Most family offices begin on personal email accounts. It is quick, it is free, and for the first few years it works: a few family members, an adviser or two, a shared folder somewhere. Nobody decided it was the right long-term setup. It simply never got revisited.
It is worth being precise about the risk. Gmail is a well-run service, and a personal account protected by a strong password and a second sign-in step is hard to break into. The risk is organisational, not technical. A personal account belongs to a person, not to the office, and that single fact causes most of the problems.
What goes wrong when the office runs on personal accounts
- Nobody is in charge. There is no administrator, so no one can see which accounts exist, require a second sign-in step or switch off access.
- Leavers keep access. When someone moves on, their account goes with them, along with every document and adviser conversation inside it.
- Private life and office mix. One compromised account exposes both a person's private life and the office's financial information.
- There is no audit trail. If something goes wrong, it is hard to establish who opened, shared or changed what.
- Recovery depends on one person. If an account is locked or hijacked, getting it back depends on that individual's phone and patience.
Those are the structural gaps. Sitting on top of them, the same everyday habits tend to appear:
- Passwords shared between people.
- No second sign-in step on important accounts.
- No backup of email and documents, or a backup that nobody has ever tested.
- Out-of-date or missing records of who has access to what.
- Passwords written down on paper or kept in a notes app.
None of this is unusual, and none of it is anyone's fault. It is what happens when there is no owner and no standard.
Why it matters more for a family office
A family office combines three things attackers look for: significant money, payment instructions that arrive by email, and a small group of people with very different attitudes to security. A convincing message to the person who can release a payment is often all it takes. Add personal phones and laptops used for office work, and the line between private and office becomes very hard to defend.
The three controls that matter most
- A second sign-in step on every account that supports it. Start with email, because email can reset almost everything else. An authenticator app is better than a text message, and a text message is far better than nothing.
- A backup you have tested. Keep a separate copy of email and documents somewhere other than the account itself, and restore something real at least once. A backup that has never been restored is a hope, not a backup.
- A call-back rule for payments. Never change payment details, or pay a new account, on the strength of an email alone. Phone the person on a number you already hold. It costs a minute and defeats most invoice and impersonation fraud.
What moving off personal accounts looks like
The aim is a business platform on the office's own domain, where the office owns the accounts, an administrator can see and control them, and access can be removed the same day someone leaves. Microsoft 365 and Google Workspace can both do this well. We usually recommend Microsoft 365: the suite is broader and, in our experience, often a little more accessible and intuitive for people who are not technical. We do not resell either, so that recommendation is ours alone.
The move itself should be gentle. Keep the old accounts running throughout, so there is always a way back. Copy across only the business mail people choose, and leave personal mail where it is. Put an automatic reply on the old address for several months pointing contacts to the new one, and avoid forwarding the old mailbox into the new system, which would blend business and personal mail again. Then update banks and advisers with the new address, using a checklist so none is missed.
A quick test
If you can answer yes to all five of these, you are in better shape than most:
- Can you list every account the office relies on, and who has access to each?
- Does every important account use a second sign-in step?
- If someone left today, could you remove their access within a day?
- Has anyone restored something from backup in the last year?
- Does everyone know the call-back rule for payment changes?
If several of those are a no, the answer is rarely a big project. It is usually a handful of changes made in the right order.