Cyber fraud, payment redirection and AI impersonation in legal practice.
Thirteen lessons on cyber fraud, payment redirection and AI impersonation for NSW solicitors and the people who work in their practices, and a free 25-question practice test. About 2 CPD units of course time, on your phone or computer, with no account. Pass the test and download a certificate of completion with a QR check and a ready entry for your CPD log for A$89. You pay only after you pass.
- Pay only if you pass
- Retake the test as often as you like
- 2027 edition · no account, no subscription
Try a question from the test
Lesson 2 · Payment redirection: when the client’s bank details change
What does the Law Society recommend before making large payments on an emailed instruction?
Show the answer
Right answer: B, Telephone the client on details already on file to confirm the instruction, BSB and account number. It recommends telephoning the client using details on file, not those in the email, to confirm the payment instruction, BSB and account number. [S9] Read that lesson
Thirteen lessons, about 2 CPD units.
Each part answers a question from the working day and ends with a summary. Then the test: 25 questions at random, and 20 right (80%) is a pass.
- What the NSW CPD rules ask, and where this course fitsThe ten units and four fields, self-assessment, why interactive online programs are uncapped, which field a fraud course sits in, and the records to keep.
- Payment redirection: when the client’s bank details changeThe most common scam affecting legal practitioners, real alerts from the Law Society, and the call-back rule for any payment instruction.
- Trust money duties when something looks wrongThe duty to report irregularities, what counts as one, what happens if you do not, the old cheque scam, and what to do straight after an incident.
- Impersonation: banks, clients and cloned voicesHow scammers pose as your bank or your client, the code-reset trick, a cloned voice used against a law practice, and how to check who you are speaking to.
- Identity, documents and fake clientsVerifying identity under the electronic conveyancing model rules, documents that look right but are not, and the new client who does not add up.
- Four files to practise onFour short practice situations built from what the Law Society and the Australian Cyber Security Centre describe. Decide first, then read the right move.
- Payment redirection and business email compromisePayment redirection is when a criminal gets a business to pay money into the wrong bank account.
- AI-written phishing and impersonation by email, SMS and chatPhishing is when a scammer pretends to be someone you trust to get your money, passwords or details.
- Verification habits that stop most of these scamsThis is the habit that appears most often in the sources behind this course, in one form or another.
- Account takeover, passwords and MFA fatigueAccount compromise means someone gets into your email, bank or other online account without your permission.
- Synthetic identities and fake documentsThe US Treasury's financial crimes unit (FinCEN) defines a synthetic identity as a combination of real and fake personal information used to build a person or business that can pass identity checks.
- Voice clones and deepfake video calls: an emerging riskVoice cloning and deepfake video are real, and the official bodies warn about them, but they are still a small part of the picture.
- When it happens: the first hourIf you think you have sent money or bank details to a scammer, contact your bank or financial institution immediately.
Inside: 13 lessons, 84 parts, 112 practice questions, each explained, and 168 facts, each linked to its source.
How the 2 CPD units are counted: reading time at 200 words a minute (58 minutes, measured from the lesson text), 1 minute for each of the 39 review questions and for each of the 25 test questions, rounded down to the whole hour.
How it fits the Law Society’s CPD rules.
The Law Society sets the rules and each solicitor applies them. This is what it says, and what we do about it.
| Question | What the Law Society says | What this course does |
|---|---|---|
| How many units do I need? [S1] [S2] | Ten units a CPD year, with at least one in each of four compulsory fields. | The certificate shows the units counted from the course content, rounded down to a whole hour. |
| Can an online course count? [S2] | Interactive web-based programs earn 1 unit per hour with no cap; passive audio or visual study is capped at 5 units. | Each lesson has review questions, practice files that ask you to choose, and a final test. |
| Does the Law Society approve courses? [S2] [S1] | It has no process for pre-approving providers or courses; CPD is self-assessed. | We do not claim approval. You decide whether it counts. |
| Which field? [S2] | Providers may suggest a field; the practitioner decides. | We suggest practice management and business skills; you choose. |
| What must I keep? [S1] | A record and evidence for at least 3 years, produced within twenty one (21) days if audited. | The certificate includes a ready record entry. |
Your certificate, as soon as you pass.
Type your name, pay and download it straight away as a PDF: the certificate, a training record and a ready entry for your CPD log.
Certificate of completion
Cyber fraud, payment redirection and AI impersonation in legal practice (2027 edition)
This is to certify that
Sample Name
has completed the self-paced online course from Aptia Skills and passed its final test with 23 out of 25 right (pass mark 20).
