Skip to main content
Diopter
Log inBook a demo
Industry

Real-time social engineering defense for fund administrators

Diopter helps your investor services and transfer agency teams confirm that the investor or manager on the call is real before a bank-detail change or a payout goes through. We test your teams with simulated attacks, then assist them on their own calls with real-time alerts while there's still time to hold the payment.

Your first agentic attack is on usBook a walkthrough

A free simulated attack on a team you choose, with an NDA first if you want one.

What can Diopter help fund administrators do on calls?

Diopter helps fund administrators confirm who is on the call and check every payment or bank-detail request before money moves.

  1. Verify investor bank-detail changes.

    An "investor" might email a change form, then take the verification call in a cloned voice.

  2. Release redemption payouts to the right account.

    A redemption request might arrive with a new account and a deadline, from a caller who knows the fund, the share class, and the amount.

  3. Confirm manager payment instructions.

    A cloned general partner (GP) or manager CFO could join a Microsoft Teams call to confirm new instructions for a capital call or a distribution.

  4. Protect the investor services queue at month-end.

    Attackers tend to call the team that works the queue, especially at month-end when the queue is busiest.

  5. Prove your controls to clients and auditors.

    If managers and their auditors ask how you verify payment changes, simulation results and the evidence trail from live calls can help you answer.

How does Diopter help stop investor payment fraud on a live call?

Diopter checks four things on every call, from the first minute to the last.

Identity

Whether the caller is the investor, the GP, or the manager's CFO your records say they are and whether the number and account match what you hold

Mismatch

Voice and video

Cloned voices on the callback, including one that sounds like the investor you spoke to last quarter, plus face-swap and lip-sync artifacts on video, scored for the whole call

Synthetic

Conversation

Pressure such as an "investor" who needs the redemption paid to a new account today and says the form will follow

Pattern

Policy

Requests checked against your payment rules, such as a bank-detail change and a redemption on the same day, or a callback to a number given on the call

Out of policy

The person on the call sees the alert, the reason, and a suggested next step, such as holding the payout for a second check through a known contact. A person decides, and your fraud team gets the evidence and the transcript.

Which social engineering attacks have hit fund administrators and their funds?

Fund administrators and their funds have lost money to fake payment instructions and to callers posing as a bank's fraud team, and regulators now warn about callers posing as savers.

  1. In March 2016, scammers using an email address that misspelled Tillage with an extra "L" sent fund administrator SS&C requests to wire money to Hong Kong. Tillage Commodities Fund said SS&C processed six transfers over 21 days, losing US$5.9 million, and sued the administrator.1

  2. In December 2013, a caller claiming to be from the fraud team at Coutts, the bank of London hedge fund Fortelus Capital, phoned the fund's CFO late on a Friday. The CFO generated security codes to "cancel" 15 suspicious payments, and £742,668 (about US$1.2 million) left the account instead.2

  3. In March 2026, the UK's Pensions Regulator warned more than 35,000 pension professionals that fraudsters were posing as savers to get past security checks, then changing bank details or opening fake accounts in the savers' names to divert their money. The regulator said 90% of the reports behind the alert came from trustees and administrators.3

These attacks follow the same pattern:

  1. A request arrives from a name you know, by email or on a call.

  2. The request asks for a new account, a changed instruction, or codes to "fix" a problem.

  3. There's a deadline, often late on a Friday or at month-end.

  4. Someone skips the check, or the attacker is the one who answers the callback.

Why are fund administrators a target for social engineering?

An administrator holds the one thing an attacker wants, which is the authority to send investor money somewhere new. Callbacks were designed for a time when a familiar voice proved who was calling, but now a cloned voice can pass that check. The FBI recorded US$2.77 billion in business email compromise losses in 2024 and has warned that criminals use AI-generated audio and video on live calls to pass as executives and vendors.4

How do social engineering simulations work for fund administrators?

Diopter runs simulated attacks against your investor services, transfer agency, and treasury teams, with a cloned voice of an investor or manager if you want it. You see who stopped the attack, who escalated it, and who would have released the payment, so you can harden both your payment policies and your people. Do the dry runs with us when you run a red team exercise before attackers do.

