By Sharan Gill, General Counsel, Law Mutual
Law Mutual is seeing a concerning increase in attempted email fraud targeting clients of small legal practices. Smaller firms can be particularly vulnerable, as they may not have access to the same cyber security resources and safeguards available to larger firms.
How the fraud typically occurs
In many cases, a fraudster sends an email to a client while impersonating the solicitor and provides fraudulent bank account details for funds to be transferred, often in connection with a property settlement, inheritance distribution or other financial transaction.
This type of impersonation may occur because:
- The law practice’s email system or computer has been compromised; or
- The fraudster uses an email address that closely resembles the solicitor’s genuine email address, making the communication appear legitimate.
Key risk controls
These incidents highlight the importance of robust cyber security measures, regular staff awareness training and effective verification procedures to reduce the risk of financial loss.
Verification procedures
The following controls are strongly recommended:
- Advise clients in writing, including through a prominent warning on all outgoing emails, that they must telephone the firm’s office to verify trust account details before transferring any funds. Clients should obtain the firm’s telephone number from a reliable source, such as the firm’s website, rather than from the email itself.
- Before transferring funds to a client or third-party recipient, the law practice should independently verify the recipient’s bank account details by telephone using a number obtained from a trusted and reliable source.
Staff awareness training
Staff awareness is a critical line of defence against cybercrime. All staff should understand:
- The nature and prevalence of email fraud and cyber scams;
- How cyber criminals attempt to compromise communications and payment processes; and
- The importance of strictly following the firm’s verification and risk management procedures.
Regular training and reinforcement of these protocols can significantly reduce the likelihood of a successful fraud.
Further guidance
Law Mutual has previously issued two Risk Alerts containing additional information on cyber security measures and other practical steps to mitigate the risk of cyber fraud.
Those Risk Alerts are available here:
- Cybercrime targeting lawyers and conveyancers on the rise
- Claims arising from money being paid to the wrong recipient
Remember: Call before you pay. A simple verification phone call can prevent a significant financial loss.
