Phishing scams disguised as digital party invitations are giving cybercriminals a fresh way into the personal email accounts of high-net-worth clients – and from there, a potential path to their financial accounts, wealth managers and security specialists warn.
The Federal Trade Commission flagged the scheme in a May 2026 consumer alert. It said fake messages styled after platforms such as Evite and Paperless Post ask recipients to enter their email username and password to view event details. Once inside, scammers can take over the account and send the same bogus invitation to the victim's contacts, according to the FTC.
The broader numbers are moving in the wrong direction. The FBI's Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025, the most of any crime type, according to its 2025 Internet Crime Report, released in April 2026. Reported phishing losses roughly tripled to $215.8 million from $70 million in 2024, and total reported cybercrime losses hit a record $20.877 billion.
As Cybersecurity Awareness Month runs through October 2026, advisors say the invitation scam shows how criminals exploit the trust and crowded calendars of affluent families.
Steve Czocher, a partner, advisor and director of family office services at Chicago-based Gresham Partners, says wealthy clients are most exposed through personal email. The risk climbs when clients use older services such as Yahoo and AOL, or haven't turned on two-factor authentication. Because email is usually how passwords to financial accounts get reset, one compromised inbox can hand criminals a route to significant assets, he says.
"Accessing sensitive accounts on public Wi-Fi adds further risk. A VPN can help protect the connection, but it cannot prevent phishing or account takeover on its own," Czocher said.
Brian Francetich, director of Golsan Scruggs RIA, which provides insurance and risk management to investment advisory firms, says the circle of professionals around a wealthy family widens the target. Advisors, attorneys, accountants, private bankers and family office staff each represent another channel an attacker can impersonate.
"In many cases, the underlying technology isn't the primary issue. The challenge is that the communication appears legitimate enough for a reasonable person to trust it, and the bad actors continue to get better at this," Francetich said.
Heather Sweeney, strategic partner manager at BlackCloak, a digital executive protection firm based in Lake Mary, Florida, says many affluent families lack the safeguards at home that they rely on at work. Artificial intelligence is widening that gap. The FBI report counted 22,364 complaints referencing AI in 2025, with about $893 million in associated losses.
"Artificial intelligence has made these attacks even more dangerous by enabling criminals to impersonate family members, financial advisors and other trusted contacts with remarkable sophistication," Sweeney said.
"This is particularly concerning amid the generational transfer of wealth, as aging family members and younger generations may face different vulnerabilities. The reality is that trust itself has become a new security perimeter," she said.
Czocher says the most effective defense is a single, consistent way to exchange sensitive information. When clients know how their advisor will contact them, requests that arrive any other way are easier to question.
"At Gresham, we use secure email and a client portal to share sensitive documents and instruct clients to retain their login instructions through a password manager and use these services when sending confidential information. Employee preparation is equally important. Our cybersecurity training includes simulated phishing emails sent at random, often using topics designed to prompt an immediate response," Czocher said.
Francetich says today's phishing attempts rarely resemble the clumsy scams clients were trained to spot. Fraudulent emails, texts and websites now closely mimic real messages from banks, advisors, vendors and even relatives.
"Requests involving credentials, account changes, sensitive information, or movement of funds should be independently verified through another communication channel whenever possible. While security tools remain important, client awareness and verification procedures can significantly reduce the likelihood of a successful attack. We find that in the vast majority of cyber incidents there was a human judgement or trust error made," Francetich said.
He adds that some advisors now build personal know-your-client questions into verification calls – details about a client's family or shared history that an impostor would struggle to answer. Sweeney recommends a predetermined code word for any instruction to move money.
"Wealth advisors must emphasize the importance of independently verifying sensitive requests through trusted, previously established channels, regardless of how legitimate a message, phone call or video interaction may appear," Sweeney said.
The pressure is not only on clients. Advisory firms have faced their own wave of attacks, including the breach that prompted a second class action lawsuit against Mercer Advisors. And as InvestmentNews has reported, AI-powered cyberattacks are forcing RIAs to rethink client security, with criminals using a client's hijacked inbox to impersonate that client to the advisor.
Speed matters. Czocher says Gresham moves to lock down access and protect accounts immediately.
"We advise clients to change passwords immediately and enable two-factor authentication on frequently used applications, particularly those linked to financial accounts. We also help freeze their credit, restrict money movement at our primary custodian, and close affected accounts as needed. A coordinated response is essential," Czocher said.
Gresham also contacts the client's insurance agent to identify available coverage, brings in BlackCloak to help with mitigation, and alerts its own staff and the client's other service providers. Czocher says firms should have a response process in place before an incident, linking internal teams, insurers, cybersecurity specialists and outside providers.
Sweeney says clients with a compromised email account should reset the password, enable multifactor authentication and log out of all active sessions. If a device may be compromised, a cybersecurity professional should remove any malware, and clients should notify their financial institutions.
Fast action can recover money. The FBI's Recovery Asset Team froze about $679 million of roughly $1.16 billion in attempted theft across 3,900 incidents in 2025, a 58% success rate, according to the IC3 report.
For SEC-registered advisors, a documented plan is now a regulatory requirement as well as good practice. Smaller firms had until June 3, 2026, to comply with amendments to Regulation S-P, which require written incident response programs and client notification after certain breaches.
Francetich says advisors should also raise personal cyber insurance with wealthy clients, though coverage varies widely.
"In addition to the controls discussed above, advisors should make HNW clients aware of the personal cyber insurance that is now available. Often, these insurance programs have monitoring services and expert incident response teams on 'retainer' for insured households. It is also possible to cover many of the wire fraud and social engineering schemes through personal cyber insurance, but important to note that there is currently a wide variance between the insurers as to what is covered and what is not. This is definitely a buyer beware marketplace at this juncture," Francetich said.
For Sweeney, the issue is also a business opportunity for advisors willing to lead on it.
"Advisors who offer ongoing cybersecurity education and protection can become the go-to resource for clients seeking comprehensive guidance that extends beyond their financial well-being," she said.
New UMA, direct indexing and asset location capabilities aim to cut manual work for advisors managing personalized portfolios
As notetakers push into account opening, a consultant warns RIAs risk ‘buying redundancy’ instead of capability
The senior recruiter position at LPL Financial can lead to future success and industry leadership.
Hackers are already probing two bugs in software that runs most of the web. European Government and other major sites have already been taken down for emergency patches.
Unclaimed auto accounts can’t take family money, so advisors face questions on 529s, divorce terms, employer funding and stock gifts.
Knighthead Life entered the market with a competitive MYGA. A strong launch earned advisor confidence and paved the way for FIAs.
As AI makes financial information more accessible than ever, Lana Hock explains why human judgment, trust, and empathy remain the qualities clients value most in a financial advisor
