When Trust Becomes the Target: Protecting Your Wealth from Impersonation Fraud

For today’s investors, fraud is no longer defined by poorly written emails or suspicious calls from strangers. Today’s most dangerous scams are polished, personal, and convincing. Criminals may sound like your grandchild, write like your financial advisor, and know enough about your life to make an invented emergency feel real.

Two threats deserve particular attention: grandparent scams enhanced by artificial intelligence (AI) and Business Email Compromise, often called BEC. Although the scenarios differ, both exploit the same vulnerability: trust.

A Familiar Voice Is No Longer Proof

In a grandparent scam, a criminal impersonates a grandchild or another relative facing an urgent crisis. The caller may claim to have been arrested, injured in an accident, or stranded in another country. A second fraudster may then pose as a lawyer or police officer to make the story feel legitimate and provide payment instructions.

Although the scam has existed for many years, AI has made these calls even more effective. Voice-cloning tools can reproduce a person’s tone and speech patterns using audio gathered from social media, videos, or even voicemail greetings. The voice may sound remarkably familiar, but it is no longer reliable evidence of identity.

Ontario senior Marilyn Crawford can attest to this. She received a call from someone she believed was her grandson, Ian. The caller said he had been arrested for stealing a car and needed $9,000 for bail. Crawford was confident that the voice on the call was her grandson, so she agreed to help. Fortunately, the scam was stopped before any money was lost.

Other victims were not so lucky. Police in Lethbridge, Alberta, have warned that scammers are using AI tools to mimic victims’ relatives. In 2024, police charged two individuals in connection with an “emergency fraud” case involving the collection and distribution of funds. Experts noted that criminals can combine voice technology with personal information gathered from social media to make their stories more credible.

The scale of traditional emergency fraud is already significant. The Canadian Anti-Fraud Centre (CAFC) reported that emergency scams caused more than $23 million in losses across Canada from 2021 through April 2024. Canadian police arrested more than 70 individuals who allegedly collected money from victims during that period.

The Email That Looks Completely Normal

Business Email Compromise uses a different approach but follows a similar formula. A criminal impersonates someone the target already trusts, such as an investment advisor, accountant, or lawyer.

The email message may appear to continue a legitimate conversation, providing “updated” instructions such as bank account information. In more sophisticated attacks, criminals may have compromised the mailbox of one of these trusted advisors, monitored correspondence, and intervened at precisely the right moment.

Detecting these attacks may rely on subtle clues: a small change in the sender’s email address, a heightened sense of urgency, or a request to keep the transaction confidential. Sometimes there are no obvious clues at all. The communication appears authentic because the criminal is sending it from a compromised account.

Adopt One Rule: No Money Moves on Trust Alone

The strongest protection is a healthy dose of skepticism. Before sending money or changing payment instructions, confirm the request independently. Do not reply to the original email or call a number on it. Use contact information obtained from a trusted source. If the request appears to come from a relative, contact that person directly or speak with another family member to confirm.

The CAFC recommends hanging up on suspicious emergency calls and calling a number already in your contact list. It also warns that Canadian courts do not demand cash or cryptocurrency to release someone from custody.

The organization also recommends that families establish a private verification phrase known only to trusted family members. If a caller claims to be a relative in distress, ask for the phrase. Avoid questions whose answers could be found on social media, such as a pet’s name, birthday, or vacation destination.

Protect email, banking, and investment accounts with unique passwords and strong multifactor authentication. Limit the public information that criminals can use. Family relationships, travel plans, property purchases, board appointments, and investment activity can all help an attacker construct a believable story.

Create Permission to Pause

The most important defence may be cultural rather than technical. Encourage critical thinking and respect verification. Both investors and service providers must have explicit permission to delay a transaction that does not feel right. Legitimate professionals will respect verification. A genuine family emergency will withstand a callback. A credible investment opportunity will not disappear because someone took 10 minutes to confirm banking instructions.

Urgency, secrecy, and money can be an explosive combination. When in doubt, take a pause. Call someone you trust. Verify independently.

Your relationships are among your greatest assets. They are also what fraudsters seek to exploit. Protecting your wealth now requires protecting the trust surrounding it.

Drew Carmichael is Vice President at Iron Spear Information Security Ltd. (founded 2012), where he helps organizations strengthen cybersecurity governance, resilience, and risk management. He has led cybersecurity initiatives for organizations across Canada, including multi-year engagements with RGF Integrated Wealth Management focused on cybersecurity maturity, application security, and the protection of client-facing digital services.

The views expressed are those of the author and not necessarily those of RGF Integrated Wealth Management, which makes no representations as to their completeness or accuracy.