Wealthtech
Wealthtech Fraud and Account-Takeover Intake Guide
Fraud and account-takeover intake should reduce further harm, preserve what the investor reports, and reach the right owner without promising asset recovery.
Begin with calm safety questions
An investor reporting a scam or account takeover may be distressed, coerced, or still communicating with an impersonator. Follow the firm’s urgent script, ask whether contact or unauthorized access is ongoing, and direct the customer to an approved protective channel. Do not tell them to confront the suspected actor, send more funds, install remote software, share a screen, or disclose credentials. Treat “I did not authorize this,” “I was tricked,” “the trade is not mine,” and “the account changed” as customer statements, not final legal or fraud findings.
Preserve facts without secrets
Capture the customer’s chronology, account or case reference when appropriate, activity and date as reported or shown by an authorized source, contact channels used by the suspected actor, device or profile changes, prior actions, verification state, and safe follow-up. Keep screenshots and original messages in approved evidence channels. Never request passwords, one-time codes, full account numbers, or remote access. Mark every fact’s source so security, fraud, operations, custody, compliance, legal, and supervisory reviewers can distinguish customer statements from system observations.
Route by harm and authority
Active takeover, identity theft, impersonation of a professional, unauthorized trading or transfer allegation, vulnerable-investor risk, suspicious funding, sanctions or AML concern, and law-enforcement contact may require different routes. FINRA has described account-takeover and new-account fraud risks, while FTC and CFPB publish consumer scam resources. Front-line support should not decide whether conduct is fraud, whether an instruction was authorized, whether assets can be frozen or recovered, whether a filing is required, or whether the firm is liable.
Set honest action and recovery expectations
Possible action depends on account, firm, custodian, transaction, timing, facts, contracts, market conditions, law, and jurisdiction. Never promise trade cancellation, reversal, freeze, reimbursement, recovery, investigation result, or law-enforcement action. Tell the customer what was recorded, who accepted the case, which immediate approved step applies, and how follow-up will occur. Track urgent-route speed, evidence completeness, credential-disclosure attempts, repeat victimization signals, unsupported promises, abandoned handoffs, and corrections.
Build the control table
| Control | Support role | Authorized owner |
|---|---|---|
| Customer facts | Capture minimum necessary information | Validate identity and record |
| Explanation | Use dated approved sources | Approve policy and wording |
| Consequential action | Preserve request and route | Decide or execute under procedure |
| Uncertainty | State limits and escalate | Investigate and respond |
Govern knowledge and human handoff
Every answer should point to a dated, owned source. Separate firm policy, account-specific facts, public education, professional communications, legal obligations, and customer statements. Require qualified review for recommendations, professional roles, custody, trading, performance, fees, fraud, identity, privacy, security, accessibility, pricing, and jurisdiction questions. Log the knowledge version, verification state, authority boundary, receiving owner, and customer confirmation. A generated summary helps only when its provenance can be checked and the authorized destination accepts the case.
Test privacy, resilience, and accessibility
Collect the minimum information needed in approved channels. Define access, retention, redaction, recording, consent, export, deletion, and card-data controls. Provide accessible interaction, error recovery, a human alternative, and reviewed language support without inventing a language count. Test outages, stale sources, integration failures, duplicate events, malicious prompts, attempted credential disclosure, and emergency handoff with synthetic data. Record limitations, owners, and rollback paths.
Apply scope and qualified review
This article provides general operational information, not legal, financial, investment, tax, securities, BSA/AML, sanctions, fraud, identity, custody, privacy, security, accessibility, or compliance advice. Firm, professional role, account, service, custodian, product, transaction, investor, agreement, jurisdiction, systems, and current law control. A configured conversational system may assist approved intake and routing, but this article does not claim LumiTalk gives recommendations or advice; acts as a broker, adviser, fiduciary, custodian, or transfer agent; enters or cancels trades; holds or moves assets; makes regulated, fraud, identity, sanctions, or AML decisions; guarantees performance, recovery, compliance, or timing; reads live account or portfolio state; or provides exact pricing, availability, language, or integration coverage.
Primary sources
Use current primary sources as the factual floor, then obtain firm, account, service, professional-role, product, and jurisdiction-specific qualified review. Regulatory Notice 20-32 · Investment Scams · Fraud and scams · NIST SP 800-63-4 Digital Identity Guidelines
Continue through the Wealthtech cluster
Use the hubs and service page for cluster context, then compare adjacent guides before implementing a workflow. Wealthtech resource hub · Fintech resource hub · LumiTalk for wealthtech operations · Wealthtech Customer Support: Operations Guide · Wealthtech Account Access and Identity Support · Wealthtech Customer Support Software Checklist
Quick answers
Frequently asked
What should wealthtech fraud support do first?
Use the firm’s urgent safety route, reduce further disclosure, preserve the report, and reach the authorized fraud or security owner.
Can support cancel an unauthorized trade or transfer?
Do not promise action; available steps depend on the account, firm, custodian, transaction, timing, facts, and authorized procedures.
Can support guarantee recovery?
No. Outcomes depend on the facts, market activity, providers, contracts, law, jurisdiction, and qualified decisions.
Where can investment scams be reported?
Use firm-specific routes and reviewed official options such as SEC tips or complaints, FTC ReportFraud, FINRA contacts, and appropriate law enforcement.
Wealthtech Fraud and Account-Takeover Intake
Map one customer journey, its approved source, authority boundary, owner, evidence, and safe handoff before expanding.
