Skip to main content
Diopter
Log inBook a demo
Industry

Real-time social engineering defense for hedge funds and private equity

Diopter helps hedge funds and private equity firms make sure the person asking to move fund money is who they say they are and that the request fits your policy. We test your operations, deal, and investor relations teams with simulated attacks, then assist them on their own calls with real-time alerts before a capital call or distribution goes out.

Your first agentic attack is on usBook a walkthrough

A free simulated attack on a team you choose, with an NDA first if you want one.

What can Diopter help hedge funds and private equity firms do on calls?

Diopter helps fund teams confirm who is on the call before capital calls, distributions, deal payments, and vendor payments go out, including work with fund administrators on investor-facing calls.

  1. Send capital calls and distributions to the right account.

    An "investor relations" contact might send new wire details with the right amounts and dates, then call to confirm them.

  2. Confirm instructions from your fund administrator.

    A cloned CFO might call the administrator to redirect a distribution or change a signatory before the cut-off.

  3. Approve deal payments safely.

    A cloned general partner (GP) could join a late-night Teams call to approve a wire ahead of a signing.

  4. Verify portfolio company and vendor payments.

    A fake portfolio company CFO might ask for an urgent bridge payment or a vendor payment to a new account.

  5. Prove your controls to limited partners (LPs) and auditors.

    If LPs ask in due diligence how you verify payment instructions, simulation results and the evidence from live calls can help you answer.

How does Diopter help stop capital call fraud on a live call?

Diopter checks four things on every call, from the first second to the last.

Identity

Whether the caller and the instruction match your records, such as a chief investment officer (CIO) or portfolio CFO calling from a number and account the fund has never used

Mismatch

Voice and video

Cloned voices and deepfake video, such as a GP voice lifted from an investor webinar or a conference panel, with face-swap and lip-sync artifacts scored for the whole call

Synthetic

Conversation

Pressure to skip a step, such as a "GP" who says the deal signs tonight and not to loop in the administrator until it's done

Pattern

Policy

Requests checked against your approval policy, such as new wire instructions on a capital call with no callback to the number on file

Out of policy

The person on the call sees the alert, the reason, and a suggested next step, such as holding the wire and calling back on the number on file. Your operations and security leads get the evidence and the transcript.

Which social engineering attacks have hit hedge funds and private equity firms?

Funds have faced AI voice calls asking for system access, a phone call used to approve a fraudulent wire, and fake invoices that led to a fund closing.

  1. In August 2026, Bloomberg reported that attackers phoned staff at several of Wall Street's biggest investment firms, using AI-generated voices that imitated senior executives and colleagues to ask for logins and other system access. Two Sigma, a hedge fund that manages about US$75 billion, said it stopped the attempt before any sensitive data was accessed.1

  2. At a private equity firm, an attacker took over an email thread about a cash transfer from inside a limited partner's compromised account. The attacker then phoned the firm to get verbal approval for the transfer, which led to a fraudulent wire.2

  3. In 2020, attackers pushed through fake invoices worth A$8.7 million at Sydney hedge fund Levitas Capital after one of its founders clicked a link in a fake Zoom invite. All but A$800,000 of the stolen money was recovered, but the fund closed after its largest institutional client withdrew.3

These attacks follow the same pattern:

  1. The attacker studies the fund's calendar (the next close, capital call, or distribution), who signs off, and public audio of its leaders.

  2. A lookalike domain, a compromised inbox, or a cloned voice makes the request look routine.

  3. A call from a familiar voice confirms the change or asks for access, and adds pressure.

  4. The attack only stops when someone checks, by calling back on a number already on file.

Why are hedge funds and private equity firms a target for social engineering?

Hedge funds and private equity firms are a target because they run lean, with small operations teams, large wires, and partners whose voices are all over podcasts and investor days. A close or a capital call puts a real deadline on every request, so urgency sounds normal. The FBI counted US$2.77 billion in business email compromise losses in 2024 and has warned that criminals now use AI-generated audio and video on live calls to pass as executives and vendors.4 That's why private equity cybersecurity has to cover the call, as well as the inbox.

