Security details Book a security review

Family office verification

As AI Improves, the Family’s Risk Compounds.

Cloned voices and faces now target high-net-worth families and the offices that act on their behalf.

Trust Onion puts identity verification in an app branded as your office. Don’t trust the voice. Verify the family.

Book a security review For security teams: how it’s secured
A woman in her late 50s with dark, shoulder-length hair stands on a hotel terrace above a lake, holding a phone to her ear.
Voice match: passed Principal
A man in his early 50s in a tailored jacket sits at a walnut desk in a quiet private office, phone to his ear.
Family office
INCOMING CALL · MAYA WHITCOMBE “James, it’s Maya. I need the Montecito wire sent today. Don’t loop in Martin, I’ll explain later.”
HEAD OF FAMILY OFFICE “Of course, Maya. I’ll set it up now.”

The next call from her might not be her.

The ground shifted

Confirm it’s the principal, even when every check passes

An attacker who controls the principal’s inbox and phone number, and has cloned her voice, can pass each check below.

Your office already guards inboxes, devices and travel plans. AI adds the voice: a clone built from about 15 seconds of public audio, from a gala speech or an interview, can sound like the principal. Recognizing her voice was the check your team trusted most, and it no longer holds on its own.

  1. The inbox

    A phishing link or a reused password gives the attacker the principal’s email, so email confirmation passes and her calendar shows when she is traveling.

    • Email confirmation: incorrectly passed

  2. The number

    A SIM swap or carrier port-out moves the principal’s phone number, so caller ID matches and a callback reaches the attacker.

    • Caller ID: incorrectly passed
    • Callback: incorrectly passed

  3. The voice and face

    About 15 seconds of public audio can be enough to clone a voice, and a video call can be faked the same way.

    • Voice recognition: incorrectly passed
    • Video call: incorrectly passed

  4. The request

    An urgent wire to close a property, outside the usual pattern, with the attorney left out.

    • Every check incorrectly passed
It was never her

What are the words?

Each device generates the three words locally. They rotate every 60 seconds, out of reach of anyone holding only the inbox and number.

Demo brand
Whitcombe Family Office
Wire approvals

#2291 · $1,800,000 · Montecito closing

Maya Whitcombe (phone)

Caller verification
Live words
Demo brand
9:41
Whitcombe
Family Verification

WITH THE OFFICE

Rotates every 60 secondsGenerated on this phone

Your office will ask: What are the words?

  • OFFICE · WIRE APPROVAL The three words, on the wire request.
  • PRINCIPAL · MAYA’S PHONE The same three words, on her phone.
  • EVERY 60 SECONDS Both change at the same moment. A caller holding only her inbox and number doesn’t have them.
Maya’s phone and the office’s wire request show the same three words, changing together every 60 seconds.

Every direction

The family can verify your office, and each other.

Attackers impersonate the principal to move funds, impersonate the office to get family members to share access or approve payments, and impersonate family members to each other. One app covers every one of those calls.

The same three live words verify the family calling the office and the office calling the family. Family members also verify each other in their own groups, with words the office never sees.

When the family calls the office

Your office verifies the family

Your team asks, “What are the words?” The family member reads all three from their Whitcombe ID Verify app, and your team checks them on the request before acting.

When the office calls the family

The family verifies your office

The family member asks, “What are the words?” Your team reads all three from the office view, and the family member checks them in their app before sharing anything.

“Theo, it’s James from the office. I need you to confirm your bank login.” If James can’t give the words, Theo hangs up.

When the family calls each other

Family members verify each other

The family runs its own groups in the same Whitcombe ID Verify app, with three words your office never sees. When Theo calls his father from a new number asking for help, Daniel asks, “What are the words?” before he does anything.

The rule never changes: whoever places the call says the words. Whoever answers checks them.

What’s at stake

Protect the trust a single wire could break

The cost of one misdirected wire reaches well past the wire itself.

