PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Executives’ families can be targeted because a family relationship makes an urgent message, familiar voice or request for help seem credible. Relatives’ personal accounts and phone numbers may also sit outside the company’s security controls, giving an attacker a way to request codes, money or information—or to reach the executive and other contacts.
Recent FBI and UK National Cyber Security Centre advisories document these methods in specific campaigns. They show that family targeting occurs, but they do not establish that every executive is at risk, identify one universal motive or measure how often this route is used.
Why are executives’ families targets for social engineering?
Social engineering works by persuading a person to take an action or disclose something. A relative may receive a request that appears to fit a normal family situation: an executive is travelling, has changed numbers, needs a quick favor or wants an introduction. The relationship supplies context that an unknown sender would have to build from scratch.
Recommended Free Tools
Executives’ public roles can make those relationships easier to imitate. Public biographies, interviews, social-media posts, event appearances and visible business connections can help an attacker write a tailored message. The FBI’s December 19, 2025 public-service announcement says a campaign active since 2023 impersonated senior U.S. officials and contacted people including officials’ family members and personal acquaintances. The reported requests included authentication codes, personal information, funds and introductions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A family account can also be less centrally managed than a corporate account. An executive may use a company-managed identity, device and security team at work while a spouse, parent, adult child or close friend uses a personal email address, social account or mobile number. That difference does not make the relative inherently careless or guarantee that an attack will succeed. It creates another channel that an attacker may try.
The potential value is broader than entry to a company network. An attacker may want a one-time code, an identity document, a payment, a contact’s details or a warm introduction. If the relative’s account is taken over, the attacker can use its contact list and message history to impersonate the relative or approach other people who trust them.
How do scammers target executives through their families?
Documented campaigns combine impersonation with rapport, urgency and a request that becomes more consequential as the conversation progresses. The following pathways can overlap.
Text impersonation and rapport building
A text may claim to come from the executive, a colleague, another relative or a senior official. The sender can begin with ordinary conversation, ask whether the recipient is available and establish a few believable details before requesting help. The FBI describes this pattern in messages that posed as senior officials and then sought codes, information, money or introductions.
An unexpected new number or account is a warning sign, but a familiar name or profile photo is not proof of identity. Attackers can copy names, images and writing styles, and a compromised account can send messages from a genuine profile.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
AI-generated voice calls
The FBI says some messages in the campaign used AI-generated voices. A convincing voice should not be treated as authentication: modern synthetic audio may be difficult to distinguish from a real speaker, especially during a stressful or rushed call. Verify the person through a separate channel rather than listening for an accent, pause or other supposed imperfection.
Moving the conversation to another app
An attacker may ask the recipient to continue in a different encrypted messaging application. Changing platforms is not automatically fraudulent; families and organizations use multiple apps for legitimate reasons. The combination of an unexpected move, a new account and a request for secrecy, money, credentials or codes deserves an independent check before the conversation continues.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCredential phishing
The UK NCSC reported on September 27, 2024 that actors in an Iran-linked targeted campaign tailored approaches to people’s interests and sometimes impersonated family members. In the described sequence, an actor built rapport and then sent a link to a false login page to solicit credentials. Entering a password on that page could give the attacker access to the account, its messages and its contacts.
Do not use a login link supplied in an unexpected message. Open the service by typing its known address, using a trusted bookmark or opening its official application, then check for alerts or requests there.
Requests for codes, documents, money or introductions
A request for a two-factor authentication code is especially important. Codes are intended to prove control of an account to the service being accessed; forwarding one to another person can let that person complete a login. The FBI advises against sharing codes or sensitive information through email, text or encrypted messaging.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Other high-value requests can include identity documents, gift cards, cryptocurrency, bank transfers, emergency cash or an introduction to a colleague, investor, official or family friend. Urgency and secrecy are not evidence of fraud by themselves, but they remove the time needed for normal verification. Treat them as reasons to pause.
SIM swapping and call forwarding
FBI Internet Crime Complaint Center guidance identifies SIM swapping and call forwarding as social-engineering methods. An attacker who convinces a mobile carrier to move a number to a different SIM or to forward calls may receive texts and calls intended for the victim. That can expose account-recovery messages and may bypass some forms of SMS-based multi-factor authentication. Carrier protections therefore matter even when the suspicious contact begins as a family impersonation.
How a family member can become a stepping stone
The first contact does not have to compromise the executive directly. If a relative discloses a code, enters credentials on a fake page or loses control of an email or messaging account, the attacker may gain a map of the person’s network. The FBI notes that access to contact lists can enable another round of impersonation.
Message history can reveal names, travel plans, employers, assistants, preferred apps and the way a family addresses one another. An attacker can then send a more convincing message to the executive, an assistant or another relative. A forwarding rule or stolen session can also let the attacker read incoming messages without repeatedly asking the victim to log in.
This is a possible pathway, not a claim that every family incident is an attempt to reach corporate systems. The FBI campaign reports requests aimed directly at contacts, while the NCSC account-takeover scenario describes possible message exfiltration and forwarding rules. The useful response is to protect the relative’s account and notify the executive’s security contact promptly if compromise is suspected.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should an executive’s family do if they get a suspicious text or call?
Use a deliberate pause. The goal is to verify identity and the request without giving the attacker more information.
- Stop the requested action. Do not send money, gift cards, cryptocurrency, identity documents, passwords or authentication codes. Do not click an unexpected link or install software at the caller’s direction.
- End the current conversation if necessary. A polite response such as “I will call you back” is enough. Do not let the sender keep you on the line while you attempt to verify them.
- Use an independently known channel. Call the supposed sender using a number already stored and previously confirmed, start a new conversation in a known account or contact the executive’s office through its established process. Do not use a number, link or account supplied in the suspicious message.
