.png)
%20(1).png)
Imagine receiving a security email from Google, followed by a phone call from someone claiming to be from Google Security.
The email is real and the caller knows about it, so it would be reasonable to assume the call is legitimate.
Unfortunately, scammers have found ways to combine legitimate security messages with fraudulent phone calls, making it harder to tell what is real.
The good news is that you don't need to become an expert at spotting every new scam. A few simple habits can help protect you and your family.
A recent attack documented by Proton shows how convincing these scams can be.
A scammer creates a new Google account and enters the victim's email address as the recovery email for that account. Google then sends the victim a legitimate message asking them to confirm the recovery address.
The scammer calls the victim pretending to work for Google. They may claim someone is trying to access the victim's account or change its recovery information.
Additional genuine Google security messages may even arrive while the caller is speaking.
This creates a convincing illusion: the emails are real, so the caller must be real too but that isn't necessarily true.
Fortunately, Google offers a simple rule: They will never call you about your account security. Google will not call to ask for your password or verification code or ask you to approve a device prompt.
The technique behind this scam can appear in other forms.
The Canadian Anti-Fraud Centre warns that criminals may attempt to sign into your email, social media, banking or other accounts, causing a legitimate one-time passcode to be sent to you.
The criminal then contacts you while pretending to represent an organization you trust and asks you to provide the code.
In other words, receiving a real security message or verification code doesn't prove that the person contacting you is legitimate.
That is an important distinction to remember.
Don't panic, and don't try to solve the problem while you're still on the phone.
If someone unexpectedly calls about an account problem, end the conversation. You can investigate separately.
The Canadian Anti-Fraud Centre recommends never sharing one-time passcodes, including with someone claiming to represent a service provider.
A code that arrives on your phone or in your email is for you, not for the person contacting you.
Don't use instructions or links provided by the caller.
Instead, open the official website or app yourself. Review recent security activity and check for devices you don't recognize.
For a Google account, use Google's own account security tools rather than relying on someone who contacted you unexpectedly.
Look at what the message actually says, not what the caller tells you it means.
For example, someone asking to use your email address as the recovery address for another account is not the same as someone changing the recovery information on your own account.
Use strong, unique passwords and multi-factor authentication, also known as MFA. These measures make it harder for someone to take over an account even if they obtain your password.
The Canadian Centre for Cyber Security recommends additional authentication measures and strong account security practices to help protect against phishing and related attacks.
Account security shouldn't stop with just a few members of your family.
A teenager's email account may connect to social media, photos, cloud storage, gaming accounts, school services and other parts of their digital life. Same with children and older adults.
You don't need to turn everyone into cybersecurity experts. Give them three simple family rules instead.
Someone claiming there's an urgent problem with an account doesn't need to stay on the phone while you investigate.
Not with someone on the phone. Not with someone messaging on social media. Not even with someone who claims they sent the code to you by accident.
Make it clear that your family can come to you if something seems wrong, even if they've already clicked a link, answered a message or made a mistake. That last rule may be the most important.
You want your family's first instinct to be “tell someone,” not “hide what happened.”
Competition Bureau Canada similarly recommends teaching young people to protect their personal information and verify who they are dealing with online.
Professional-looking messages aren't necessarily trustworthy.
The Canadian Anti-Fraud Centre warns that modern fraud can involve professional-looking messages and AI-generated text, images, videos and voices.
Executives can also face highly targeted phishing. The Canadian Centre for Cyber Security describes attacks aimed at senior executives as “whaling,” a form of spear phishing that can use information about its target to make an approach more convincing.
Your family's security is also connected than you may think. A spouse, child or other family member may have accounts, devices or personal information that overlap with the wider family's digital life.
So the right question is no longer simply:
“Does this email look fake?”
A better question is:
“Can I independently confirm that this request is real?”
The best defence against this kind of scam isn't fear. It's a simple habit:
A real email doesn't make the person calling you real. A familiar phone number doesn't prove who's calling. And an urgent warning doesn't mean you have to respond urgently.
If you're a Richter Guardian client and receive a suspicious security message, call or account alert, contact us before taking action if you're unsure. Our team can help you assess what happened and determine what to do next.
The objective isn't to make your family nervous about technology; it's to make everyone a little harder to fool.
Richter Guardian gives you enterprise-level cybersecurity tailored for individuals, families, and executives.
Imagine receiving a security email from Google, followed by a phone call from someone claiming to be from Google Security.
The email is real and the caller knows about it, so it would be reasonable to assume the call is legitimate.
