Security details Book a security review

Verification for registered investment advisers

As AI Improves, Your Callback Stops Being Enough.

Cloned voices and hijacked inboxes let criminals pass the checks advisers rely on, and the request reaches your team sounding exactly like your client.

Trust Onion puts identity verification in an app branded as your firm. Don’t trust the voice. Verify the client.

Book a security review For security teams: how it’s secured
A Korean American man in his late 60s in a quarter-zip sweater stands in a sunlit kitchen, phone to his ear.
Voice match: passed Client
A man in his early 50s with a salt-and-pepper beard, in a charcoal blazer and open-collar light blue shirt, sits at his desk in a high-rise office with a city view, phone to his ear.
Adviser
INCOMING CALL · HENRY CHO “Marcus, it’s Henry. I emailed you the wiring instructions for the condo. It has to go today, and don’t mention it to Susan. It’s a surprise.”
LEAD ADVISER “Got your email, Henry. I’ll send it to the custodian this morning.”

The next call from him might not be him.

The ground shifted

Confirm it’s your client, even when every check passes

An attacker who controls your client’s inbox and phone number, and has cloned his voice, can pass each check below.

Your firm already confirms requests by email and calls back the number on file. AI adds the voice: a clone built from about 15 seconds of audio, from a voicemail greeting or a family video, can sound like your client. When the number has been moved, your callback reaches the attacker.

  1. The inbox

    A phishing link or a reused password gives the attacker your client’s email. They read years of messages with your firm, then send wiring instructions from his real address.

    • Email confirmation: incorrectly passed

  2. The number

    A SIM swap, a carrier port-out or call forwarding moves the client’s phone number, so caller ID matches and your callback reaches the attacker.

    • Caller ID: incorrectly passed
    • Callback: incorrectly passed

  3. The voice and the answers

    About 15 seconds of audio can be enough to clone a voice, and the answers to security questions sit in breached data and social media.

    • Voice recognition: incorrectly passed
    • Security questions: incorrectly passed

  4. The request

    An urgent wire to a new title company, outside the usual pattern, with his wife left out.

    • Every check incorrectly passed
It was never him

What are the words?

Each device generates the three words locally. They rotate every 60 seconds, out of reach of anyone holding only the inbox and number.

Demo brand
Halden Park Advisors
Money movement approvals

#4127 · $385,000 · Scottsdale condo closing

Henry Cho (phone) · Account: Cho joint brokerage

Caller verification
Live words
Demo brand
9:41
Halden Park
Client Verification

CHO HOUSEHOLD

Rotates every 60 seconds, generated on this phone

Your adviser will ask: What are the words?

  • ADVISER · WIRE REQUEST The three words, on the wire request.
  • CLIENT · HENRY’S PHONE The same three words, on his phone.
  • EVERY 60 SECONDS Both change at the same moment. A caller holding only his inbox and number doesn’t have them.
Henry’s phone and the adviser’s wire request show the same three words, changing together every 60 seconds.

Both directions

Your clients can verify your firm, too.

Attackers impersonate clients to move money, and they impersonate advisers to get clients to share logins or “move funds to a safe account.” The same three words cover both calls.

The same three live words verify the client calling the firm and the firm calling the client. Family members in the household group also verify each other.

When the client calls the firm

Your firm verifies the client

Your adviser asks, “What are the words?” The client reads all three from their Halden Park ID Verify app, and your adviser checks them on the request before acting.

When the firm calls the client

The client verifies your firm

The client asks, “What are the words?” Your adviser reads all three from the firm’s view, and the client checks them in their app before sharing anything.

“Susan, it’s Marcus. We’ve flagged fraud on your account and need to move your funds to a safe account today.” If Marcus can’t give the words, Susan hangs up and calls the number she knows.

Inside the household

The family verifies each other

Henry and Susan’s daughter Emily is in the same group. When “Emily” calls from a new number asking for money, Henry asks for the words.

The rule never changes: whoever places the call says the words. Whoever answers checks them.

What’s at stake

Protect the relationship a single wire could end

The cost of one misdirected wire reaches well past the wire itself.

A woman in her early 40s with dark hair pulled back, in a navy blazer, sits at a white desk in a bright office, phone to her ear, reviewing a document on her monitor.
  • The savings. A forged request moves a client’s retirement money on your firm’s instruction. The custodian may not reimburse a transfer your team approved, and many policies cap social engineering losses below the size of a single wire.
  • The relationship. Years of trust, and often the next generation’s assets, can turn on one call your team acted on.
  • The exam. A loss becomes a question for your CCO, your carrier and the SEC: what was your written procedure, and did your team follow it?

The new standard

Verify every request in seconds, and escalate any doubt

Your adviser matches three live words against the request in one question. For doubtful requests, a signed live selfie adds proof, and your dual approval and the custodian’s checks still run before funds move.