  1. We'll run simulated bank-detail change, redemption, and capital call scenarios

  2. You'll receive results by team and by step, so you know which teams to fix first

  3. The same scenarios then become the checks Diopter runs on live calls

How does Diopter roll out for a security team?

Diopter rolls out with a pilot on your investor services team, then goes wider through MDM once it's working.
  • OpenTelemetry native: logs flow into your SIEM, and EDR and MDR connect via API
  • Runs on Zoom, Microsoft Teams, Google Meet, and phone lines (Dialpad, RingCentral, and any carrier via API), with Webex coming soon
  • Captures calls with or without a bot, with nothing to install for investors or managers
  • Rolls out through MDM (Intune, Jamf)
  • Offers configurable data retention, including zero retention, and on-prem or hybrid deployments
  • Has completed a SOC 2 Type II audit

Two ways to start

Your first agentic attack is on us. Fill out the form, and we'll talk through how to run a simulated bank-detail change call on one of your teams. Want to talk about live-call defense instead? Book a walkthrough, and we'll replay a deepfake payment-change call and show you what Diopter caught and when.

Your first agentic attack is on usBook a walkthrough

Common questions for security and finance teams

Can Diopter test our team with a simulated attack first?

Yes. Diopter will run a simulated bank-detail change or redemption call on one of your teams, using a cloned investor or manager voice if you'd like, and show you where each team caught it. Most teams start there, then turn on the same scenarios for live calls.

Can a cloned voice pass a fund administrator's callback verification?

Yes, and Diopter helps catch it. A few minutes of recorded audio can be enough to clone an investor or a manager, so an attacker can pass a callback that relies on recognizing the voice. Diopter scores the voice for cloning on the callback itself and alerts the person on the call before anyone approves the change.

How do fund administrators stop investor payment fraud on bank-detail changes?

Diopter adds a live check to the call that confirms the change. It verifies who is calling, scores the voice and video, reads the conversation for pressure, and checks the request against your cooling-off and callback rules, alongside the steps you already run.

Does Diopter's deepfake detection for fund administrators work on phone calls?

Yes. Diopter covers phone calls, where most callbacks happen, as well as video. On VoIP and conference lines, through Dialpad, RingCentral, or any carrier via API, it scores the voice for cloning and the conversation for pressure.

Can Diopter check know-your-customer video calls?

Yes. When the know-your-customer (KYC) call runs on Zoom, Microsoft Teams, or Google Meet, Diopter scores it for face swaps and lip-sync artifacts across the whole call, so a swap that looks convincing in the first minute can still get caught later. The investor doesn’t have to install anything. Webex support is coming soon.

How does Diopter avoid false alarms on urgent redemption calls?

Diopter won't flag an investor just for needing money quickly. One urgent sentence doesn't trigger an alert. Before it alerts, it needs to see the whole pattern, such as a voice or face that doesn't hold up, pressure, and a request that skips a step your policy requires.

What should a fund administrator look for in social engineering defense?

Start with your own process. A callback to the investor on a number already on file and a second approver for bank-detail changes and payouts can stop many of these attacks without any tool. When you compare tools, run each one on your own investor services calls during a pilot and measure how often it raises a false alarm, how fast the alert reaches the person on the call, and what it does with recordings and investor data. Check that it covers the channels your team uses and fits your existing security tools and audit trail. The final decision should stay with a person. Your own pilot will tell you more than any vendor's benchmark, ours included.

Research behind deepfake detection for fund administrators

Sources
  1. CSO Online, Sep 2016, on Tillage Commodities Fund's lawsuit against SS&C.
  2. Insurance Journal (Bloomberg), Jul 7, 2015, on the Fortelus Capital phone scam.
  3. The Pensions Regulator, Mar 11, 2026, scam alert on impersonation fraud against pension savers.
  4. FBI IC3 2024 Internet Crime Report, and FBI public service announcement I-120324-PSA, Dec 3, 2024.