Fraud tends to follow money and ambition. Businesses raising capital and people looking for work both have something at stake and a reason to move quickly, which makes them attractive targets. The schemes are rarely sophisticated, but they are well rehearsed, and they increasingly borrow the names, logos and staff of genuine firms. Knowing the common patterns, and what a genuine process looks like, is the best defence.
Advance-fee schemes. The most common pattern in capital raising is the advance fee. A company is told an investor has approved funding, often on unusually generous terms and after very little diligence. Then a cost appears: a due diligence charge, an insurance premium, a legal or stamp fee, or a tax that must be settled before money can move. Each payment is followed by another, each with a plausible explanation. The investor does not exist, and the money paid is rarely recovered.
Genuine counterparties welcome verification, and fraudsters avoid it.
A worked example. Consider, as a hypothetical, a London business raising EUR 15 million. Its founder receives an email from someone describing himself as an investment director at a family office in Abu Dhabi. After two calls and no questions about the accounts, a term sheet arrives with a valuation well above anything other investors have discussed. A week later the family office's "compliance department" asks for a fee to complete anti-money laundering checks, payable to a consultancy in a third country. The founder is told the offer lapses on Friday. Every element of that sequence is a warning sign, and the deadline is there to stop the founder from asking anyone.
What genuine diligence looks like. Real investors, and Gulf family offices in particular, tend to move carefully. According to UBS's Global Family Office Report 2026, 86% of family offices handle strategic asset allocation in-house, and decisions are usually taken by a small number of senior people after a period of familiarity. In practice that means many questions, management meetings, requests for financial detail, and the investor's own lawyers and accountants reviewing the business. Investors pay their own advisers. An investor who commits quickly, asks little and then wants money from you is behaving in the opposite way to a genuine one.
Paying to receive funds. A variation tells the company that its funds are already sitting in an account, held by a bank, a regulator or a custodian, and that a fee is needed to "release or unlock funds". Legitimate capital never moves this way. In a genuine raise, money passes from the investor to the company, or through an escrow agreed by lawyers on both sides, and no one asks the recipient to pay first. Documents offered as proof, such as bank comfort letters, regulator certificates or stamped screenshots of balances, are easy to fabricate and prove nothing.
Borrowed names. Fraudsters often claim a link to a well-known institution: a sovereign fund such as PIF or ADIA, a ruling family office, a large bank or a known adviser. Such claims are easy to make and hard to test from the outside, which is why they are used. Treat any claimed mandate from a large institution as unverified until you have confirmed it through that institution's own published channels. Do not rely on a telephone number, website link or letter supplied by the person making the claim.
False urgency and lookalike identities. Fraud depends on speed. Deadlines are tight, the investor is said to be about to commit elsewhere, or confidentiality is offered as a reason not to involve your lawyers. Messages often arrive from addresses that look nearly right: a domain with one letter changed, a different ending, or a free email account using a real employee's name. Check the full sender address every time. A genuine firm uses one domain, and Wrotham Partners, for example, communicates only from @wrothampartners.com, with LinkedIn as its only official social profile.
Payment diversion. A quieter form of fraud targets genuine transactions. Late in a deal, an email that appears to come from a lawyer, adviser or investor announces new bank details for a payment. The email account may have been compromised, or the domain may differ by a single character. The defence is a fixed habit: confirm any change of payment details by telephone, using a number you already hold from earlier in the transaction, before sending anything.
Fake recruiters. Job-offer fraud often targets people early in their careers. A message arrives through a social network or messaging app offering a role at a known firm, sometimes after a brief interview conducted entirely by text. The offer comes quickly. The candidate is then asked to pay for training, equipment, a visa or a background check, or to share bank details, identity documents or login details for "onboarding". A genuine employer does not charge candidates and does not ask for passwords.
How a fake offer unfolds. Imagine a recent graduate who receives a message on a messaging app from someone using the name and photograph of a real analyst at a London advisory firm. The interview takes place by text over an afternoon. An offer letter follows the same evening, carrying the firm's logo. The graduate is asked to buy a laptop from a named supplier, with a promise of reimbursement in the first pay packet, and to send a passport scan and bank details for payroll. The laptop money is gone, and the identity documents can now be used to open accounts in the graduate's name.
Money mule schemes. Some fake roles are designed to use the candidate's own bank account. The new "employee" is asked to receive payments and pass them on, perhaps described as client funds or payroll processing. Those payments are usually the proceeds of other frauds, and the account holder can face the account being closed, difficulty banking in future and serious legal consequences. Any job that involves moving money through your personal account should be refused.
Protecting yourself. Verify independently. Find the firm's website yourself, check that the person contacting you appears on it, and get in touch through details you have found, never through those in the message. Search the company register and, where a firm claims to be regulated, the regulator's register. Never pay a fee to receive funds or a job, and never share passwords, one-time codes or remote access to your devices. Take your time, because a genuine investor or employer will wait while you check.
Reporting it. If you have paid money or shared bank details, contact your bank straight away, since speed improves the chance of stopping a payment. Keep every message, email and document, and do not delete the conversation. Report the fraud to the police or the national fraud reporting service in your country, and in the UK forward suspicious emails to the National Cyber Security Centre's reporting service. If a scheme uses a genuine firm's name, tell that firm through its published contact details so it can warn others. Wrotham Partners can be reached at contact@wrothampartners.com.
Not every unexpected approach is fraudulent, and many genuine opportunities begin with a cold email. The test is simple and reliable: genuine counterparties welcome verification, and fraudsters avoid it.
This commentary is provided for general information and reflects the views of Wrotham Partners at the time of writing. It does not constitute investment, legal or financial advice.