  1. The client calls. His device generates three live words in your firm’s app, and the words rotate every 60 seconds.

  2. Your adviser sees the same words. They appear on the request in the firm’s view.

  3. The client confirms. Your adviser asks “What are the words?” and he reads them aloud.

  4. Any doubt, a Proofie™. Your adviser requests a live selfie, signed by his passkey after a Face ID, fingerprint, or passcode check. The signature covers the exact photo plus the time and place, and any edit breaks verification.

Demo brand
9:41
Halden Park
Client Verification

CHO HOUSEHOLD

Cobalt Lantern Orion

New words in 42s

Rotates every 60 seconds, generated on this phone

Your adviser will ask: What are the words?

Steps 1 to 3
Demo brand
9:41

Proofie™ request

Your Halden Park adviser asked for a Proofie™ to confirm a request.

Take a live selfie. Your passkey signs it after Face ID, fingerprint, or passcode.

Take Proofie™
Step 4: the request
Demo brand

Face ID unlocked the key

Henry Cho takes a Proofie selfie while a face scan maps his face.

Fingerprint watermark

Proofie™

HPx4…k2Qd

Signed with
Passkey (P-256)
Not before
Arbitrum One #473,604,118
Place (signed)
Pasadena, California
Owner controls
Password protected · Delete any time

Verified by Halden Park

Step 4: verified

Swipe for the next screen

Inside your approvals

Verification becomes the first step of every phoned-in money movement

When a client asks to move money, the three live words appear on the request in the firm’s view. Your adviser asks one question, confirms the match, and the request goes to your second approver with the check recorded, before anything reaches the custodian.

Nothing replaces your callback, your dual approval or your custodian’s own checks. The second approver sees the request was verified before they sign off, and when your policy calls for it, your adviser requests a Proofie™ from the same screen.

Demo brand
Halden Park Advisors
Money movement approvals

#4127 · $385,000 · Scottsdale condo closing

Henry Cho (phone) · Account: Cho joint brokerage

Caller verification
Live words
Cobalt Lantern Orion
New words in 42s

Ask: What are the words?

Request Proofie™
Confirm match Verified
Second approver
Nadia Haddad Chief Compliance Officer Awaiting approval
Send to custodian
Locked until approved

Marcus: What are the words?

Henry: Cobalt Lantern Orion.

Security you can verify

Your CCO and IT provider can test each security claim below

Each box below links to its source or to a review with us, so your team can test what we say.

Why it works

Nobody in the middle can see or fake the words

Not us, not your IT team, and not a hacker who breaks into our servers. Only the client’s phone and an adviser device your firm has enrolled ever see the real words.

Client’s phone

Sees the live words

Sealed enclave

Hardware-sealed. No one can log in, look inside or change the code.

Key vault

Opens only for the approved code

Code fingerprint match

Enrolled adviser device

Sees the live words

  • Hardware-backed key
  • Enrolled by you, more than one approver

Locked out: can’t read or forge the words

  • Trust Onion engineers
  • Your IT team
  • A hacker on our servers

  1. The words are made in a sealed box

    The words are created and unlocked only inside a hardware-sealed compartment in the cloud, called an enclave. Nobody can log into it, look inside or change what runs there, including us.

  2. The key only works for the approved software

    The encryption key lives in the cloud provider’s key vault, and it opens only for that sealed box running the exact version of the code that was published. If anyone changes a single line, the key stops working.

  3. We locked ourselves out on purpose

    Our own engineering account is explicitly blocked from decrypting anything. We can deploy and run the system, but we can’t read or forge the words. Even a rogue employee or a breach of our servers gets nothing usable.

  4. Staff need an enrolled device, not just a password

    Your advisers can see a client’s words only on a device your firm has enrolled with hardware-backed keys. A stolen password alone isn’t enough.

  5. You control who gets enrolled

    Staff enrollment is signed with a key your firm holds, and it needs more than one person to approve it. We can’t quietly add a staff member.

  6. Checkable, not “trust us”

    Your security team can rebuild the software themselves and confirm it produces the exact same fingerprint the key is tied to. They can verify it without relying on us.

Designed so that no one in the middle, including us, can read or forge the words, and you can verify that yourself.

This design is covered by U.S. and international patent applications, filed and pending.

The signature includes a recent public block hash, a value no one could know in advance, which shows the photo was taken after that moment. Nothing is written to a blockchain.

Read our privacy policy and terms.

For your clients

Your clients carry a safety app that bears your firm’s name

Clients get a verification app in your firm’s name, published under your own App Store and Google Play accounts. We build, submit, and maintain it.

  • A welcome screen in your brand. The first thing your clients see is your firm’s name and logo.
  • Set up in a review meeting. Your adviser invites the client, and the app opens ready, with the firm already in the group.
  • A group for every household. Everyone in a group shares its three words, the same ones your adviser sees. Families can also set up their own groups for calls between themselves.
  • A welcome letter on your letterhead. It introduces the app and the one question that now runs both ways.
On the left, Emily, in her mid 30s, calls from a city sidewalk with her phone to her ear. On the right, her father Henry answers at home, phone to his ear, asking for the words.
Demo brand
9:41
Halden Park

Welcome to Halden Park ID Verify

When you call us, three words confirm it’s you. When we call you, ask us for them.

