The detail makes it convincing. The urgency makes it difficult to question. Neither proves the request is genuine.
Social engineering is the manipulation of people into revealing information, granting access or taking actions they would not otherwise take. In a family office or private office, attackers may target the trusted professionals around a principal rather than approaching the principal directly.
Why assistants and Chiefs of Staff are attractive targets
A Chief of Staff may coordinate advisors, household personnel, travel, corporate appointments and sensitive correspondence. An executive assistant often knows who needs what, when and through which channel.
This knowledge is essential to doing the job well. It also means that impersonation, pretextual requests and compromised communications can have disproportionate consequences.
An attacker doesn't need to defeat every security control if they can persuade someone with legitimate access to act on a false instruction.
Familiarity can be manufactured
Social engineering attempts may refer to a real event, use the name of a trusted advisor or mimic someone's writing style. Accounts and messaging services can also be impersonated or compromised.
The UK's National Cyber Security Centre has warned that attackers may seek account recovery codes, attempt to add devices to messaging accounts and impersonate known contacts.
The useful lesson is not to mistrust every message. It is to recognise that accurate background details do not authenticate the sender.
What practical controls matter?
Private offices benefit from clear, workable verification rules for unusual requests involving sensitive documents, money, account access or changes to established arrangements.
Staff should know how to verify an unexpected instruction through a previously established, trusted channel, rather than relying on the contact details supplied in the message itself.
Access permissions should reflect actual responsibilities. Communication protocols should be practical enough to use under time pressure. Staff need a way to question a request without fearing that they are being difficult or disloyal.
A culture that rewards unquestioning speed can create openings for manipulation.
When an incident requires more than routine IT support
A suspected compromise may involve technical issues, but also questions about the person or organisation behind the approach, what information was exposed and whether the request was part of a wider pattern.
That may call for technical incident response, legal guidance, investigation or protective intelligence, depending on the facts. Preservation of relevant evidence and prompt internal escalation are important; staff should not investigate a suspected attacker independently.
FRYA supports private offices, family offices and organisations with human-risk enquiries, counterintelligence and appropriate investigative assistance. FRYA Academy also offers practical training in human behaviour and social engineering awareness.
The strongest gatekeeper is not the one who says yes to everything quickly. It is the one who knows when a request deserves a second check.