Why Are We Still Sending Capital Calls by Email?

For decades, email has been the standard method for distributing capital calls. It’s familiar, it’s efficient, and the most common reason fund managers continue to use it is simple:

“It’s more convenient for our investors.”

It’s a fair point.

Fundraising is competitive, and every manager wants to provide an exceptional investor experience. No one wants to introduce unnecessary friction that could discourage an investor from participating in the current fund—or the next one.

But perhaps we’ve been asking the wrong question.

Virtually every bank, brokerage firm, payroll provider and tax authority has already decided that sensitive financial information should not be delivered by email.

Why is the private investment fund industry different?

That isn’t a technology question. It’s a risk management question.

Perhaps the private fund industry has spent years competing on investor convenience.

Maybe it’s time to compete on investor security.

Every Other Financial Institution Has Already Made This Decision

Think about how you receive sensitive financial information today:

• When was the last time your bank emailed your monthly account statement?
• When did the Canada Revenue Agency or the Internal Revenue Service send your personal tax information as an email attachment?
• When did your payroll provider email your pay stub?
• When did your brokerage firm email your investment portfolio statement?

They don’t.

Instead, they notify you that new information is available and require you to authenticate before accessing it.

Banks, brokerage firms, payroll providers and government tax authorities didn’t make this change because customers wanted more security.

They made it because protecting sensitive financial information became more important than maximizing convenience.

If virtually every other financial institution has concluded that authentication should come before access to sensitive financial information, why should capital calls be treated differently?

Capital Calls Are Different

A capital call isn’t simply another investor communication.

• It instructs the movement of capital.
• It often contains confidential financial information.
• It frequently includes banking instructions.
• It may involve hundreds of thousands—or even millions—of dollars.

The purpose of a capital call isn’t simply to deliver a document. It’s to securely instruct the movement of investor capital.

The issue isn’t whether email works. The issue is whether email remains the appropriate way to deliver instructions that move money.

A Real-World Capital Call Fraud

This isn’t a hypothetical scenario. It happened.

In one real-world case, an investor received fraudulent banking instructions relating to a capital call and transferred funds to a criminal’s bank account instead of the fund. The fraud wasn’t discovered until the expected capital failed to arrive.

Rather than leaving the investor to absorb the loss, the fund chose to make the investor whole. The financial loss was ultimately borne by the fund itself. In other words, every investor effectively shared the cost of a fraud that began with an email.

The financial loss was only part of the story. Management’s attention shifted from running the fund to responding to a cybersecurity incident. Lawyers became involved. Operational controls came under scrutiny.

Whether the money was eventually recovered is almost beside the point.

The more important question is this:

Would this fraud have been possible if the investor had simply received an email notification and then authenticated before accessing the capital call and its funding instructions?

Cybersecurity is much like insurance.  You don’t judge its value by how often you use it. You judge its value by what happens when you need it. Cybercriminals don’t have to succeed every time.

They only have to be right once.

Why Managers Continue to Send Capital Calls by Email

Fund managers often explain their decision by saying:

• It’s more convenient for our investors.
• Some of our investors aren’t comfortable using secure portals.
• We’ve always sent capital calls by email.
• We’ve never had a problem.
• Our investors trust us.
• We don’t want to make investing harder.
• Our administrator sends the capital calls, so the risk isn’t ours.
• We’ve never had an investor complain about receiving capital calls by email.
• Our investors expect a white-glove experience—email feels more personal.

These are all understandable considerations.  But notice what they have in common. None of them are really about security. They’re about convenience. They’re about familiarity. They’re about investor experience. They’re about operational preference.

Every one of these reasons ultimately comes back to the same trade-off:

Convenience versus security.

The real question isn’t whether email is easier.

The real question is whether making capital calls more convenient is worth exposing investors—and ultimately the fund—to a level of risk that virtually every other financial institution has already decided is unacceptable.

Perhaps It’s Time to Compete Differently

Every fund manager wants to deliver an exceptional investor experience. But investor experience is about more than reducing clicks.

It’s about earning trust. Protecting confidential information, safeguarding investor capital and demonstrating strong governance.

The inconvenience of authenticating before accessing a capital call lasts less than a minute but the consequences of a successful fraud can affect an entire fund.

Perhaps the private fund industry has spent years competing on investor convenience.

Maybe it’s time to compete on investor security.

Contact David Smith at dsmith@pinnaclefundservices.com to see if how Pinnacle Fund Services can help secure your capital calls.

Coming Next

In Part 2 of this series, we’ll explore an often-overlooked reality of emailing capital calls.

Fund managers and administrators invest heavily in securing their own systems.

But once a capital call leaves the organization by email, its security is no longer entirely within their control.

We’ll examine why the greatest cybersecurity risk may not be the fund’s infrastructure—but the hundreds of individual investor inboxes where capital calls ultimately arrive.