Impersonation scams and a record crypto hack target your accounts
Overall posture: Elevated5-minute read
The main point this morning is that official-sounding contact cannot be trusted on its own: the FTC says impostors are copying the agency itself, and the SEC says false filings were used to make a $130 million fraud look credible. A suspected $6.3 billion hack at Binance, which analysts attribute to a North Korean unit, puts exchange-held digital assets in focus. On the physical side, the FBI is flagging white powder letters sent to media and polling organizations, and the UK Foreign Office has refreshed advice for Italy, Colombia and Spain.
United States
Cyber & FraudUnited StatesModerate
Impostors pose as the FTC itself, and 19 fake agency sites had to come down
The Federal Trade Commission published highlights of its impersonation-scam enforcement. It says it shut down 19 websites imitating the agency and has recovered more than $80 million for consumers since its Impersonation Rule took effect.
Why it matters. Your assistants, household managers and family office staff are the people who receive official-looking notices and payment demands in a principal's name. If the agency's own name is being faked, a government letterhead or website is not proof of anything.
What to do
Route any government-branded payment or data request through a callback to a number you look up yourself.
Require a second approver, confirmed by voice, on any payment triggered by an unexpected notice.
False SEC filings fronted a $130M fraud as a Georgia donor drew 15 years in a Ponzi case
The SEC charged two foreign-operated, Colorado-incorporated entities, BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd, over a $130 million scheme that used false SEC filings to build investor confidence. Separately, a Georgia Republican donor was sentenced to 15 years in a $76 million Ponzi scheme in which prosecutors say new investor money paid earlier investors and funded personal spending.
Why it matters. The principal, the family office investment lead and the family's advisors are the people pitched private deals by credible-looking sponsors. A filing or a prominent name in a pitch deck is not independent verification.
What to do
Confirm any filing directly with the regulator, not through links supplied by the sponsor.
Have custody and fund balances confirmed independently before any wire to a new vehicle.
White powder letters went to media and polling firms; your mailroom needs a protocol
The FBI Internet Crime Complaint Center posted an alert on suspicious letters containing white powder. The letters were mailed to state and local election officials, media organizations, and public and private polling companies.
Why it matters. Executives and staff at media or polling organizations, and the family office or residence staff who open mail for a public-facing principal, are the people handling this material. A set procedure keeps a staff member from opening an envelope on instinct.
What to do
Brief mailroom and household staff: do not open, shake or move an unexpected powder-bearing envelope; isolate it and call police.
Confirm who screens and logs mail at each office and residence.
A suspected $6.3bn Binance hack, tied to North Korea, puts exchange-held crypto in focus
BBC News reports that Binance was hit by a suspected $6.3 billion hack, which would be the largest in history. Two analytics firms attribute it to a North Korean hacking unit called TraderTraitor, and the Financial Times describes it as a record crypto heist. The reports provided do not say what happens to customer balances.
Why it matters. Principals and family offices that hold digital assets on exchanges, and the staff who manage those logins, are exposed to the same state-backed actors. Attackers at this level target the people who hold access, not only the platforms.
What to do
List every exchange and wallet the family or office uses and who holds each login.
Move to hardware-based authentication on those accounts and restrict who can approve withdrawals.
Your Italy, Spain and Colombia trips need a fresh check after UK Foreign Office updates
The UK Foreign Office updated its Italy page on a national strike and added information on a temporary deployment of security forces in Cucuta, Colombia. It also posted new Spain information after the high-speed rail collision in Toledo. BBC News reports leaked audio that appears to show one train cleared to move at normal speed although another ahead had stalled.
Why it matters. Traveling executives, spouses and children on itineraries through these countries face disrupted ground transport and rail plans. Drivers, advance staff and jet and hotel schedules are what a strike or deployment changes first.
What to do
Check Italy itineraries against the strike dates before confirming drivers and transfers.
Prefer road transfers with a vetted driver over rail in Spain until the investigation clarifies.
A ¥46M watch was stolen from a Tokyo shopping complex already hit in August
A watch worth 46 million yen was stolen from a store at Nakano Broadway in Tokyo. Kyodo News and The Japan News report that the same complex suffered a similar theft in August.
Why it matters. Collectors, dealers and traveling principals who buy, carry or ship high-value watches in Tokyo are exposed where thieves have already returned to the same location. Staff accompanying a principal on shopping trips should treat a repeat-hit venue as a known target.
What to do
Avoid wearing or carrying high-value pieces in venues with recent thefts.
Arrange secured shipment or hotel-vault storage for any purchases.
CISA added two exploited vulnerabilities to its catalog, including a GitLab integer overflow flaw; ask your IT provider to confirm patching if you self-host. (CISA)
Iran has stepped up strikes on vessels in the Strait of Hormuz over the past month, and the resulting oil spills are washing onto UAE beaches; review Gulf yacht routing. (Financial Times)
The UK Foreign Office updated Ebola screening and health guidance for Nigeria and Kenya; check entry requirements before any travel. (UK Foreign Office · UK Foreign Office)
Art security: police released suspect photos in the Tefaf art fair heist and placed them on an EU most-wanted list, and thieves fled a Dresden museum complex after a guard spotted them. (NL Times · ARTnews.com)
One thing to do today
Put a verification protocol on every payment and notice
The lead exposure today is impersonation: the FTC is dealing with fake versions of itself, and false filings made a large fraud look legitimate. SAG's Family Verification Protocol sets out call-back rules, second approvers and code words for your principals, assistants and family office staff. SAG can put it in place for your family this week; book a private call.