Get started
Demo brand
9:41

Your group

Cho household
  • You
  • Susan
  • Emily
  • Ben
  • Marcus (Halden Park Advisors)

Everyone in this group sees the same three words.

Invite family

Swipe for the next screen

Demo brand

Dear Henry and Susan,

When you call us about a transfer, a withdrawal or a change to your accounts, we will now ask one question: “What are the words?” The answer is in Halden Park ID Verify, our app for your phone, which shows three words that change every 60 seconds.

It works the other way, too. When someone calls you from Halden Park, ask them for the words. If they can’t give them, hang up and call us on the number you know.

This adds to the safeguards you already know. Our callbacks, our approvals and your custodian’s protections all stay in place.

Warm regards,

Marcus Bell, CFP
Founder, Halden Park Advisors

Scales with the risk

Match the check to the risk your policy defines

Your verification policy sets the thresholds, and we help your CCO write it. Your adviser escalates to a Proofie™ when a threshold or trigger applies.

Set by your verification policy

Routine requests

The three words, on every call your policy treats as routine.

When all apply

  • Below your threshold
  • An account on file or a standing instruction
  • No recent change to address, phone, email or bank
  • No urgency or secrecy
  • The client is reachable as usual
  • Given promptly and correctly
  • Nothing feels off

Three words

Set by your verification policy

Elevated requests

The three words and a Proofie™, whenever your policy’s triggers apply or anything feels off.

When any applies

  • Above your threshold
  • A new payee, a third party or a new title company
  • Contact or bank details changed recently
  • Urgency, or a request to keep a spouse or adviser out
  • The client is traveling or calling from a new number
  • Slow, wrong or refused
  • Anything feels off

Three words + Proofie™

At both tiers, your callbacks, dual approval and the custodian’s checks still run, as your policy sets them.

The return

Turn your top risk into a procedure your team can follow

8 in 10 RIAs call wire fraud and social engineering a major risk 71% of funds transfer fraud insurance claims began with social engineering (Coalition, 2025 claims) $100,000 a typical social engineering sublimit, less than many single client wires

Sources: Golsan Scruggs 2025 Risk Survey; Omega Systems, 2025 Financial Services Cyber Resilience Report.

  • Verified identity. Three words and a Proofie™, for calls where voice, caller ID and email can all be faked.
  • A check your team can trust. One question replaces a judgment call about whether a voice sounds right.
  • Past the callback. When the number itself is moved, a callback reaches the attacker. The three words never do.
  • A procedure you can show. It supports the written verification procedures that Regulation S-P and S-ID expect. Your CCO decides how it fits your policies.
  • Clients who feel looked after. A safety app in your firm’s name, for the client, the spouse and the next generation.
  • Proof for your carrier. Many policies pay a social engineering claim only if the firm can show it verified the request. The three words give your team a step it can point to.

Questions

What RIAs ask us first

How does an RIA verify a client on a phone call?

Your firm and the client share three words that rotate every 60 seconds in an app branded as your firm. When the client calls, your adviser asks “What are the words?” and checks the answer before acting. A voice clone can copy how the client sounds, but not the three words on their phone.

Does this satisfy Regulation S-P or Regulation S-ID?

No product satisfies a rule on its own. Trust Onion supports the written verification procedures those rules expect, and your adviser’s check appears on the request your second approver signs. Your CCO decides how it fits your policies.

We already call back the number on file. Why add this?

Because the number can be moved. A SIM swap, a port-out or call forwarding sends your callback to the attacker. The three words are generated on the client’s phone and still hold when that happens. Your callback stays in place.

Does it replace our custodian’s verification?

No. Your custodian keeps its own checks. The three words come first, before your team sends any instruction to the custodian.

Will our insurance cover a wire sent to a fraudster?

Often only in part. Social engineering coverage usually comes as an extension with a sublimit, often around $100,000, and some policies ask you to show you verified the request before a claim pays. Ask your carrier how a written verification procedure fits your policy.

Many of our clients are in their 70s. Will they use it?

Your adviser sets it up with them in a review meeting, and the app opens ready, with your firm already in the group. After that, they answer one question. Family members can join the household group to help.

Who can see the words, the keys and Proofies™?

Your team sees the current words, never the key. Each group key sits in a secure enclave on the deployment server and on each client’s phone. Proofies™ are private by default for family offices. A Proofie™ your team requests is shared with your office and no one else.

Whose name do clients see?

Your firm’s. The app carries your firm’s name and logo, published under your own App Store and Google Play accounts.

Next step

Make the next money movement call a little more certain

Send this page to your CCO and your IT provider, then book a review with us before you decide.

Your team can test how the three words and Proofies™ work, and where your callbacks, dual approval and custodian checks fit.

“Before anything goes to the custodian: what are the words?”

Book a security review
Talk to a human: