Just as you need to protect your firm against scam emails directing payment of trust money to cyber criminals, you need to be proactive in warning clients they might be targeted with fake emails from your firm.
What's on this page?
There are increasing incidents where clients have received scam emails purportedly from their law firm directing payment to a new bank account. Typically, the fraudster became aware of the work the firm was doing for the client after gaining access to either the client or firm's email account.
At the start of every matter, tell your clients:
- your firm's trust account details are in its engagement letter and will not be changed
- if the client receives an email from your firm containing changed trust account payment details, they must either visit the firm in person or telephone the firm to verify the position, and not respond to the email
- only contact the firm via the contact details given in the initial interview and do not reply via the details in the email requesting the change as this could be part of the scam.
Put this information along with trust account details in your firm's standard engagement letter.
LPLC has a sample brochure called Cyber security – how to protect yourself you can use or adapt to give to clients.
Warn clients early and often
A single warning is rarely enough. Cyber criminals rely on clients forgetting earlier instructions when they receive a convincing fraudulent email weeks or months into a matter. For this reason, we recommend building repeated warnings into your standard workflows at every key touchpoint.
Specifically, consider providing a cyberfraud warning:
- as a stand-alone document included with the first documents sent to the client
- each time you send an invoice to the client
- any time you send a request for the forwarding of funds to anyone
- any time you meet with the client, including your first interview
Repeating the warning at these moments reinforces the message when it matters most and particularly at the point when money is about to move. A short, consistent reminder (even a single sentence) added to invoices and payment requests costs very little but can prevent a devastating loss for your client.
Email footer warnings
We also suggest adding a warning to your firm's standard email signatures along the lines of:
WE TAKE THE RISK OF CYBERFRAUD SERIOUSLY AND SO SHOULD YOU. Hackers have impersonated law firms and requested payment via email using their own account details. It is important you take the extra step to verify any bank account details you receive in an email from our firm by speaking to us before transferring money. Use a search engine to find our website and verify our phone number and call us. Do not reply to any emails asking for payment before verifying its authenticity with us. |
The LPLC also provides a selection of ‘Call before you pay email footer’ banners that you can add to your corporate email signature block.
Finally, discuss this important issue with colleagues and other firms, so everyone is aware of the risks.
Watch our short video about warning your clients about cyber security.
