A three-person advisory practice. One afternoon. One email. A client's $250,000 house closing.
This walkthrough shows how an attack gets past antivirus and a firewall, why your custodian's security does not cover it, and what kind of monitoring would have caught it in time.
You will be asked to predict what happens at a few points. The wrong answers are the ones most advisors pick, which is exactly what makes them worth walking through.
No technical background needed. Any term appears like this — — and you can tap it for a plain-English definition at any time.
Scene 1 · Thursday, 3:50 p.m.
An agreement that needed signing
Mark advises about sixty households. Summit Custody holds his clients' assets, and paperwork from them is routine. This arrives shortly before the end of the day.
From Summit Custody <>
To mark@brightpathadvisors.com
Subject
We have updated the custodial account agreement for your practice. Please review and sign the attached document today so that client accounts are not restricted.
Summit Custody — Advisor Services
Tap the parts of this email that should raise a question. 0 of 4 found.
This is . Not a technical break-in — a message engineered so that a careful professional, at the end of a long day, does the ordinary thing and opens it.
Mark opens the document at 3:51 p.m. An account agreement appears on screen and looks entirely normal. It is real — the attacker copied a genuine one. The document is not the point.
Scene 2 · 3:51 p.m.
What the document actually did
While the agreement displayed, the file also exploited a flaw in the document viewer software itself — a flaw the company that makes it does not know exists.
That is a . The vendor has had zero days to fix it. There is no update to install, because nobody has written one. And no antivirus has a description of it, because nobody has seen it before.
Does the practice's antivirus catch this?
Pick what you think happens. There is no penalty for guessing.
Why it stays silent
Antivirus is a list of known stolen card numbersIf a card is on the list, the transaction is declined. If a card was stolen an hour ago and has never appeared on any list, it sails through — not because it is legitimate, but because the list is the only thing being checked.
Antivirus works largely from : descriptions of malicious files already identified somewhere in the world. Something built to be new matches nothing.
To be fair to antivirus: modern products also use heuristics and some behavioral rules, and they do sometimes catch novel files. But an attacker building something new tests it against common antivirus products until it passes. You cannot rely on it for this.
What would have helped here
Not a better list. Something watching what the document viewer did — because a viewer that starts another program is behaving abnormally whether or not anyone has named the file.
Scene 3 · 3:52 p.m.
The call home
A minute later the program that the document started opens a connection out to a server the attacker controls, and waits for instructions.
It uses on the standard web port — the same protocol as every website the practice visits all day.
Does the firewall block that connection?
The practice has a business-grade firewall, properly installed.
What a firewall actually does
A firewall is the vault doorIt is essential, and it controls who gets in and out. But it offers nothing once someone is already operating from inside the building — and it cannot tell whether a person inside is doing their job or emptying the drawers.
A firewall enforces rules about where traffic may travel — which addresses, which ports, which directions. It does not evaluate what a program on a computer inside the practice is trying to do.
Outbound web traffic has to be allowed, or nothing works: not the custodian portal, not email, not research. The attacker chose it for that reason.
Option C is nearly right, and worth being precise about: some firewalls do block connections to servers on known-malicious lists, which genuinely helps. But a server registered this week for this campaign is on no list yet.
What would have helped here
Noticing that this particular program — a document viewer's child process — had never made an outbound connection before. The destination was unremarkable. The program making the request was not.
Scene 4 · That evening
"But our custodian handles security"
Mark left at 6. His email and the Summit Custody portal are still open and still signed in, the way they are most evenings.
The attacker's program reads his inbox and finds a thread with Mrs. Chen: she is wiring $250,000 next Wednesday for a house closing.
Two things then happen. A hidden is created so that Mrs. Chen's replies bypass Mark's inbox entirely. Then, from Mark's real email account, she is sent updated wire instructions.
Summit Custody has serious security. Is Mrs. Chen's money safe?
This is the most common assumption, and the most expensive one.
Where the responsibility actually sits
The custodian secures its own platform, and it was never attacked. Nothing here required breaking into Summit Custody at all.
Mrs. Chen receives instructions from the email address she has corresponded with for years, in a thread she started. When she replies with a question, the rule routes it away from Mark, and the attacker answers as him. Every signal she has ever used to judge authenticity is intact.
The custodian's security ends where Mark's laptop begins — and that side belongs to the practice. Wire transfers are generally irreversible once sent; a recall can be attempted, but it depends on the receiving bank and on speed, and it frequently fails.
Option C deserves a note: custodians do apply wire controls and callback procedures, and those genuinely stop some fraud. They are worth insisting on. But a change routed through the advisor's own verified channel is specifically designed to satisfy them.
Beyond the money, this is a matter. In general terms, requires firms to maintain an incident response program covering unauthorized access to customer information, and to notify affected individuals — so an event like this brings regulatory obligations alongside the client harm.
What would have helped here
Two things that had nothing to do with the custodian: noticing that a new hidden inbox rule had appeared, and verbally confirming any change to wire instructions using a phone number already on file — never one supplied in the email itself.
Scene 5 · The same night, twice
What each setup sees
Identical attack. Identical practice. The only difference is whether anything is watching behavior.
Antivirus + firewall only
With behavior monitoring
Tap any alert on the right to see why that moment was abnormal.
What was doing the watching
EDR and UEBA are fraud monitoring for your practiceYour card company does not hold a list of every fraudulent merchant. It knows your pattern, and calls when a charge does not fit it. That is the same question being asked here, about computers and accounts instead of cards.
watches what programs do on a computer: what launches what, what connects where. The first two alerts came from there.
learns each person's and each device's normal pattern — hours, volume, which systems — and flags departures. The inbox rule, the hour, and the volume of client profiles came from there.
Neither needed to know what the attack was called. Both only needed to know what normal looked like.
One honest caveat. Behavior monitoring is not perfect either. It can raise alerts that turn out to be benign, and it needs a baseline period before it is useful. The claim is not that it catches everything — it is that it can catch things with no signature, which signature-based tools structurally cannot.
Scene 6
Three things to take away
1
Zero-day attacks have no signature.Tools that work by recognizing known threats cannot see something never seen before. That is a structural limit, not a product defect.
2
Firewalls check where traffic goes, not what is happening on your computer.The malicious connection looked exactly like ordinary browsing, because the attacker made it look that way.
3
Your custodian's security ends where your laptop begins.Summit Custody was never breached. Everything happened on Mark's machine, through Mark's real accounts.
Antivirus and firewalls are still necessary. They are just no longer sufficient. They stop a large volume of routine, known attacks every day, and removing them would be a serious mistake. The gap is specifically attacks built to be new.
The practical question is not which product to buy. It is whether anything in your practice would notice a computer or an account behaving unlike itself — and whether anyone would see it the same night, rather than after a client's closing fails.
Scene 7
Practice risk score
Three quick questions, then a six-question review of your practice.
Question 1
Why did the antivirus not alert on the document?
Question 2
Why did Mrs. Chen have no reason to doubt the wire instructions?
Question 3
What made the attack detectable on the monitored side?
Six questions about your practice
Nothing is recorded or sent anywhere — this runs entirely in your browser.
Mark's Thursday is an illustrative composite, not a report of a specific incident. Summit Custody and Brightpath Advisors are fictional. Amounts and times are used to show how an attack unfolds and are not statistics. Nothing here is legal, compliance, or investment advice; consult your compliance counsel about your obligations.