The most common scam in legal practice
The Law Society Journal says payment redirection phishing, also known as business email compromise, had the most impact on businesses, and is the most common scam currently affecting legal practitioners.
In plain terms, a scammer sits in an email conversation between a client and the practice and slips in false bank details. The money then goes to the scammer instead of the client or the other party.
Remember
- Payment redirection is the leading scam against practices.
- It works by inserting false bank details into a real conversation.
- It does not need a technical attack on your systems.
Facts and sources for this part
- The Law Society Journal says payment redirection phishing, also known as business email compromise, had the most impact on businesses, and is the most common scam currently affecting legal practitioners. [S9]
What real alerts look like
The Law Society has recorded a $400,000 payment made by a client after a fake email, ostensibly from the solicitor, with indications that the client’s computer had been hacked. So the practice can be impersonated to its own client.
In a failed attempt, the fake email came in immediately after $1,000,000 was deposited into a solicitor’s trust account, and the solicitor sending the money telephoned first to confirm the trust bank account details. In another, a staff member saw the real client email with the correct bank details in the deleted files just before a transfer of $350,000.
Remember
- The scammer can impersonate you to your client.
- A phone call before paying stopped a large loss.
- Timing matters: scammers move when money has just arrived.
Facts and sources for this part
- The Law Society has recorded a $400,000 payment made by a client after a fake email, ostensibly from the solicitor, with indications that the client’s computer had been hacked. [S5]
- In a failed attempt, the fake email came in immediately after $1,000,000 was deposited into a solicitor’s trust account, and the solicitor sending the money telephoned first to confirm the trust bank account details. [S5]
- In another alert, a staff member saw the real client email with the correct bank details in the deleted files just before a transfer of $350,000, which stopped a failed attempt. [S5]
The call-back rule
The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments.
The Australian Cyber Security Centre gives the same advice for property deals: confirm any change of bank details by calling the sender’s established phone number, or meeting them face to face, before transferring any funds.
Our advice: read the account number back out loud, write down who you spoke to and when, and put the note on the file. A call-back that is not recorded cannot help you later.
Remember
- Use details already on file, not details in the instruction.
- Confirm the instruction, BSB and account number.
- Record the call on the file.
Facts and sources for this part
- The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]
- It advises confirming any change of bank details by calling the sender’s established phone number or meeting them face to face before transferring any funds. [S7]
Internal emails, conveyancing and targets
The Law Society warns that an internal email is just as likely to be fraudulent as an external one, and should be treated the same way when it gives instructions to pay trust money. A hacked mailbox inside the practice looks genuine.
The Australian Cyber Security Centre warns that criminals target all parties in the real estate sector, with a particular focus on impersonating conveyancing lawyers and communicating with their clients. A conveyancing practice is exactly that target.
Remember
- Treat internal payment emails with the same care as external ones.
- Conveyancing lawyers are specifically impersonated.
- Make the rule apply to everyone in the practice.
Facts and sources for this part
- It also warns that an internal email is just as likely to be fraudulent as an external one, and should be treated the same way when it gives instructions to pay trust money. [S9]
- The Australian Cyber Security Centre warns that criminals target all parties in the real estate sector, with a particular focus on impersonating conveyancing lawyers and communicating with their clients. [S7]
Scenario: new account for the estate distribution
You act for the executor of a modest estate. On Thursday afternoon an email arrives from the executor’s address, signed with her usual sign-off: “Please send the beneficiary’s share to this account instead. The old one was closed after a fraud on her card.” The domain is one letter different from the one you have on file (executor-law.example).
The right move: do not reply and do not pay. Ring the executor on the number already on your file, read the account number back and ask whether she sent the email. Tell your supervising solicitor, and look at the email headers. If she says she did not send it, report it as set out in the lesson on trust money duties.
Red flags: a change of bank details, a believable excuse, an afternoon deadline, a look-alike domain and an instruction to reply by email.
Remember
- Never pay on an emailed change of details.
- Ring the number on file and read the account back.
- If the client did not send it, report it at once.
Facts and sources for this part
- The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]
- The Law Society Journal says payment redirection phishing, also known as business email compromise, had the most impact on businesses, and is the most common scam currently affecting legal practitioners. [S9]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What does the Law Society recommend before making large payments on an emailed instruction?
Show the answer
Right answer: B, Telephone the client on details already on file to confirm the instruction, BSB and account number. It recommends telephoning the client using details on file, not those in the email, to confirm the payment instruction, BSB and account number. [S9]
Question 2 of 3
What helped stop a loss in the attempt that followed a $1,000,000 deposit?
Show the answer
Right answer: B, The solicitor sending the money telephoned first to confirm the trust account details. The solicitor sending the money telephoned first to confirm the trust bank account details. [S5]
Question 3 of 3
An executor’s email asks you to send a beneficiary’s share to a new account today. What do you do first?
Show the answer
Right answer: D, Ring the executor on the number on your file and read the account number back. Confirm the instruction by telephoning the client on details already on file, not those in the email. [S9]