounts. Make the offer to each family member, and record who has accepted.
- A written channel agreement. Give it to everyone who sends to the family, including outside advisors.
What to ask this week
How many years of family statements sit in personal inboxes the office has never seen? Which family members have a second factor on their personal email, and who confirmed it? If one of those accounts were taken over tonight, what would the attacker find, and whom in the office could they then impersonate convincingly?
Where this sits
Writing the information-handling rules and the channel agreement is work we handle through cybersecurity program development, and helping each family member secure their accounts, then keeping the record current as the family changes, is what ongoing advisory is for.
Sources
Information Commissioner’s Office (United Kingdom), Encryption scenarios