Ask the COO of a New York RIA how the staff did on last quarter's phishing simulation, and you will get a click rate, a trend line, and possibly a slide with a tasteful bar chart. Ask what their clients would do if a voice that sounded exactly like their advisor called on a Friday afternoon to confirm a wire, and the room gets quiet enough to hear the HVAC.
It is a gap I see constantly. Firms have spent years hardening their own people and systems. Meanwhile the client, the person who holds the login, answers the phone, and approves the money, gets a privacy notice and a firm handshake.
The data backs this up. In the Schwab 2024 RIA Benchmarking Study, 97% of firms with $250 million or more in assets under management (AUM) reported having employee cybersecurity training in place. Only 57% reported client education, the lowest rate among the security practices Schwab highlighted. Cyber insurance came in at 91%. Apparently it is easier to buy a policy than to have a slightly awkward conversation.
My argument is that client education belongs inside your compliance program, written, delivered, and documented like any other control. For New York firms serving well-known clients, it belongs there now.
The 40-Point Gap Nobody Writes Into the Compliance Manual
A quick note before anyone forwards this to their data team. Schwab fielded the survey in early 2024, the 57% figure covers larger firms only, and the answers are self-reported. Even with those caveats, the shape of the problem is clear.
Nearly every firm has trained its staff to check IDs at the front door. About four in ten have never mentioned to the people holding their own set of keys that strangers might ask to borrow them.
Some of the hesitation is cultural. Advisors worry that talking about fraud makes clients nervous or makes the firm look like it has something to hide. I understand the instinct. I also know that nothing makes a client more nervous than a transfer they never approved.
Attackers Are Taking the Shorter Path Around Your Software
In fairness to the title of this post, your software still matters. The 2026 Verizon Data Breach Investigations Report found that 31% of breaches now start with an exploited software vulnerability, which overtook stolen passwords as the top way in. Keep patching. I have written before about why patching cadence is now a strategic KPI, and none of that has changed.
Account takeover works differently. The attacker does not need to break into your firm. They need your client's password, the code texted to your client's phone, or five minutes of your client's trust. In April 2026, FINRA reported a notable rise in brokerage customer account takeovers, with criminals stealing credentials, including multifactor authentication (MFA) codes, through phishing texts, fake login pages, and callers posing as the customer's own financial institution.
The FBI's 2025 Internet Crime Report shows the scale. Americans reported $20.9 billion in losses to the Internet Crime Complaint Center (IC3) in 2025. Account takeover alone accounted for roughly 4,700 complaints and $359.7 million in losses. Victims over 60 lost $7.7 billion. New York ranked fourth among all states, with more than $1.2 billion in reported losses.
If your book of business includes retirees, business owners who move money often, or anyone whose name shows up in the business section, your clients are already on someone's list. Your firewall does not follow them home.
Why New York Clients Are Easy to Find and Easy to Clone
Wealth managers in New York serve a lot of people who talk in public for a living: founders on conference panels, executives on earnings calls, philanthropists whose gala remarks end up on YouTube. Every one of those recordings is free raw material for a voice clone.
The FBI warned in a December 2024 public service announcement that criminals use generative AI to create short audio clips of a loved one's voice and impersonate them in a crisis. A month earlier, FinCEN issued an alert on fraud schemes involving deepfake media, citing a rise in suspicious activity reports that describe deepfake identity documents used to get around verification checks. By 2025, the IC3 was logging 22,364 complaints tied to AI-related scams, with nearly $900 million in losses.
Here is a hypothetical that should keep a chief compliance officer (CCO) up at night. A client's longtime executive assistant, who pays the family's bills and is authorized on the account, gets a call from what sounds exactly like the client. He is boarding a flight, the closing on the Hamptons house moved up, and he needs the assistant to call the advisor's office and approve a transfer to a new escrow account. Your staff do everything right. They call back the number on file to confirm. The number on file belongs to the assistant, who is now confident, cooperative, and completely wrong.
No amount of internal training fixes that scenario. The weak point sits inside the client's household, and closing it requires the household to know what to look for.
Client Education Already Has a Home in Your Compliance Program
No SEC rule says, in so many words, that an RIA must teach clients about cybersecurity. The rules you already follow make a strong case for doing it anyway.
Start with Regulation S-ID, the identity theft red flags rule for SEC-registered advisers with covered accounts. Appendix A to the rule lists notice from customers about possible identity theft as one of the categories of red flags a program should be built to catch. An educated client is an early warning system. A client who has never heard from you on the subject is a bystander.