A woman in her early 40s in a charcoal blazer sits at an oak desk in a quiet office, phone to her ear, reading a printed document with a pen in hand.
  • The funds. A forged request moves the family’s funds on your office’s authority, to an account nobody in the family chose.
  • The trust. Years of confidence between the family and the office can turn on one call your team approved.
  • The privacy. A fraud claim can bring lawyers, insurers and sometimes the press into the family’s affairs.

The new standard

Verify every request in seconds, and escalate any doubt

Your team matches three live words against the request in one question. For doubtful requests, a signed live selfie adds proof, and your dual approval still runs before funds move.

  1. The principal calls. Her device generates three live words in the office’s app, and the words rotate every 60 seconds.

  2. Your team sees the same words. They appear on the request in the office view.

  3. The principal confirms. Your team asks “What are the words?” and she reads them aloud.

  4. Any doubt, a Proofie™. Your team requests a live selfie, signed by her passkey after a Face ID, fingerprint, or passcode check. The signature covers the exact photo plus the time and place, and any edit breaks verification.

Demo brand
9:41
Whitcombe
Family Verification

WITH THE OFFICE

Emerald Anchor Orion

New words in 42s

Rotates every 60 secondsGenerated on this phone

Your office will ask: What are the words?

Steps 1 to 3
Demo brand
9:41

Proofie request

Your Whitcombe office asked for a Proofie to confirm a request.

Take a live selfie. Your passkey signs it after Face ID, fingerprint, or passcode.

Take Proofie
Step 4: the request
Demo brand

Face ID unlocked the key

Maya Whitcombe taking a Proofie selfie while a face scan maps her face.

Fingerprint watermark

Proofie™

WFc2…r8Tn

Signed with
Passkey (P-256)
Not before
Arbitrum One #472,918,305
Place (signed)
Lake Como, Italy
Owner controls
Password protected · Delete any time

Verified by Whitcombe

Step 4: verified

Swipe for the next screen

Inside your approvals

Every phoned-in wire starts with verification

When a request comes in by phone, the three live words appear on it in the office view. Your team asks one question, confirms the match, and the request moves to your second approver with the check recorded.

Nothing replaces your dual approval or your bank’s callback. The second approver sees the request was verified before they sign off, and when your policy calls for it, your team requests a Proofie from the same screen. We set up the office view in our console or inside the tools your team already uses.

Demo brand
Whitcombe Family Office
Wire approvals

#2291 · $1,800,000 · Montecito closing

Maya Whitcombe (phone)

Caller verification
Live words
Emerald Anchor Orion
New words in 42s

Ask: What are the words?

Request Proofie
Confirm match Verified
Second approver
Adaeze Okafor Controller Awaiting approval

Caller check recorded · 9:41 AM

James: What are the words?

Maya: Emerald Anchor Orion.

Security you can verify

Your security team can test each security claim below

Each box below links to its source or to a review with us, so your security team can test what we say.

The signature includes a recent public block hash, a value no one could know in advance, which shows the photo was taken after that moment. Nothing is written to a blockchain.

Read our privacy policy and terms.

For the family

The family carries a safety app that bears your office’s name

Family members get a verification app in your office’s name, published under your own App Store and Google Play accounts. We build, submit, and maintain it.

  • A welcome screen in your brand. The first thing the family sees is your office’s name and crest.
  • Set up in a minute. Your office invites each family member, and the app opens ready, with the office group already set up.
  • A group for every relationship. The office shares a group with the family, and the family sets up its own groups for calls between themselves. Each group has its own three words.
  • A welcome letter on your letterhead. It introduces the app and the one question that now runs both ways.
Demo brand
9:41
Whitcombe

Welcome to Whitcombe ID Verify

When you call the office, three words confirm it’s you. When we call you, ask us for them.

Get started
Demo brand
9:41

Your groups

With the office

You, Daniel, Eleanor, Theo, James (family office)

Family only

You, Daniel, Eleanor, Theo, Asha

Each group has its own three words. The office only sees words for groups it’s in.

