How does a federal investigation into a wealthy family start with a single email account? It usually starts with the person who schedules the dentist, pays the vendors, and keeps the Amex reconciled. The household assistant’s inbox is the switchboard for the entire estate, and when something goes wrong there, agents follow the wires outward into every other account the family owns.
Principals rarely see it coming. The assistant is trusted, long-tenured, often loved. Her inbox holds wiring instructions, trust distributions, aircraft charters, Rolodex contacts for private bankers, and the family’s calendar for the next six months. Compromise it, or misuse it from the inside, and a federal case can be built almost entirely from what’s sitting in the Sent folder.
The Insider Case: A Long-Trusted Assistant Who Started Signing the Checks
The most common federal case to come out of a family office is not a hacker in a hoodie. It’s the person who has had signatory authority, or something close to it, for years. Prosecutors like these cases because the paper trail is pristine.
The assistant used her own login, the forged signatures match the forged signatures, and the checks were cut from the account she was supposed to be guarding.The Justice Department has prosecuted exactly this fact pattern more than once. In one Eastern District case, a personal assistant pleaded guilty to defrauding an elderly wealthy couple of close to $10 million over roughly seven years, running forged checks and impersonating her employers to move money. The mechanics were mundane (email access, check stock, and time) even as the charges ran into the millions.
For the family on the other side of that case, the first sign of trouble is almost never a bank alert. It’s a subpoena to the household entity, or a visit to the accountant. By the time anyone asks the principal a direct question, agents have already read years of email. That’s why experienced federal defense counsel tell wealthy households to treat the assistant’s mailbox as a regulated environment, not a convenience, from the day the person is hired.
The Compromise Case: Someone Else Is Reading the Inbox
The second pattern looks different and ends in the same place. The assistant isn’t the target; her credentials are. A phishing email lands, a password gets reused, and a hidden forwarding rule routes copies of every wire confirmation to an address nobody at the office recognizes.
For weeks, no one notices. Then a large payment to a contractor lands in an account in another state, and the family learns what business email compromise actually is.
Family offices are a soft target for this and they know it. Industry analysis of the sector keeps coming back to the same point: one compromised mailbox in a household environment doesn’t stay contained. It cascades into financial fraud, identity theft, and in some cases physical risk to the principals, because the calendar, the travel plans, and the staff roster all live in the same account.
Once the FBI opens a BEC file, the inbox stops being the family’s property in any practical sense. Agents want headers, login IP logs, forwarding rules, OAuth tokens, and the full export of sent and deleted items. The assistant becomes a witness. The principal becomes a victim on paper and, if the money moved through a family entity with sloppy controls, a potential subject on a parallel track.
The Legal Mechanics Run Below the Radar
Families often assume investigators need a dramatic warrant to touch an inbox. The reality is more layered. Subscriber data, login records, and basic account information sit on the lowest rung and can be reached through a court order on a showing of specific and articulable facts that the records are relevant to an ongoing investigation. That standard sits below probable cause and well above a casual request.
Content, meaning the actual body of the emails, requires more. By the time a warrant is sought, though, agents usually know what’s in there, because the metadata told them. The assistant’s login times, device fingerprints, and the pattern of who she corresponded with on behalf of the family will often be the backbone of the affidavit. The content just confirms the story.
Treat the Mailbox Like the Vault It Already Is
The households that come through these investigations with the least damage share a few habits. Dual control on any wire above a set threshold, with callback verification to a known number. Separate mailboxes for calendar and finance, so one compromise doesn’t open everything.
Retention and legal-hold settings decided before anyone needs them, not after a preservation letter arrives. A written policy that the assistant signs on day one, and an exit protocol that revokes her access the same hour she walks out.
None of this stops every bad day. It changes what the bad day looks like. When agents eventually ask who had access to what, and when, the family that can answer in writing is in a very different conversation than the family that can’t. The inbox will exist either way. What the household did about it is the part that varies.