Next, look at what examiners told you they are checking. The SEC's 2026 examination priorities say the Division of Examinations will assess whether identity theft programs are reasonably designed to detect red flags, “particularly during customer account takeovers and fraudulent transfers,” and whether firms include training on identity theft prevention. We broke down the rest of that document in what the SEC's 2026 examination priorities mean for your RIA's IT program.
Regulation S-P closes the loop. The 2024 amendments require an incident response program and notice to affected individuals no later than 30 days after a firm becomes aware of unauthorized access to customer information. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. Our Reg S-P deadline guide covers the IT policy updates. If you ever have to send that notice, it helps if it is not the first thing a client has heard from you about security.
Put those together and the logic holds. Your S-ID program is supposed to detect account takeover. Clients are one of the named sources of red flags. Educating them, documenting it, and reviewing it annually is a reasonable way to show the program works. Your CCO and outside counsel should decide exactly how it gets written into your policies, because I am an operations guy, not your lawyer.
What Good Client Education Looks Like in Practice
None of this requires turning advisors into a help desk. The programs that work are short, repeatable, and built into conversations you already have.
Set the rules at onboarding. Give every client a one-page sheet that explains how your firm will and will not contact them. For example, your firm will never act on a transfer request sent only by email or text, and will never ask for a password or login code. Our guide to spotting phishing in 2025 is a useful starting point for the content.
Agree on a verification phrase. The FBI recommends that families create a secret word or phrase to verify identity. Apply the same idea to money movement, and include the family members and staff who are authorized on the account.
Move clients off text-message codes. FINRA lists an unexpected loss of mobile service as a warning sign of SIM swapping, especially when SMS is used for MFA. Walk clients through setting up an authenticator app for your portal, and make sure the portal itself meets the MFA and SSO baseline for advisors.
Brief the whole household. Spouses, adult children, executive assistants, and family office staff often have more access than anyone remembers granting. Bring them into the same conversation.
Make it a standing agenda item. Five minutes in the annual review covers new scams, confirms contact details, and checks who still has authority on the account.
Write it down. Log when education was delivered, to whom, and what it covered. If it is not documented, an examiner will assume it did not happen.
For your most visible clients, add one more step: a private conversation about what is publicly available about them and their families, and how someone could use it. It is an awkward conversation. It is far less awkward than the one after a fraudulent wire clears.
Where Techvera Fits
Techvera supports financial services firms, including RIAs, wealth managers, and family offices, across New York City and the Tri-State area. Our vCIO Services give you fractional IT leadership, a technology roadmap, and board-ready reporting on your risk posture, so client education gets an owner and a budget line rather than a good intention. Our Compliance Readiness team handles the gap assessment and audit-ready policy documentation that turn a client program into something an examiner can read. And our Cybersecurity practice runs security awareness training for your staff, so the 97% side of the ledger stays strong while you build up the 57% side.
If you are deciding whether you need more security leadership than you have today, I made the case for a fractional vCISO as the first security hire for a growing RIA earlier this year. And if you want to know what high-net-worth clients read into your security posture before they move assets, my earlier piece on cybersecurity as an RIA's competitive edge covers it.
Your clients trust you with their money. Give them the tools to protect it, and give your examiners the paper trail that proves you did.
Schedule a 30-minute strategy session with our team to see how your client education program would hold up in an exam.
Frequently Asked Questions
Do SEC rules require RIAs to provide cybersecurity education to clients?
No SEC rule explicitly requires RIAs to educate clients about cybersecurity. Regulation S-ID does require SEC-registered advisers with covered accounts to maintain a written identity theft program, and it lists notice from customers as a category of red flags. The SEC's 2026 examination priorities say examiners will assess whether those programs detect red flags during customer account takeovers and fraudulent transfers. Client education is a practical, documentable way to support both.
What should an RIA's client cybersecurity education program include?
A solid program covers how the firm will and will not contact clients, a verification process for money movement, guidance on moving from text-message codes to an authenticator app, and briefings for family members and staff with account access. It should also include an annual touchpoint and records showing when education was delivered and to whom. FINRA's guidance on customer account takeovers is a good reference for client-facing tips.
How does AI voice cloning put wealth management clients at risk?
Criminals can use short public recordings to generate audio that sounds like a client, a relative, or an advisor. The FBI has warned that criminals use AI-generated voice clips to impersonate loved ones in a crisis, and the IC3 received 22,364 complaints tied to AI-related scams in 2025, according to its 2025 Internet Crime Report. High-profile clients with recorded interviews, speeches, or podcasts give attackers more material. Verification phrases and callbacks to known numbers reduce the risk.
About the Author
Todd Mitchell
Chief Operating Officer
Todd Mitchell is the COO of Techvera, bringing operational expertise and strategic vision to help businesses transform their IT infrastructure.