Unfortunately, scammers have found ways to combine legitimate security messages with fraudulent phone calls, making it harder to tell what is real.
The good news is that you don't need to become an expert at spotting every new scam. A few simple habits can help protect you and your family.
A recent attack documented by Proton shows how convincing these scams can be.
A scammer creates a new Google account and enters the victim's email address as the recovery email for that account. Google then sends the victim a legitimate message asking them to confirm the recovery address.
The scammer calls the victim pretending to work for Google. They may claim someone is trying to access the victim's account or change its recovery information.
Additional genuine Google security messages may even arrive while the caller is speaking.
This creates a convincing illusion: the emails are real, so the caller must be real too but that isn't necessarily true.
Fortunately, Google offers a simple rule: They will never call you about your account security. Google will not call to ask for your password or verification code or ask you to approve a device prompt.
The technique behind this scam can appear in other forms.
The Canadian Anti-Fraud Centre warns that criminals may attempt to sign into your email, social media, banking or other accounts, causing a legitimate one-time passcode to be sent to you.
The criminal then contacts you while pretending to represent an organization you trust and asks you to provide the code.
In other words, receiving a real security message or verification code doesn't prove that the person contacting you is legitimate.
That is an important distinction to remember.
Don't panic, and don't try to solve the problem while you're still on the phone.
If someone unexpectedly calls about an account problem, end the conversation. You can investigate separately.
The Canadian Anti-Fraud Centre recommends never sharing one-time passcodes, including with someone claiming to represent a service provider.
A code that arrives on your phone or in your email is for you, not for the person contacting you.
Don't use instructions or links provided by the caller.
Instead, open the official website or app yourself. Review recent security activity and check for devices you don't recognize.
For a Google account, use Google's own account security tools rather than relying on someone who contacted you unexpectedly.
Look at what the message actually says, not what the caller tells you it means.
For example, someone asking to use your email address as the recovery address for another account is not the same as someone changing the recovery information on your own account.
Use strong, unique passwords and multi-factor authentication, also known as MFA. These measures make it harder for someone to take over an account even if they obtain your password.
The Canadian Centre for Cyber Security recommends additional authentication measures and strong account security practices to help protect against phishing and related attacks.
Account security shouldn't stop with just a few members of your family.
A teenager's email account may connect to social media, photos, cloud storage, gaming accounts, school services and other parts of their digital life. Same with children and older adults.
You don't need to turn everyone into cybersecurity experts. Give them three simple family rules instead.
Someone claiming there's an urgent problem with an account doesn't need to stay on the phone while you investigate.
Not with someone on the phone. Not with someone messaging on social media. Not even with someone who claims they sent the code to you by accident.
Make it clear that your family can come to you if something seems wrong, even if they've already clicked a link, answered a message or made a mistake. That last rule may be the most important.
You want your family's first instinct to be “tell someone,” not “hide what happened.”
Competition Bureau Canada similarly recommends teaching young people to protect their personal information and verify who they are dealing with online.
Professional-looking messages aren't necessarily trustworthy.
The Canadian Anti-Fraud Centre warns that modern fraud can involve professional-looking messages and AI-generated text, images, videos and voices.
Executives can also face highly targeted phishing. The Canadian Centre for Cyber Security describes attacks aimed at senior executives as “whaling,” a form of spear phishing that can use information about its target to make an approach more convincing.
Your family's security is also connected than you may think. A spouse, child or other family member may have accounts, devices or personal information that overlap with the wider family's digital life.
So the right question is no longer simply:
“Does this email look fake?”
A better question is:
“Can I independently confirm that this request is real?”
The best defence against this kind of scam isn't fear. It's a simple habit:
A real email doesn't make the person calling you real. A familiar phone number doesn't prove who's calling. And an urgent warning doesn't mean you have to respond urgently.
If you're a Richter Guardian client and receive a suspicious security message, call or account alert, contact us before taking action if you're unsure. Our team can help you assess what happened and determine what to do next.
The objective isn't to make your family nervous about technology; it's to make everyone a little harder to fool.
A new kind of AI tool is showing up on social media, on phones and on computers. This AI doesn't just answer questions; it acts for you by being able to read your email, book travel, shop, and send messages to other people while using your name.
These tools are called personal AI agents, or sometimes AI assistants. For busy executives, board members, business owners and public figures, they appear to and do save real time. The agents though also need clear limits, and a recent Canadian story shows why these controls are important.
