By Sharan Gill, General Counsel, Law Mutual (WA), and Ashley Macknay, Litigation Counsel, Williams & Hughes
There have been several claims against solicitors in recent months arising from email-based fraud. Fraudsters are becoming more astute in their methods, sometimes with serious consequences for both solicitors and clients.
Concerningly, in one of these matters (now finalised), a fraudster gained access to the solicitor’s legitimate email account and sent correspondence to the solicitor’s client directing that property settlement funds be transferred to a bank account controlled by the fraudster. A large sum was withdrawn by the fraudster from the account before the fraud was discovered.
This article addresses three issues:
- Verification of the solicitor’s bank account details;
- Verification of client and third-party bank account details; and
- Cyber-security measures.
There have been previous alerts on cyber-security given by Law Mutual (WA), and this risk alert builds on those. You can read them here and here.
- Verification of the solicitor’s bank account details
Recent professional indemnity claims against solicitors have illustrated the vital need for solicitors to advise clients in writing, at the beginning of the retainer, to telephone the solicitor’s office to verify their trust account details before transferring any funds.
Coupled with that advice, clients ought to be informed in writing that they should obtain the telephone number of the solicitor from a verifiable source, such as the law practice’s website, and not rely on a number contained in emails and pdfs, especially when that correspondence contains bank account details.
Why at the beginning of the retainer?
The importance of advising clients to verify trust account details by telephone at the beginning of the retainer has been illustrated in some of the claims referred to above.
In one case, the solicitor wrote to the client shortly before settlement, provided the solicitor’s trust account details and advised the client to verify those details by telephone. However, by then it was too late. The fraudster, posing as the solicitor, had already emailed the client and provided fraudulent bank account details, and the client had deposited funds into that account.
Why should the advice be in writing?
There are at least two reasons why the advice concerning verification of the trust account details should be in writing:
- It highlights its importance to the client. Solicitors should also consider the prominence of the advice. Burying it in small print in a footer will not necessarily warn, or be taken to be a reasonable warning to, the client.
- If, at the commencement of the retainer, the advice is prominently displayed in writing, it will provide documentary evidence that the advice was given. That evidence is likely to minimise the risk of a claim against the solicitor should the client not heed the warning and fall victim to a fraudster.
Why not rely on an email from the solicitor to ascertain the solicitor’s telephone number?
The likelihood is that, when requesting money or providing bank details, the fraudster will be able to compose an apparently authentic email purportedly from the solicitor, including a fraudulent telephone number. In one instance, the fraudster in the guise of the solicitor had been corresponding with the client by email for about two months. In another instance, the fraudster corresponded with the solicitor and the client, variously purporting to be the solicitor, the client and a representative of the lending bank without either the solicitor or the client being alerted.
Therefore, reliance on a telephone number provided in an email or pdf is very risky. The client should be warned to ensure that the telephone number being used to verify the solicitor’s bank details is authentic by confirming it from a reliable source (that is, at the very least, not the correspondence that provides the bank account details).
How should the written advice be given?
Some practitioners provide this advice on every email sent by them. Other practitioners advise clients in writing that their trust account details will never change, so that any purported correspondence advising of a change in trust account details will be fraudulent.
Solicitors could also consider whether it would be effective to insert a suitably prominent statement in their standard cost agreement warning about the prevalence of cyber-criminals targeting solicitors and stating to the effect that it is the client’s responsibility to verify the firm’s bank details by telephone, using the telephone number on the firm’s website, and the firm accepts no responsibility for payments made to any other account.
Additionally, solicitors could include a provision in their standard cost agreement which specifies the firm’s trust account details and which states that, unless the cost agreement is expressly varied in writing, that trust account is the only such account used by the practice, all payments into trust are to be made to that account, and any purported electronic communication from the firm specifying different bank account details is not to be relied upon by the client and, if used, will lead to the funds being misdirected. Again, it would be for the law practice concerned to consider the efficacy of such a provision.
2. Verification of client and third-party bank account details
The need for verification of bank details applies to the solicitor’s bank details, the client’s bank details and, when solicitors are instructed to pay third parties, the third parties’ details as well.
Law Mutual (WA) has managed claims in which solicitors have received fraudulent emails purportedly from their client requesting the transfer of funds to a fraudulent bank account.
Solicitors should telephone the relevant client or third party, using a telephone number reliably sourced, to verify bank account details before the transfer of any funds to them. Reliable sources would include the telephone number provided by the client when instructions were first received, a number from the client or third party’s business website (if applicable), and a number which has previously been confirmed as the client or third party’s number.
It is strongly recommended that a form be created which requires the person performing the verification to record both the relevant details of the verification and the basis upon which the telephone number was confirmed as correct.
3. Cyber-security measures
Practitioners are advised to have appropriate cyber-security measures in place to mitigate the risk of email accounts being compromised.
The Australian Signals Directorate has formulated the Essential Eight – a list of eight strategies to mitigate against cybersecurity incidents. Failure to comply with the Essential Eight increases the risk a solicitor might be found to have negligently failed to put protective measures in place to minimise risk of a hack.
The Cyber Precedent, an information campaign by the Law Council of Australia to assist the legal profession further defend itself against growing cyber threats, is also a useful resource in that respect.
Conclusion
Professional indemnity claims involving misdirected trust funds cause practitioners significant stress, may cause reputational damage, and can have disciplinary consequences.
The measures to mitigate the risk of such claims are relatively straight forward but need to be rigorously followed and documented. Every payment made into trust, and every payment from trust, must be treated as at risk, and all reasonable steps must be taken to ensure funds end up at their intended destination.
However, these measures only mitigate – not eliminate – the risk of fraud. Solicitors should re-evaluate every year whether they have adequate insurance, given the nature of their practice. Circumstances can change rapidly, and risk profiles can change with them. For instance, taking on a new area of practice, or changes in the broader economy, can expose solicitors to a higher level of risk.
A recent example has been the skyrocketing costs of housing. Those solicitors conducting residential conveyancing need to factor in the increasing amounts of money they are handling as housing prices have increased. The current Limit of Indemnity under the Law Mutual (WA) policy is $2,000,000, inclusive of costs. If a solicitor is handling conveyancing transactions which significantly exceed that amount, they should consider whether they need top up insurance.
In conclusion, if solicitors implement strong verification and cyber-security measures and have adequate insurance in place for the nature of their practice, they will have gone a long way to reducing their exposure to the risk of cyber fraud.
