Kostas Metaxas & Konstantinos Ilias, KM Cube · 29 September 2026

Part of CyberAId

A transfer request reaches the operations team late on a Friday afternoon: EUR 45,000, to go out the same day. It opens with the greeting that client always uses and names the relationship manager. The amount is one the portfolio could absorb without comment. The last line asks the team to skip the call they would normally make before passing the instruction to the custodian.

Wealth management runs on instructions like this. Relationship managers and operations teams act every day on written requests that move client money, and they have to keep serving the real ones while catching the forged ones. If a forgery gets through, the firm is left with a financial loss and a damaged relationship, and then has to tell a regulator what it relied on.

A forgery like this can look completely routine. The wording is close, the amount fits, and the urgency suits the day’s work. Email authentication can come back clean, because the sender is writing from a domain they control. What gives it away is smaller: a phrase the client never uses, or a claim about who may authorise the payment that does not match how that relationship is handled. Then there is the request to skip the call the team normally makes.

Before the instruction goes to the custodian, the firm has to decide whether the person asking is really the client, and be able to show why it decided that.

What we are building

This is the work KM Cube is leading inside CyberAId, and we are testing it in our operational environment.

The detector reads the instruction for those cues and returns a score with the reasons attached, so the analyst can see why it fired. They can accept the alert, override it, or go back to the client through the channel the firm already trusts. The same judgement has to hold once the request is in the transaction flow. A payment can sit comfortably inside the account’s normal pattern and still be impersonation, so the email and the transaction have to be read against how this desk works: how transfers are confirmed, how cash moves, and how an order goes from request to execution. Monitoring that ignores that rhythm will flood the team with false alarms, or it will miss the forgery written to look routine.

Balancing detection quality and client trust

In private banking the hard trade-off is between missing a forgery and blocking a legitimate high-value instruction. Either one damages client trust and continuity.

CyberAId ranks threats by impact on client funds and market continuity, and keeps a human in the loop for investigation and recovery, so accountability stays with the firm’s people. Detection should also feed investigation that EU financial oversight can follow, including the incident handling DORA expects of financial firms.

Back to Friday afternoon

Take that EUR 45,000 request again. The aim is that the operations team sees it flagged, with the reasons attached, and makes the call they were asked to skip before any instruction goes to the custodian. If the client confirms, the instruction is sent. If not, it is stopped. Either way, the decision and the evidence behind it are on record for whoever asks later.

That is what KM Cube is working toward in CyberAId: a desk that keeps serving its real clients quickly, and does not send an instruction to the custodian on the strength of a message that only sounds like the client.

Funded by the European Union. Grant Agreement No. 101249596.

Views and opinions expressed are however those of the author only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre. Neither the European Union nor the granting authority can be held responsible for them.