Practice the Verification, Not the Stereotype: A Respectful Phishing Rehearsal for Wealth Stewardship

Make the safe action easier to rehearse

A warning to be careful online does not teach a person what to do when a message appears to come from a trusted adviser. A family office should rehearse a specific verification process: pause, use an independently known contact route, clarify the request and involve the authorized decision maker. The rehearsal must be respectful and safe. It should use fictional information, never collect real passwords and never create a genuine transfer instruction. Its purpose is to reveal a process gap that the office can fix, not to catch someone out or prove that one generation is more vulnerable than another.

What suspiciousness research can and cannot establish

Gavett and colleagues studied phishing suspiciousness among 193 cognitively intact younger and older participants [1]. Their model identified education and interactions involving prior phishing awareness and one executive-function measure, while several other measures were not useful predictors. The age-group estimate itself was too imprecise for a confident interpretation. These details argue against a simplistic story that age determines vulnerability. The measured outcome was reported suspicion in a laboratory setting, not prevention of an actual fraudulent transfer. A family office should apply the study as a reason to test knowledge and workflow, not as permission to diagnose cognition or infer a person’s capacity.

Design a transparent and bounded exercise

Explain in advance that participants will encounter simulated messages during a defined practice session and can stop at any time. Use a range of plausible requests, including an ordinary service notice and an urgent request to change payment details. Label the environment clearly as training without making the correct answer depend only on a prominent warning. Ask participants to narrate what they would do next and which source they would use to verify the request. Avoid private family stories that could embarrass the learner. Provide an accessible format and allow the person to bring a chosen support contact if that makes the exercise more useful.

Score the verification pathway

Record whether the person used a known contact directory, recognized an unexpected request for secrets, and identified the correct authorization route. A participant may be suspicious but still contact the attacker through the number in the message; that is a meaningful process gap. Another may not initially recognize the deception but follow a standard independent check that prevents harm. Score those pathways separately. Do not reward alarm alone, since constant suspicion can make legitimate services difficult to use. Observe whether the office’s own directory is current and whether the designated contact can actually respond. Training cannot compensate for a broken verification system.

Teach the missing step and test transfer

Give feedback on the action rather than the person: explain why a contact route was independent, which request exceeded the normal workflow, or where authorization was unclear. Then use a different scenario to see whether the learner can apply the principle without being told the answer. Keep a short record of the gap, the support offered and the follow-up result. A correct response immediately after coaching is not proof of durable protection, so repeat a proportionate exercise later with consent. If difficulty persists, adapt the service design and provide human support; do not turn the exercise into an amateur neuropsychological assessment.

Implementation ownership and review

Owner: Security education lead. Action: Run a consent-based exercise with fictional requests and no real credentials. Evidence: Scenario scripts, accessibility choices and participant consent. Measure: Completion of an independent verification step.

Owner: Operations lead. Action: Test the contact directory and payment authorization route revealed by the exercise. Evidence: Directory checks, response times and process-gap log. Measure: Unreachable contacts and ambiguous authority.

Owner: Family support liaison. Action: Provide action-specific coaching and a new transfer scenario. Evidence: Private learning record and follow-up result. Measure: Improved process use without embarrassment or reduced reporting.

Evaluate safety and dignity together

The office should review whether the exercise improved verification behavior, uncovered directory failures or made participants reluctant to disclose future mistakes. Stop deceptive or humiliating practices and remove unnecessary personal detail from training records. Include employees with payment authority as well as family members, because a well-designed control should not depend on a stereotype about who is likely to fail. This rehearsal is an editorial proposal informed by the research, not a validated intervention from the source article. Success means a usable route to independent confirmation and appropriate help, not a high score on a frightening simulation.

Source, attribution and limits

[1] Brandon E. Gavett; Rui Zhao; Samantha E. John; Cara A. Bussell; Jennifer R. Roberts; Chuan Yue. Phishing suspiciousness in older and younger adults: The role of executive functioning. PLOS ONE (2017-02-03). https://doi.org/10.1371/journal.pone.0171620. CC BY 4.0.

The outcome was reported suspiciousness in a laboratory task, not real-world losses. Recruitment, sample composition, test context and imprecise age effects limit generalization; the research does not justify clinical screening by a family office.

Prepared by the Family Office Private Wealth Journal editorial research desk with AI assistance at the direction of Dr. Freedom Cheteni. Original research authors retain full credit and are not authors or endorsers of this companion. This proposed process has not been evaluated in a new empirical study; no independent peer-review acceptance is claimed. This is educational analysis, not individualized investment, legal or tax advice.

Implementation record

Open the cited sources

1. [1] Brandon E. Gavett; Rui Zhao; Samantha E. John; Cara A. Bussell; Jennifer R. Roberts; Chuan Yue. Phishing suspiciousness in older and younger adults: The role of executive functioning. PLOS ONE (2017-02-03). ↗