In October, CBC News reported on Matt Robb, a Toronto resident who used Meta's new agent, Muse, for Facebook Marketplace sales. He says it arranged a Marketplace sale without his knowledge and gave a stranger his home address. When the buyer showed up, Muse even told him, "Yep I'm here!" on Robb's behalf, when he wasn't home.
This all came down to one wrong tap. Robb explained that he had chose "Allow always" instead of "Allow one time." A senior Meta executive said they confirmed together that there was no breach of privacy controls, and Robb says Meta told him it will make that choice clearer.
There was no hacking; the tool did exactly what one setting allowed and that's the main lesson.
Muse is spreading fast. In six weeks, more than 10 million people in the U.S. and Canada signed up.
Every major AI company now offers an agent or assistant like this:
Your home address, travel plans, children's activity and school schedules, and deal emails are valuable to the wrong people. A personal AI agent with broad access holds all of that in one place.
One wrong setting could not only send a stranger to your door, but share an important business decision, intercept, re-route and reply to an email, or quickly move money from one account to another.
Personal AI agents can also affect other people in your life without them knowing.
In the CBC article, a cybersecurity expert stated that the data of people who write to you is also at risk. A lawyer pointed to the U.S. CLOUD Act, which can give the American government access to data on servers owned by U.S. companies, which is exactly where all these tech companies are based.
Personal AI agents are already useful, and they'll keep getting better. Treat an agent like a new assistant on their first day. Give it small tasks and clear limits, and let trust grow over time.
Our concierge team helps leaders and their families work through exactly these questions: what personal information is already out there, which tools can reach it, and what sensible limits look like. A brief review by our Cyber Defence Desk now is far easier than a cleanup later.
Learn how Richter Guardian helps high-net-worth executives and families, or take the free What's My Risk? assessment as an initial first step.
Wire fraud happens when a criminal tricks someone into sending money to an account the criminal controls. Good wire fraud prevention starts before the bank is involved, because most schemes begin with an email account that was hacked or faked. For family offices, principals and the staff who approve transfers, that is where protection matters most.
The bank usually does exactly what it was told. The weak point is the instruction itself.
Wire transfer fraud usually follows a predictable pattern:
This is often called business email compromise, or BEC. It also includes payment redirection fraud, where a real payment is sent to the wrong account because the instructions were changed.
Our article on business email compromise explains why even a familiar email still needs to be checked. It also points out that in 2025, the FBI's Internet Crime Complaint Center recorded more than $3 billion in reported BEC losses.
Family offices are attractive targets for a few simple reasons.
Put together, these factors mean a convincing message at the right time can move a large sum before anyone pauses.
Wire fraud is usually treated as a payments problem. In practice, it is often a personal digital exposure problem.
The criminal needs a way in, and it usually comes from one of three places:
Many of these accounts are personal, not corporate. A principal's private email or a family member's social media profile may sit outside any IT team's view. That is why account takeover prevention and personal monitoring belong in any serious wire fraud prevention plan.
The best controls are simple and used every single time.
None of these steps require advanced technology. They require consistency.
Speed matters. The sooner a bank is told, the better the chance of stopping or recovering funds.
Process controls stop many fraudulent transfers. Reducing the exposure that makes fraud possible is the other half.
Managed personal cybersecurity helps by watching personal accounts, devices and identities that often sit outside corporate IT.
Richter Guardian's Monitoring & Prevention reviews protections such as passwords and MFA and watches for meaningful risk signals over time. Reputation & Identity Protection helps surface credential exposure and impersonation before they can be used in a scam.
If something does go wrong, Incident Response & Concierge Support gives families a clear person to call and guided steps to regain control.
Start by asking a few questions:
Learn how Richter Guardian helps family offices reduce personal digital exposure, or take the free What's My Risk? assessment as an initial first step.
The terms are often used the same way. Wire fraud is the broader crime of using electronic communication to deceive someone for money. Wire transfer fraud describes the specific outcome: a bank transfer sent to a criminal's account.
They usually take over or imitate a trusted email account, then send new payment instructions. If no one confirms the change by phone, the money goes to the criminal's account.
They often move large sums, rely on small trusted teams, act quickly and value discretion. Those conditions make convincing fake requests more likely to succeed.
Call a known number to confirm every new transfer or banking change. Require two approvals, use MFA and unique passwords, and monitor email accounts for signs of compromise.
Call your bank right away and ask them to recall the transfer. Then report it to police and the appropriate fraud reporting agency, secure the affected account, and warn anyone who may get related messages.
Not always. If you approved the transfer, even because you were tricked, recovery may be limited. Coverage depends on your bank, account agreement and any insurance, so check with your bank and insurer before a problem happens.