Sophisticated criminals are increasingly targeting firms of solicitors with so-called ‘Friday afternoon’ frauds.
The Solicitors Regulation Authority (SRA) reported in March that it is receiving four reports a month of solicitors falling victim to these scams, which tend to involve a combination of identity fraud and cyber techniques, such as hacking and spear phishing.
The term Friday afternoon fraud has helped raise the profile of these types of scam – but it is important to note that they are certainly not confined to Friday afternoons, so firms and their employees must be vigilant at all times.
Why solicitors?
Solicitors’ firms are being pursued because of the large amounts of money that pass through their client accounts. Friday afternoons are targeted in particular because fraudsters realise that is when many property transactions complete, so there are significant sums of money exposed to strike at.
Our recent experience has shown that while it is the smaller practices that perhaps lack the wherewithal to spot an attack who are the most vulnerable, larger and more sophisticated firms are also preyed upon with equal success.
Fraudsters capitalise on the fact that solicitors are working to tight deadlines and often in stressful situations and use this as means to undermine the firm’s standard processes and procedures.
Increasingly sophisticated techniques
A notable feature of these Friday afternoon frauds is the relatively sophisticated techniques being employed. The fraudsters may spend weeks preparing for each fraud, but the sums of money involved make that investment more than worthwhile.
Essentially, the fraudsters are confidence tricksters who will use a variety of methods to convince you that they are somebody else – for example, your bank, your client’s bank or even another law firm. They will then try to trick you into releasing sensitive information that will allow them to access your client account, or persuade you to transfer funds to their account.
They may do this, for example, by calling and pretending to be your bank, saying that they think you have been subjected to fraud. There may be nothing about such calls that raises a red flag with you; the person on the other end of the phone may come across as credible, well spoken and articulate, and sound like they are speaking on a local landline.
E-mail is another popular tool with the fraudsters. Spear phishing e-mails are common, as is creating an e-mail address that looks like it belongs to your client – or hacking a client’s genuine e-mail account and sending e-mails from that.
A fraudster may even come into your offices purporting to be a client, bringing genuine-looking ID such as a passport or driver’s licence with the aim to infiltrate your business.
The role of insurance
Although solicitors’ professional indemnity insurance (SPII) plays an important role in protecting solicitors’ firms and their customers from such frauds as it repays any client monies that are stolen it must be remembered that this is a breach in the Solicitors Accounts Rules which is reportable to the SRA and may incur serious sanctions against the firm. Insurance should therefore always be looked at as the last line of defence and is not a substitute for robust practice processes and procedures.
Moreover, firms’ reputations can be badly damaged and clients significantly affected as their house purchase may fall through while the stolen funds are replenished with the possibility of allegations against the firm of negligence if it takes weeks or months for a claim to be paid.
This is where the quality of your insurer comes in. Because solicitors’ PI cover is mandatory, firms may think that there is no differentiation between providers. However, choosing an experienced insurer with good financial strength and a strong claims paying record can make all the difference.
How can you protect yourselves and your clients?
Consequently the best protection for solicitors is to have robust IT security in place. However, this does not guarantee absolute protection – particularly from sophisticated frauds carried out by phone or in person – and must be used in conjunction with appropriate security measures.
These include:
- Training employees about the risks and encouraging them to be vigilant.
- Checking that people are calling from where they say they are calling from. For example, if someone says they are calling from your bank, call someone you know at the bank to check, using a different phone line.
- Encouraging employees to use strong, unique passwords and change them regularly.
- Protecting operating systems with up-to-date security software.
- Using secure wireless connections – such as virtual private network (VPN) software – to encrypt wireless communications.
- Making sure that you are completely happy with your outsourced IT provider (if you have one), and that you understand how your systems are protected.
- Considering internal procedures, such as how you verify that the destination account for the proceeds of a house sale belongs to your client.
Ultimately, we would also like to see more solicitors considering using third-party accounts – such as an escrow account – to hold client funds, providing additional protection for both the firms themselves and their end clients.
Grant Clemence, Head of Professional & Financial Lines and Mark Casady, Deputy Head of European Financial & Specialty Markets, both at QBE Insurance, the largest writer of solicitors’ PI in the UK.
For more information, please go to: www.QBEeurope.com/solicitors