Fraud reaches a Greenwich business as deepfake CEOs net $129M
Overall posture: Elevated5-minute read
Payment fraud is the main exposure this morning: a warrant says an email scam cost a Greenwich business $25,000, and a separate case accuses three people of using deepfake CEOs and bogus lawyers to take $129 million from companies. On the physical side, two people were arrested after a car crash outside the White House, and a robbery in downtown Nashville left a man and his service dog attacked. For travelers, Singapore seized a cruise ship after passengers were left in Cambodia, and the UK Foreign Office added Ebola screening guidance for Côte d'Ivoire.
United States
Cyber & FraudGreenwich, ConnecticutModerate
An email scam cost a Greenwich business $25,000, a warrant says
A warrant says a woman from Georgia defrauded a Greenwich business of $25,000 through an email scam, according to the New Haven Register. The sum is modest, but the method is an email aimed at a company's payments, the same entry point used against larger offices.
Why it matters. The family office, its controller and the bookkeepers who handle household and property payments in Greenwich are exposed whenever a payment request arrives by email.
What to do
Require a call-back to a known number before any new payee or changed bank detail is accepted.
Limit how many people can approve a payment that was requested by email.
Travel & RegionWashington, DC (Lafayette Square)Moderate
Two arrested after a car crash and a barrier jump outside the White House
Two people were arrested after a car crashed in the park outside the White House, according to The Washington Post. One person fought with responding Secret Service and National Guard personnel, and another jumped a barrier in Lafayette Square, authorities said.
Why it matters. Principals, drivers and protective staff who move through downtown Washington pass an area where a security response can develop with no warning. Routes and arrival times near the White House should be planned with that in mind.
What to do
Brief drivers on alternate routes around Lafayette Square before scheduled movements.
Check local alerts on the morning of any downtown DC appointment.
Robbers attacked a man and his service dog in downtown Nashville
Police say a man and his service dog were attacked during a robbery in downtown Nashville, according to WKRN. The report as provided gives no suspect details.
Why it matters. Visiting executives, entertainment guests and their staff who walk downtown Nashville face street-level robbery that can turn violent. Keep personal movements and valuables in mind when planning evenings out.
What to do
Arrange door-to-door transport for evening movements downtown.
Tell staff and guests to keep watches, phones and bags out of sight on foot.
Legal & RegulatoryUnited States (including the Washington, DC area)Moderate
ICE now hides detainee locations, leaving staff's lawyers and families blind
Under a new policy, ICE is leaving thousands of detainees out of its public database, which keeps their location from lawyers and family, according to The New York Times. In the DC area, a youth baseball coach arrested by ICE was taken to a detention facility in Louisiana, WTOP reports.
Why it matters. Households that employ drivers, nannies, housekeepers or contractors, and the attorneys who serve them, could be unable to find a detained worker through the public database. That raises duty-of-care and continuity questions for the principal.
What to do
Keep current emergency contacts and counsel details on file for every employee.
Ask employment counsel to confirm what paperwork each household and vendor worker holds.
Cyber & FraudLocation not specified in reportsHigh
Fake CEOs and bogus lawyers took $129 million from businesses, three accused
Reports describe a trio accused of using deepfake versions of chief executives and bogus lawyers to scam businesses out of $129 million. The case was covered by BankInfoSecurity and Help Net Security.
Why it matters. The CEO, CFO, family office controller and the family's attorneys are exposed whenever a payment request arrives by voice or video that looks like a principal. Adding a lawyer to the story is the part staff are least likely to challenge.
What to do
Set a code word or call-back rule for any wire request made by voice or video.
Verify any new lawyer or escrow contact through an existing, independent channel.
Singapore seizes a long-stay cruise ship after creditors win a court order
Singapore port authorities seized the Odyssey, a ship sold as a multi-year voyage, after creditors obtained a court order, according to the Financial Times. The Financial Times says it had dumped passengers in Cambodia, and the BBC reports the trip ended because the operator ran out of money.
Why it matters. Families and executives who book long-stay voyages, charters or any vessel-based travel are exposed if the operator's finances fail mid-trip. Check the operator's standing and a fallback plan for guests, children and crew before departure.
What to do
Confirm the finances and insurance of any voyage operator before booking.
Hold a fallback plan and funds for getting guests home from any port.
Ebola screening and health declarations now apply on arrival in Côte d'Ivoire
The UK Foreign Office published new information on Ebola screening and health declarations for people arriving in Côte d'Ivoire. The update appears on the country's entry requirements page.
Why it matters. Executives and families traveling to Côte d'Ivoire should expect health paperwork and screening on arrival, which can delay a schedule. Travel planners and family offices should build that time in.
What to do
Complete the health declaration ahead of departure and carry a copy.
Check the Foreign Office entry requirements again before wheels-up.
The FBI and Nvidia's own board are examining the Nvidia chief's relationship with an alleged Chinese spy, and the company's shares fell on the news. (BBC News · BBC News)
France blames Iran for a cyberattack that spoiled food in hundreds of supermarkets by heating fridges and freezers, and the French foreign minister summoned the Iranian ambassador. (The New York Times · BBC News)
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence of active exploitation, so patching teams should review the list. (CISA)
President Trump says further US attacks on Iran are highly unlikely, while the US has pulled aircraft from a second UK military base after an Iran threat. (BBC News · Financial Times)
One thing to do today
Put call-back verification on every wire request
The two fraud cases in today's brief share one weakness: money moves on a message that looks routine. SAG's Family Verification Protocol sets call-back, code-word and approval steps for wires, vendor changes and voice or video requests, and SAG can put it in place for your family office and household staff. Book a private call and we will start with your payment workflow.