Invite family

Swipe for the next screen

Demo brand

Dear Maya and family,

When you call the office, we will now ask one question: “What are the words?” You’ll find them in Whitcombe ID Verify, our app for your phone.

It works both ways. When we call you, ask us for the words. Your family can also set up its own groups for calls between yourselves; we never see those words.

Our callbacks and approvals stay in place.

With warm regards,

James Holloway
Head of the Whitcombe Family Office

Three generations gather on a stone terrace at a long table in late afternoon light while Maya shows her mother something on her phone.

Scales with the risk

Match the check to the risk your office defines

Your verification policy sets the thresholds, and we help you write it. Your team escalates to a Proofie when a threshold or trigger applies.

Set by your verification policy

Routine requests

The three words, on every call your policy treats as routine.

When all apply

  • Below your threshold
  • Known payee, account and destination
  • No urgency or secrecy
  • The principal is reachable as usual
  • Words given promptly and correctly
  • Nothing feels off

Threshold: set by your verification policy

Three words

Set by your verification policy

Elevated requests

The three words and a Proofie, whenever your policy’s triggers apply or anything feels off.

When any applies

  • Above your threshold
  • New payee, account or destination
  • Urgency, or a request to keep advisors out
  • The principal is traveling or hard to reach
  • Words slow, wrong or refused
  • Anything feels off

Threshold: set by your verification policy

Three words + Proofie

At both tiers, your callbacks and dual approval still run, as your policy sets them.

The return

Close the gap between concern and confidence

83% of family offices are concerned about deepfakes or other impersonation threats 60% staff confidence in spotting AI-powered attacks, the lowest of any firm type surveyed 72% believe they are targeted more often because they manage high-net-worth assets

Source: Omega Systems, 2025 Financial Services Cyber Resilience Report.

  • Verified identity. Three words and a Proofie, for calls where voice, face, caller ID and email can all be faked.
  • A check your team can trust. One question replaces a judgment call about whether a voice sounds right.
  • A family that feels looked after. A safety app in your office’s name, for calls to the office and between generations.
  • Privacy, kept private. Fewer fraud claims means fewer lawyers, insurers and headlines in the family’s affairs.
  • Past the callback. When the number itself is swapped, a callback reaches the attacker. The three words never do.
  • A conversation with your carrier. A stronger verification record is worth discussing with your carrier.

Questions

What family offices ask us first

How does a family office verify the principal on a phone call?

The principal and the office share three words that rotate every 60 seconds in an app branded as your office. When she calls, your team asks “What are the words?” and checks her answer before acting. A voice clone can copy how she sounds, but not the three words on her phone.

Does it replace our callbacks and dual approval?

No. It adds a check before them. Callbacks fail when an attacker has moved the principal’s phone number, and the three words still hold when that happens. Your dual approval runs as it does today.

Can family members check that a call really comes from the office?

Yes. Whoever places the call says the words, and whoever answers checks them. If someone calling from “the office” can’t give the words, the family member hangs up and calls back on a number they know.

What if the principal is traveling or offline?

The words are generated on her phone and work without a connection, so they are there wherever she is.

Who can see the words, and where are the keys?

Your team sees the current words for the groups your office is in, never the key. Each group key sits in a secure enclave on the deployment server and on each member’s phone.

Whose name does the family see?

Your office’s. The app carries your office’s name and crest, published under your own App Store and Google Play accounts.

Can family members use it to verify each other?

Yes. The family sets up its own groups in the same app, each with its own three words, and your office never sees them. When a son calls his father from a new number asking for help, his father asks for the words before doing anything.

Where does our team see the words?

In our office console, or inside the tools your team already uses. We set up the connection during deployment.

Who can see a Proofie?

Proofies are private by default for family offices. A Proofie your team requests is shared with your office and no one else.

Next step

Make the next sensitive call a little more certain

Send this page to your security team, then book a review with us before you decide.

Your security team can test how the three words and Proofies work, and where your callbacks and dual approval fit.

“Before I send anything: what are the words?”

Book a security review