Cybersecurity and privacy for high-net-worth families in Switzerland

High-net-worth families are prime targets for targeted cyber attacks. Not because their IT systems are deficient — but because the information that concerns them has high value: names of family members, bank accounts, holding structures, travel schedules, professional relationships, data about minor heirs. This information is often dispersed, sometimes public and constitutes the raw material for sophisticated attacks.

This article focuses on threats targeting family members as individuals — distinct from institutional threats against digital tools and platforms (covered in our article on the digital family office).

Threats specific to high-net-worth families

Targeted spear phishing

Unlike mass phishing — bulk distribution of generic fraudulent emails — spear phishing is a personalised attack. The attacker collects public information about the target (LinkedIn, local press, commercial register, children's social media) and crafts a convincing message impersonating a trusted contact.

Typical examples:

• An email purportedly from the usual banker, asking to confirm account information
• A message appearing to come from a family member abroad, reporting a financial emergency
• An invitation to a charitable or professional event, containing a malicious link or attachment

The sophistication of these attacks has increased considerably with artificial intelligence, which can generate messages in the exact language, style and register of the person being impersonated.

Family identity fraud

Data that characterises a family — members' names, dates of birth, addresses, relationships — can be used to impersonate family members with banks, lawyers or other service providers. This fraud is particularly dangerous when it targets minor heirs, whose information is less monitored.

Protecting the identity of children and young adults is an often-neglected angle of family cybersecurity. An heir who enters adulthood with a compromised identity may face serious difficulties: credit refusals, fictitious criminal records, accounts fraudulently opened in their name.

Social engineering against household members

Attackers do not always target the head of the family directly. They sometimes attack more vulnerable members: a spouse unfamiliar with financial transactions, teenage children active on social networks, household staff with access to sensitive information. These indirect vectors can provide information or access that enables the attacker to reach the primary target.

Compromise of family data

A family's patrimonial structure — who owns what, in which structure, with which mandataries — is high-value information. Its unwanted disclosure can facilitate targeted attacks, extortion attempts, opportunistic litigation or unwanted commercial approaches.

This information circulates in many documents: contracts, bank correspondence, tax returns, notarial deeds. The question is not only to protect it in IT systems, but to control who has access to it in real life.

Swiss data residency and the FADP

The new Federal Act on Data Protection (nFADP), which entered into force in September 2023, strengthens individuals' rights over their personal data and the obligations of entities that process it. For a high-net-worth family, this means they can require their Swiss service providers to:

• Document personal data held
• Correct or delete inaccurate or unnecessary data
• Notify in the event of a data breach

A preference for service providers hosting their data in Switzerland (or at least in the EU/EEA, subject to GDPR) is a prudent practice, particularly for sensitive patrimonial documents.

Best practices for high-net-worth families

For each family member:

• Two-factor authentication (2FA) on all critical accounts (email, online banking, cloud storage)
• Systematic vigilance in the face of urgent requests received by email or instant messaging — verify by direct phone call before taking any action
• Unique, strong passwords (password manager)
• Caution on social networks: limit public information about family structure, travel and purchases

For the family as a whole:

• Establish a verification protocol for unusual transfer requests (confirmation call via a secondary channel)
• Regularly raise awareness among all family members — including younger ones — about social engineering risks
• Centralise sensitive documents in a secure storage space with managed access rights
• Define who in the family has access to what information

The family office's role

The family office is not a cybersecurity provider. Its role in this area is to:

• Raise awareness among family members of the risks specific to their profile
• Maintain centralised and secure documentation of sensitive patrimonial information
• Coordinate with banks and service providers to ensure identity verification protocols are in place
• Alert clients to unusual contact attempts that are reported to it

Cybersecurity is a shared responsibility: tools and protocols are necessary, but the vigilance of individuals remains the first line of defence. To discuss these challenges in the context of your family situation, we invite you to a confidential meeting.

References

• FDPIC – FADP
• Fedlex – nFADP
• NCSC – National Cyber Security Centre
• FINMA – Operational risks
• UBS – Family Office Solutions