Cybercriminals are increasingly exploiting fake digital party invitations to breach the personal email accounts of high-net-worth individuals, creating a potential pathway to their financial assets, according to wealth managers and cybersecurity specialists. The Federal Trade Commission issued a consumer alert in May 2026, warning that fraudulent messages mimicking platforms like Evite and Paperless Post trick recipients into entering their email credentials to view event details. Once credentials are captured, scammers can hijack the account and propagate the same malicious invitations to the victim's contacts, the FTC said.
The threat is part of a broader surge in phishing activity. The FBI's Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, the most of any crime category, as detailed in its 2025 Internet Crime Report released in April 2026. Reported phishing losses nearly tripled to $215.8 million from $70 million in 2024, while total reported cybercrime losses reached a record $20.877 billion. These figures underscore the escalating risk for affluent families and the advisors who serve them.
Why personal email is a weak point
Steve Czocher, a partner and director of family office services at Chicago-based Gresham Partners, notes that wealthy clients are most vulnerable through their personal email accounts. The risk intensifies when clients use older services like Yahoo or AOL, or fail to enable two-factor authentication. Since email is often the primary method for resetting passwords to financial accounts, a single compromised inbox can give criminals access to substantial assets. "Accessing sensitive accounts on public Wi-Fi adds further risk. A VPN can help protect the connection, but it cannot prevent phishing or account takeover on its own," Czocher said.
Brian Francetich, director of Golsan Scruggs RIA, which provides insurance and risk management to advisory firms, points out that the network of professionals around a wealthy family—advisors, attorneys, accountants, private bankers, and family office staff—expands the attack surface. Each individual can be impersonated in a phishing attempt. "In many cases, the underlying technology isn't the primary issue. The challenge is that the communication appears legitimate enough for a reasonable person to trust it, and the bad actors continue to get better at this," Francetich said.
Heather Sweeney, strategic partner manager at BlackCloak, a digital executive protection firm based in Lake Mary, Florida, observes that affluent families often lack the cybersecurity safeguards at home that they rely on at work. Artificial intelligence is widening this gap. The FBI report counted 22,364 complaints referencing AI in 2025, with associated losses of approximately $893 million. "Artificial intelligence has made these attacks even more dangerous by enabling criminals to impersonate family members, financial advisors and other trusted contacts with remarkable sophistication," Sweeney said. "This is particularly concerning amid the generational transfer of wealth, as aging family members and younger generations may face different vulnerabilities. The reality is that trust itself has become a new security perimeter."
How advisors can help clients spot phishing
Czocher emphasizes that the most effective defense is establishing a single, consistent method for exchanging sensitive information. When clients know how their advisor will contact them, any request arriving through another channel becomes easier to question. "At Gresham, we use secure email and a client portal to share sensitive documents and instruct clients to retain their login instructions through a password manager and use these services when sending confidential information. Employee preparation is equally important. Our cybersecurity training includes simulated phishing emails sent at random, often using topics designed to prompt an immediate response," Czocher said.
Francetich notes that modern phishing attempts rarely resemble the clumsy scams clients were trained to recognize. Fraudulent emails, texts, and websites now closely mimic legitimate messages from banks, advisors, vendors, and even relatives. "Requests involving credentials, account changes, sensitive information, or movement of funds should be independently verified through another communication channel whenever possible. While security tools remain important, client awareness and verification procedures can significantly reduce the likelihood of a successful attack. We find that in the vast majority of cyber incidents there was a human judgement or trust error made," Francetich said. Some advisors are now incorporating personal know-your-client questions into verification calls, asking about family details or shared history that an impostor would struggle to answer. Sweeney recommends establishing a predetermined code word for any instruction to move money.
"Wealth advisors must emphasize the importance of independently verifying sensitive requests through trusted, previously established channels, regardless of how legitimate a message, phone call or video interaction may appear," Sweeney said. The pressure is not only on clients. Advisory firms themselves have faced a wave of attacks, including the breach that prompted a second class action lawsuit against Mercer Advisors. As AI-powered voice-cloning scams demonstrate, criminals are using sophisticated techniques to impersonate clients and advisors alike.
What advisors should do when a client is breached
Speed is critical. Czocher says Gresham moves quickly to lock down access and protect accounts. "We advise clients to change passwords immediately and enable two-factor authentication on frequently used applications, particularly those linked to financial accounts. We also help freeze their credit, restrict money movement at our primary custodian, and close affected accounts as needed," he said. Advisors should also consider the broader implications for their practice, as a client breach can expose sensitive data and lead to regulatory scrutiny. For more on how firms are adapting, see Vanguard's customizable models and the ongoing RIA M&A activity that reflects the industry's focus on resilience.
