Find your course
Menu

Course Guides Payment redirection

How does payment redirection hit law practices?

A scammer sits in an email conversation and slips in false bank details, so the money goes to them instead. The Law Society Journal calls it the most common scam affecting legal practitioners. The fix is to telephone the client using details already on file and confirm the instruction, BSB and account number.

Sources for this answer
  • The Law Society Journal says payment redirection phishing, also known as business email compromise, had the most impact on businesses, and is the most common scam currently affecting legal practitioners. [S9]
  • The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]

What it looks like

  • A fake email, ostensibly from the solicitor, leads a client to pay $400,000; the client’s computer appears to have been hacked.
  • A fake email arrives immediately after $1,000,000 is deposited in a solicitor’s trust account.
  • A staff member sees the real client email with the correct bank details in the deleted files just before a $350,000 transfer.
Facts and sources for this part
  • The Law Society has recorded a $400,000 payment made by a client after a fake email, ostensibly from the solicitor, with indications that the client’s computer had been hacked. [S5]
  • In a failed attempt, the fake email came in immediately after $1,000,000 was deposited into a solicitor’s trust account, and the solicitor sending the money telephoned first to confirm the trust bank account details. [S5]
  • In another alert, a staff member saw the real client email with the correct bank details in the deleted files just before a transfer of $350,000, which stopped a failed attempt. [S5]

The call-back rule

The Law Society recommends telephoning the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments.

In one attempt the solicitor sending the money telephoned first to confirm the trust bank account details, and the loss did not happen.

Facts and sources for this part
  • The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]
  • In a failed attempt, the fake email came in immediately after $1,000,000 was deposited into a solicitor’s trust account, and the solicitor sending the money telephoned first to confirm the trust bank account details. [S5]

Internal emails and conveyancing

An internal email is just as likely to be fraudulent as an external one. In property deals, criminals particularly impersonate conveyancing lawyers and communicate with their clients, so confirm any change of bank details by calling the sender’s established phone number or meeting them face to face.

Facts and sources for this part
  • It also warns that an internal email is just as likely to be fraudulent as an external one, and should be treated the same way when it gives instructions to pay trust money. [S9]
  • The Australian Cyber Security Centre warns that criminals target all parties in the real estate sector, with a particular focus on impersonating conveyancing lawyers and communicating with their clients. [S7]
  • It advises confirming any change of bank details by calling the sender’s established phone number or meeting them face to face before transferring any funds. [S7]

Practice habits

Tell clients in the engagement letter that the practice will never change its bank details by email, write the call-back on the file, and require a second person to approve large payments.

  1. Lesson 2Payment redirection: when the client’s bank details change4 min
Facts and sources for this part
  • The Law Society recommends that a practice telephone the client using details already on file, not those in the payment-instruction email, to confirm the instruction, BSB and account number before making large payments. [S9]