The bank that is not your bank
The Law Society’s Trust Account Department has seen a significant escalation in scammers calling, emailing or messaging lawyers and pretending to be from their bank, using technology to make the call appear to come from the bank’s own number.
The Law Society says your bank will never ask you over the phone for online banking passwords, one-time security codes, PINs or tokens. It advises contacting your bank separately using your banking app, or a phone number from your bank website, bank statement or bank card.
Remember
- Caller ID can be faked.
- Banks never ask for codes, passwords or tokens by phone.
- Hang up and call the bank on a number you source yourself.
Facts and sources for this part
- The Law Society’s Trust Account Department has seen a significant escalation in scammers calling, emailing or messaging lawyers and pretending to be from their bank, using technology to make the call appear to come from the bank’s own number. [S8]
- The Law Society says your bank will never ask you over the phone for online banking passwords, one-time security codes, PINs or tokens. [S8]
- It advises contacting your bank separately using your banking app, or a phone number from your bank website, bank statement or bank card. [S8]
The code-reset trick
In a reported case, property professionals were told a trust account payment had been blocked and the account needed a reset. The scammers asked for a code and used it to withdraw funds from the trust account.
The pattern is the one to remember: urgency, a believable reason, and a request for a one-time code. Whoever receives that code controls the account.
Remember
- A “blocked payment” story is a pressure device.
- A one-time code must never be read out.
- Whoever gets the code controls the account.
Facts and sources for this part
- In a reported case, property professionals were told a trust account payment had been blocked and the account needed a reset; the scammers asked for a code and used it to withdraw funds from the trust account. [S9]
A cloned voice on the phone
A reported scam used the voice of a client, probably AI-cloned, in a call to a law practice, and directed the firm to pay over $1 million from a deceased’s estate into the scammer’s bank account.
It is a reminder that recognising a voice is not verification. The people in your practice who handle estates and trust money will meet this first.
Remember
- A familiar voice is no longer proof.
- Estates and large trust payments are targets.
- Verification must not rely on how someone sounds.
Facts and sources for this part
- A reported scam used the voice of a client, probably AI-cloned, in a call to a law practice, and directed the firm to pay over $1 million from a deceased’s estate into the scammer’s bank account. [S9]
Checks that survive a good fake
Our advice: pick checks that do not depend on how a person sounds or how an email looks. Call back on a number from your file. Ask a challenge question that only the real client could answer, such as the name of the last document they signed with you, not their date of birth. Require a second person to approve any payment above a set amount.
Our advice: agree a simple code word with high-value clients at the start of the retainer. If a caller cannot give it, the payment waits. Treat deepfake video the same way: a face on a screen is not proof either.
Remember
- Call back, ask a challenge question, and use a second approver.
- Agree a code word with high-value clients.
- Do not treat a voice or a face on screen as proof.
Scenario: the “fraud team” call
Your practice manager takes a call. The caller says he is from the bank’s fraud team and that a trust account payment was blocked after a suspicious login. The number on the display looks like the bank’s. He asks her to read out the six-digit code just sent by text so he can release it.
The right move: do not read the code. Hang up. Ring the bank on the number printed on the card or in the banking app, tell them about the call, and ask whether anything is wrong. Tell the principal. If the code was given, tell the bank at once.
Red flags: an unsolicited call, a number that looks right, urgency about a blocked payment, and a request for a one-time code.
Remember
- Never read out a one-time code.
- Hang up and call the bank on your own number.
- If a code was read out, tell the bank immediately.
Facts and sources for this part
- The Law Society’s Trust Account Department has seen a significant escalation in scammers calling, emailing or messaging lawyers and pretending to be from their bank, using technology to make the call appear to come from the bank’s own number. [S8]
- The Law Society says your bank will never ask you over the phone for online banking passwords, one-time security codes, PINs or tokens. [S8]
- It advises contacting your bank separately using your banking app, or a phone number from your bank website, bank statement or bank card. [S8]
- In a reported case, property professionals were told a trust account payment had been blocked and the account needed a reset; the scammers asked for a code and used it to withdraw funds from the trust account. [S9]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
Which will a bank never ask you for over the phone?
Show the answer
Right answer: B, One-time security codes. Your bank will never ask you over the phone for online banking passwords, one-time security codes, PINs or tokens. [S8]
Question 2 of 3
What happened in the reported voice-clone scam against a law practice?
Show the answer
Right answer: B, A cloned client voice directed the firm to pay over $1 million from an estate into the scammer’s account. A scammer, probably using AI to replicate a client’s voice, directed the firm to pay over $1 million from a deceased’s estate. [S9]
Question 3 of 3
The caller ID shows the bank’s number. What does that prove?
Show the answer
Right answer: D, Very little: the display can be made to look like the bank. Scammers use technology to make a call appear to come from the bank’s phone number. [S8]