- Your role
- NSW solicitor
- NSW practising certificate number (partly hidden)
- *****678
- CPD units (rounded down)
- 2 CPD units
- Study time
- 122 min
- What the NSW CPD rules ask, and where this course fits
- Payment redirection: when the client’s bank details change
- Trust money duties when something looks wrong
- Impersonation: banks, clients and cloned voices
- Identity, documents and fake clients
- Four files to practise on
- Payment redirection and business email compromise
- AI-written phishing and impersonation by email, SMS and chat
- Verification habits that stop most of these scams
- Account takeover, passwords and MFA fatigue
- Synthetic identities and fake documents
- Voice clones and deepfake video calls: an emerging risk
- When it happens: the first hour
CPD in NSW is self-assessed and the Law Society does not pre-approve courses. You decide whether this course counts, how many units to claim and which field it falls in, and you keep your own CPD records.
- Date issued
- 2 November 2026
- Issued and signed by
- Aptia Skills · Opus Vault
What your certificate includes
- A PDF certificate of completion (A4) with a unique number. Download it straight away. Your name, your role, and your NSW practising certificate number if you choose to give it (partly hidden).
- A training record. The thirteen lessons with the reading time of each and the kinds of source they draw on.
- A ready entry for your CPD log. The activity, provider, date, 2 CPD units counted and how, and a line on why it is relevant. You edit it.
- A QR check code. Anyone can check in seconds that it is genuine and still valid.
- A purchase receipt. With the price and what you agreed to before paying.
A$89Australian dollars · one payment
You pay only after you pass. By card, Apple Pay or Google Pay. No account, no subscription. If we get something wrong, we fix it or refund you.
Take the test and get itTraining a team? Coming soon: one link per person and one invoice. Email hello@aptiaskills.com.
Quick answers for NSW solicitors.
Short pages, answer first, each with its sources.
- CPD unitsTen units, four fields, one table.
- Do online courses count?Interactive versus passive, in the Law Society’s words.
- Payment redirectionThe most common scam against legal practices.
- Trust irregularitiesThe duty to report, and what counts.
- Bank and voice scamsFake fraud teams and cloned voices.
The rules, plainly.
We are a private training provider, not a public body. Tap each answer to see its source.
How many CPD units do NSW solicitors need?Ten units each CPD year (1 April to 31 March), with at least one unit in each of four compulsory fields.
- NSW solicitors must complete ten CPD units each CPD year, which runs from 1 April to 31 March. [S1] [S2]
- The ten units must include at least one unit in each of four compulsory fields: ethics and professional responsibility; practice management and business skills; professional skills; and substantive law. [S1]
Does the Law Society approve CPD providers or courses?No. It says it has no process for pre-approving providers or courses. Each solicitor assesses the activity and decides how many units to claim.
- The Law Society of NSW says it has no process for pre-approving CPD providers or courses; each solicitor decides how many units to claim for an activity. [S2] [S1]
- CPD is based on self-assessment: if you assess that an activity extends your knowledge and skills in areas relevant to your practice needs or professional development, you can claim it. [S1]
Does an online course count?An interactive web-based program earns 1 unit per hour with no cap. Passive audio or visual private study is capped at 5 units. Interaction is the difference.
- A seminar, workshop, lecture, conference, discussion group, multimedia or web-based program earns 1 unit per hour, minus refreshment breaks, with no cap. [S2]
- Web-based programs are uncapped, while private study of audio or visual material is capped at 5 units. [S1]
- The distinction is interaction: web-based programs offer opportunities to interact with the material, while private study of audio or visual material is passive. [S1]
Which field does a fraud course fit?Practice management and business skills lists risk management and effective use of technology, but you decide which field an activity falls in.
- The Law Society’s examples for practice management and business skills include risk management, file management and effective use of technology. Providers may suggest a field, but it is up to the practitioner to decide which field an activity falls in. [S2]
How long do I keep CPD records?At least 3 years. If selected for the annual audit you have twenty one (21) days to provide them.
Must I report a suspected trust account irregularity?Yes. It is mandatory under section 154 of the Legal Profession Uniform Law (NSW), as soon as practicable, whatever the amount.
- Reporting trust money irregularities, or suspected irregularities, is mandatory under section 154 of the Legal Profession Uniform Law (NSW). [S6]
- All irregularities and suspected irregularities must be reported to the Law Society as soon as practicable, regardless of the monetary value involved. [S6]
How do I check a changed payment instruction?Telephone the client using details already on file, not those in the email, and confirm the instruction, BSB and account number.
- The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]