How do social engineering simulations work for a fund?

Diopter runs simulated attacks against your operations, deal, and investor relations teams, with a cloned partner voice or a deepfake video call if you want it. You see who spotted the attack and which step failed, so you can harden both your wire policy and your people. Do the dry runs with us to test your team with a simulated attack before a real one does.

  1. We'll run simulated capital call and distribution changes built from real fund attacks

  2. You'll receive results by team and by step, so you know which teams to fix first

  3. The same scenarios then become the checks Diopter runs on live calls

How does Diopter roll out for a security team?

Diopter works with the platforms, deployment options, and retention settings below.
  • OpenTelemetry native: logs flow into your SIEM, and EDR and MDR connect via API
  • Runs on Zoom, Microsoft Teams, Google Meet, and phone lines (Dialpad, RingCentral, and any carrier via API), with Webex coming soon
  • Captures calls with or without a bot, with nothing to install for LPs, administrators, or portfolio companies
  • Rolls out through MDM (Intune, Jamf)
  • Offers configurable data retention, including zero retention, and on-prem or hybrid deployments
  • Has completed a SOC 2 Type II audit

Two ways to start

Your first agentic attack is on us. Fill out the form, and we'll talk through how to run a simulated capital call attack on one of your teams. Want to talk about live-call defense instead? Book a walkthrough, and we'll replay a deepfake capital call and show you what Diopter caught and when.

Your first agentic attack is on usBook a walkthrough

Common questions for security and finance teams

Can Diopter test our fund with a simulated attack first?

Yes. Diopter will run one simulated attack on one of your teams at no cost, using a cloned partner voice or deepfake video if you'd like, and show you where each team caught it. Most funds start there, then turn on the same scenarios for live calls.

How can private equity firms stop wire fraud on capital calls?

Diopter helps your team check the call that confirms the wire, which is where capital call fraud succeeds. It flags a cloned voice or a caller who isn't on file, spots pressure to skip the callback, and checks the new instructions against your policy, so operations can hold the wire before it goes out.

Can someone clone a GP's or CIO's voice from public recordings?

Yes. A podcast, an investor day, or a conference panel can give an attacker enough audio to clone a partner's voice. Diopter scores the voice on the live call for signs of cloning, so a familiar voice alone doesn't pass.

Does Diopter protect calls with our fund administrator?

Yes. Diopter covers the calls your team has with the administrator, on video and on phone lines through Dialpad, RingCentral, or any carrier via API. A request to change a signatory or redirect a distribution gets checked against your policy while the call is still going.

What does private equity cybersecurity need to cover beyond email?

Diopter covers the calls that confirm money movements, since that's where most wire fraud gets its final approval. Email security catches lookalike domains, but the attacker's follow-up call to confirm the change reaches a person directly.

How does Diopter avoid false alarms on busy calls?

Diopter won't flag a busy deal team just because a signing is coming up. One urgent sentence doesn't trigger an alert. Before it alerts, it needs to see the whole pattern, such as a voice or caller that doesn't match, pressure to skip a step, and an ask your policy wouldn't allow.

What should a hedge fund or private equity firm look for in social engineering defense?

Start with your own process. A callback to a contact already on file and a second approver for capital calls, distributions, and changes to wire details can stop many of these attacks without any tool. When you compare tools, run each one on your own investor and deal calls during a pilot and measure how often it raises a false alarm, how fast the alert reaches the person on the call, and what it does with recordings and data. Check that it covers the channels your partners and finance team use and fits your existing security tools. The final decision should stay with a person. Your own pilot will tell you more than any vendor's benchmark, ours included.

Research behind social engineering defense for funds

Sources
  1. Inc., Aug 7, 2026, and IBTimes UK, both citing Bloomberg, on AI voice phishing at Two Sigma and other investment firms.
  2. FTI Consulting case study, business email compromise at a private equity firm.
  3. NZ Herald, Nov 2020, on Levitas Capital and the fake Zoom invite.
  4. FBI IC3 2024 Internet Crime Report, and FBI public service announcement I-120324-PSA, Dec 3, 2024.