Six Money-Out Moments Worth Auditing in Your Firm

Here is an exercise that takes about twenty minutes and tends to be uncomfortable.

Write down the identity evidence your firm collects at onboarding. Then write down the evidence you collect at each of the six moments below. Compare the two lists.

Most firms find six different standards rather than one, thorough at the front door and improvised at every door after it. And every door after the first is where the money actually leaves.

1. Withdrawals and distributions

Ask: how do we know the person asking for this money is the person who owns it?

Once the money goes, getting it back is hard, and by the time a participant notices, it has usually moved again. If your honest answer involves recognizing a voice, calling back a number on file, or a form that showed up by email, you are protecting a six-figure transaction with a courtesy.

2. Beneficiary designations and account changes

Ask: if a family member challenges this in four years, what can we actually produce?

This is the quietest one on the list. Nothing happens the day it is filed, so nobody looks twice. It surfaces at a death or a distribution, and by then your file is the only version of events, and the one person who could have said "I never signed that" is gone.

3. Spousal consent

Ask: how do we verify someone who is not our client?

The signature carrying the most weight here often belongs to a person you have never met, with no account, no history, and nothing for you to check them against. Knowing your client is no help at all in the one place you need it most.

4. Wire transfer authorizations

Ask: what would a good impersonator actually have to get past?

Large amounts, short windows, and the most heavily targeted instruction in the business. If the answer is a confident phone manner and a few account details, that is the bar you are currently setting.

5. Account recovery

Ask: what are we leaning on when every credential is already in question?

Your client has lost access, so the factors you would normally check are the ones under dispute. Attackers work this door hardest, because getting through it hands them an account that every other control was built to protect.

6. Powers of attorney for account access

Ask: did we verify the agent, or did we just receive a document?

Somebody new can now move this client's money. Verifying both the person and the authority they claim is the whole job, and a notarized page tells you a human stood next to a notary, nothing more.

Why this is getting harder, not easier

Three things are happening at the same time.

The clients most at risk are the ones transacting most. Cerulli Associates projects $124 trillion changing hands through 2048, with $105 trillion going to heirs and $18 trillion to charity, plus $54 trillion moving to spouses before it moves again. Nearly $40 trillion of those spousal transfers go to widowed women in the Baby Boomer generation and older. Every one of those is a beneficiary form, an estate settlement, or a re-registration, handled by someone who is often in their seventies and recently widowed.

Fraud against those clients is climbing fast. The FBI's 2025 Internet Crime Report logged 201,266 complaints from people aged 60 and over, up 37% in a year, with $7.748 billion in reported losses, up 59%. The average victim lost $38,500. More than 12,000 of them lost over $100,000 each. Tech and customer support scams took $1.04 billion, romance and confidence scams $584 million, and impersonation $413 million.

Account takeover keeps spreading. Javelin Strategy & Research reported account takeover losses above $15 billion in 2025, hitting 6 million consumers, an 18% rise in people affected.

Look at what those scam categories have in common. Tech support, romance, impersonation: all of them work by talking to a person. None of them beat a biometric check, because none of them ever meet one. They talk their way past somebody helpful, which is exactly what a control built on relationships and recognition cannot stop.

But clients hate friction

That is the usual reason these six moments stay lightly guarded, and the numbers do not support it.

Fenergo's Financial Crime Industry Trends 2025, a survey of 600 senior decision-makers across banks, asset managers, and fund administrators, found 70% of firms lost clients in the past year because onboarding was too slow, up from 67% in 2024 and 48% in 2023. Around 10% of clients now abandon onboarding partway through.

So firms are already losing clients to friction, and the friction they have is not buying much protection. The old controls were built for a branch: someone came in, you looked at them, they signed in ink, a manager reviewed it. Serving people remotely took all of that away, and in a lot of workflows what filled the gap was knowing the client.

Stop starting from scratch with each identity check

What you need is real assurance at all six moments without making a client of fifteen years start from scratch each time. The way through is to separate the first verification from every one after it.

A client verifies once, properly, with credential analysis, biometric matching, and liveness detection at an IAL2 standard certified by the Kantara Initiative, and walks away with a reusable Digital ID. Next time they request a withdrawal or change a beneficiary, they confirm with a quick biometric check against the credential they already hold. Same quality of evidence, seconds instead of minutes.

The pieces around that map onto the six moments directly. For withdrawals and spousal consent, Proof verifies identity, scans for fraud risk, captures the consent, and produces the documentation in one pass, with commissioned notaries available 24/7, so a spouse finishes at their kitchen table instead of driving somewhere.

For the moments where you want a person watching, Verify puts a live agent on secure video. Four of the five situations Proof built Verify for land directly on the list above: account recovery, high value transactions, ownership transfers, and a high-risk step up for anything your signals flag. It also handles sessions the automation could not resolve, and you can staff it with your own agents or Proof's.

Every notarization, signing, and transaction authorization is cryptographically tied to the verified credential, creating a tamper-evident record. That file looks like housekeeping on the day it is created and becomes the most valuable thing you own the day an heir contests a beneficiary change three years later

Run the audit. If all six moments hold to the same standard, you are ahead of most of the industry. If they do not, the weakest one on your list is where you will hear about it first.

See how Proof unifies identity, consent, and documentation for retirement workflows >