Awareness is key to protecting your clients from fraud
Customer-facing staff across the financial services sector face a daily onslaught from con artists and fraudsters who go to extreme measures to compromise client accounts. These criminals, who are often part of organised criminal syndicates, use email, social media and telephones to perpetrate a range of nefarious activities spanning data compromise, lodging false insurance claims and outright theft from bank and investment accounts.
Ethical responsibilities
The recent Allan Gray Edge 2026 conference included an hour-long panel discussion on how fraud emerges in practice, and the ethical responsibilities that financial advisers have to prevent it. The asset manager’s IFA Proposition Manager, Taryn Duncan, was joined on the virtual stage by Senior Legal Advisor, Reo Emmett, and Manager in Discretionary Products Operations, Derwina Morar. These panellists encouraged advisers to consider every transaction request with client outcomes in mind.
Duncan opened the debate by asking whether protecting clients from fraud risk should go beyond compliance and operational aspects, to include ethical conduct. Emmett launched into a detailed explainer of the law of agency, saying that advisers, as agents of their clients, had a duty of good faith to those clients. “As an adviser or any sort of agent, you are not meant to act as a post box or rubber stamp; you are meant to apply your mind reasonably,” he said, before encouraging advisers to “slow down and think” before acting, even on an urgent client instruction.
Morar noted that compliance was not enough to prevent issues at an advice or operational level. “We often think of fraud as someone trying to withdraw funds from an account, but fraudsters are getting brave and even posing as the client nowadays,” she said. The importance of FIC and KYC emerged from this section of the debate. Both are excellent tools to test whether the cash flows and transactions being proposed by clients match their circumstances. It is important to verify information and double-check against file entries wherever possible.
Prevailing fraud themes
The panel moderator asked Morar to talk through some prevailing fraud themes and comment on rising incidences of estate late fraud, a title no doubt ‘lifted’ from a 2024 Association for Savings and Investment South Africa (ASISA) working group tasked with tackling fraud around deceased estates. “There is often a calculated effort to cut off the client from communication, and we have seen that emerge as quite a theme,” Morar said. Clients who are in the dark about what is happening do not question instructions with either adviser or product supplier.
The modus operandi is for fraudsters to compromise communication routes, then reach out to customer services agents to change bank accounts and then initiate a fund withdrawal request. “The fraudsters are able to open a legitimate bank account using a copy of the client’s ID,” Morar said, commenting on the operational challenges faced by support staff. As soon as a fraudulent withdrawal is processed, the money is simply moved out of that account. The problem is that the client has no idea this bank account exists.
Another common trend involves email interception at the adviser or client side, typically preceding a payment instruction. In practice, the fraudsters will monitor legitimate back-and-forth communication between adviser and product supplier or adviser and client, before intercepting the final payment instruction and changing the bank details contained therein. “Fraudsters are patient; I have seen months-long email trails in which they pretend to be financial advisers giving advice,” Morar said.
Phishing and smishing on the rise
SIM swaps were briefly mentioned, as were phishing (by email) and smishing (by SMS or WhatsApp) attacks aimed at luring clients to cloned websites and / or convincing them to part with important personal information via email, online forms or telephone calls. Attackers can masquerade as your client’s bank or the South African Revenue Service (SARS) or a courier company, or whatever, and always create some form of urgency around a cash windfall or crisis.
They may promise an unexpected SARS repayment or warn of a bank account compromise that requires your immediate attention. They use panic in combination with a compromised communication channel to lure clients in. “Your client calls the number in the email or SMS thinking they are talking to a trusted employee of a company, but they are not,” Morar said. Fraudsters use emotion and vulnerability to press your clients to compromise bank or investment account login details and then perpetuate fraud from there.
In the ‘estate late’ context, the asset manager often encounters fraudsters impersonating executors and trying to lodge false claims. “We see fraudulent copies from the Master’s office coming through as well,” Morar said. In summary, she noted that each of the fraud themes started with “some form of compromise on the client’s side” before the perpetrator leveraged that compromise to maximise their criminal reward. A trusted adviser is often best placed to prevent these attacks.
An industry built on trust
“The financial services industry runs on trust … and that is why these frauds are really problematic,” noted Emmett. He said that ethical lapses in contravention of the FAIS Code of Good Governance and Fit and Proper contributed to fraud and other risks. This explains why the regulator is so keenly focused on regulating behaviour across the financial services value chain. The legal advisor then shared a few examples of fraud-related court rulings that will give the compliance teams at advice practices and product suppliers sleepless nights.
In the first case, a fraudster intercepted email communication between the parties and sent altered banking details to the conveyancer. “The conveyancer made payment without any formal verification or double-checking with the client,” Emmett said, before transferring the money into a bank account opened by the fraudster, rather than to the intended recipient. The court found the conveyancer liable for the loss, holding that the payment had not been properly made.
In the second matter, dubbed the law firm case, the client’s email was again compromised. The fraudsters intercepted a legitimate instruction from the law firm, amended the payment details on that instruction, and on-sent this to the client from a domain that was very similar to that of the law firm. The client then made payment into the fraudster’s account.
Initially, the High Court found the law firm liable, saying that the law firm owed the client a duty of care. “This case was taken on appeal, and the Supreme Court of Appeal found that the law firm was not liable,” Emmett continued.
An advice-related case
Finally, in an advice-related matter, again involving a compromised email account at the client side, the High Court ordered a financial services provider (FSP) to reimburse its client. In this matter, the client sent an email with proof of banking details to the FSP; but there were some discrepancies relating to the time the account had been open. The FSP in question did its own bank account verification but still went ahead with a payment. “There was a clear contradiction that should have set the alarm bells ringing,” Emmett said.
To make matters worse, the FSP’s internal policy required independent verification of bank account changes with the client, using contact details on file. This never happened. As is typical in these types of fraud, emotion and urgency contributed to a lapse in ethical reasoning. “This case speaks to the importance of the policies that you have in place,” concluded Duncan, before encouraging advisers to be aware of their internal practices, and apply them to the letter.
Writer’s thoughts:
Fraud often succeeds because people miss the warning signs. Are your internal processes adequate to identify suspicious instructions before client money is paid out, and what additional checks and balances are you considering? Please comment below, interact with us on X at @fanews_online or email us your thoughts [email protected].