- Use a family secret phrase. Agree in advance on a word or phrase that is not posted publicly and is not contained in the suspicious conversation. The FBI specifically recommends this method: “Create a secret word or phrase with your family members to verify their identities.” Ask for the phrase through the independent channel, and change it if it is exposed.
- Verify the request itself. A genuine relative may still have a compromised account. Confirm what is needed, why it is urgent and who else has approved it. For financial requests, use a second person and a normal payment process rather than an emergency transfer.
- Preserve evidence. Keep the original messages, phone numbers, email headers, timestamps, profile links and payment details. Avoid forwarding a malicious link to other people; share evidence through the organization’s security team or the appropriate reporting service.
- Escalate quickly after disclosure. If a password, code, document or payment was provided, tell the affected service, the mobile carrier and the executive’s security contact immediately. Change credentials from a trusted device, revoke active sessions and check for forwarding rules or new recovery methods.
- Report the incident. For the campaign described by the FBI, victims are directed to contact relevant security officials and report to the Internet Crime Complaint Center. Outside the United States, use the country’s appropriate cybercrime and emergency reporting channels.
Layered controls: match each measure to the risk
No single control proves identity, prevents account takeover and protects a mobile number at the same time. Combine measures according to what they defend and how the family will actually use them.
| Control | What it defends | How the family uses it | Important limitation |
|---|---|---|---|
| Family secret phrase | Identity deception during calls or messages | Ask for the pre-agreed phrase through a channel that was independently verified | It fails if the phrase is public, reused carelessly or revealed in the suspicious conversation |
| Independent callback | Impersonation from a new number, account or app | Call a previously confirmed number or use a known account, not contact details in the request | It verifies the channel you choose; it does not prove that a genuine account has not been compromised |
| Unique passwords and a password manager | Password reuse and credential theft across personal accounts | Generate and store a different password for every important service | A password manager cannot make a phishing page legitimate; navigate to the service directly |
| Multi-factor authentication | Some stolen-password logins | Approve sign-ins only when you initiated them and recognize the device and location | Never disclose a one-time code; SMS-based methods can be affected by SIM swapping or forwarding |
| Security key or passkey | Phishing of supported account sign-ins | Use a FIDO2/WebAuthn hardware key or passkey on accounts and devices that support it | Availability depends on the service and device; it complements, rather than replaces, identity verification |
| Carrier account controls | SIM changes and unauthorized call forwarding | Set a unique voicemail password, ask the carrier about blocking SIM changes and forwarding, and review account changes | Carrier features differ, so confirm which restrictions are available on the account |
Joint CISA/FBI guidance from 2024 identifies a physical security key as an example of phishing-resistant multi-factor authentication. A passkey can provide the same type of protection where the service supports it. These controls reduce the chance that a stolen password or fake login page will succeed, but they do not stop an attacker from persuading someone to send money or reveal private information.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect personal devices and work channels
Keep personal accounts recoverable and current
Install operating-system and application updates, use screen locks and review account-recovery email addresses and phone numbers. Remove old devices and sessions that are no longer used. Check whether an account has newly created forwarding rules, unfamiliar delegates, changed recovery methods or login alerts from another location.
Use a password manager to create unique passwords, and turn on multi-factor authentication for email, messaging, social, financial and cloud accounts. Email deserves priority because it can reset other services. Where supported, select a passkey or hardware security key instead of relying only on texted codes.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Separate personal and corporate work
The NCSC’s guidance for high-risk individuals advises using corporately managed accounts and devices for work where possible. That approach gives the organization a clearer ability to enforce updates, monitor risky sign-ins and respond to a suspected compromise. It is guidance for people whose work or public status gives them access to sensitive information of interest to nation-state actors, not a definition that applies to every corporate executive.
Families should know which executive-office or security-team number to use for urgent verification. The executive’s assistant, communications staff and security team should agree on how to validate unusual introductions, travel-related requests and payment instructions without relying on the same compromised channel.
What the documented campaigns establish—and what they do not
The FBI announcement establishes that impersonation activity dating from 2023 included senior officials’ family members and personal acquaintances, with requests for codes, information, funds and introductions. It also describes text and AI-generated voice messages, rapport building and attempts to move conversations to another messaging application.
The NCSC report published September 27, 2024 describes an Iran-linked targeted phishing campaign aimed at people connected to Iranian and Middle Eastern affairs rather than the general public. NCSC Director of Operations Paul Chichester called these “a persistent threat to individuals with a connection to Iranian and Middle Eastern affairs.” The report includes family-member impersonation and credential theft through false login pages.
These advisories document tactics and incidents, not a prevalence comparison. They do not show that all executive families are targeted, that relatives are always the first entry point, or that family attacks are more common than direct attacks on executives. No reliable percentage or incident rate for executive-family social engineering is established by these sources. Risk depends on public exposure, the value of the person’s contacts and information, account security, and the attacker’s objectives.
A practical family security routine
- Agree on a secret phrase and an independent callback method before an incident.
- List the phone numbers, email addresses and accounts that are safe for urgent verification.
- Use unique passwords and multi-factor authentication on email, messaging and financial accounts.
- Prefer passkeys or hardware security keys on supported services.
- Ask the mobile carrier about SIM-change and call-forwarding protections, and set a unique voicemail password.
- Decide who in the executive’s organization receives reports of suspicious contacts.
- Rehearse one scenario: a new number, a convincing voice and an urgent request for a code or payment.
The routine should make verification normal rather than insulting. A genuine relative or executive can wait for a callback; an attacker benefits from speed, secrecy and uncertainty.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
