When fraudsters intercept law firm communications and conduct cyber crime, the accounts to which they redirect funds are often opened and closed quickly to avoid lengthy paper trails and detection. So, incorporating a check on the length of time the account has been open into your risk management processes mitigates the risk of transferring funds to fraudsters.
When fraudsters intercept law firm communications and conduct cyber crime, the accounts to which they redirect funds are often opened and closed quickly to avoid lengthy paper trails and detection.
According to the Hiscox Annual Cyber Readiness Report there has been a 5-fold increase in the financial impact of a security incident to UK businesses, up from £8,000 in 2019 to £47,000 in 2020.
In its annual Risk Outlook, The SRA reported that in the first nine months of 2019, law firms reported losses of c.£4m of client money to criminals intercepting communications between law firms and their clients and redirecting funds to fraudulent bank accounts.
And while conveyancing continues to present the greatest risk, fraudsters are now also targeting other departments including private client, family and PI, where there are regular transactions between law firms and their clients.
One of the identifiers then when it comes to our Customer Due Diligence risk assessments should be some investigation into the length of time the bank account to which the funds are being transferred has been open.
A recently opened account isn’t a definitive identifier; there will be many reasons for people to have bank accounts which have been open for less than 12 months, it forms part of our Customer Due Diligence risk assessments.
This approach is encouraged in The Law Society’s various quality standards and accreditations, where a proactive approach is required.
Within the Lexcel accreditation which covers all areas of law the requirement is documented as follows
Practices handling financial transactions must have a procedure, which must include: the transfer of funds
(Lexcel England and Wales v6.1 Standard for legal practices, 2.5a)
For conveyancing practitioners The Law Society's Conveyancing Protocol states conveyancing practitioners should
Obtain evidence that the bank account is properly constituted as an account conducted by the seller for a period of at least 12 months. Confirm that remittance will be made to that account only
(The Law Society's Conveyancing Protocol: Stage A: Instructions; Acting for the Seller, Section 3)
And within the Conveyancing Quality Scheme Core Practice Management Standards,
Practices must have an information management and security policy, which should be accredited against Cyber Essentials. The policy must incorporate the following controls:
a procedure for verifying the banking details of other conveyancers and third parties to whom money is sent
(Conveyancing Quality Scheme Core Practice Management Standards, 6.2l)
And the risks are acknowledged in the Wills & Inheritance Quality Scheme
Practices will have procedures for the prevention of financial crime, including:
a: the person responsible for the procedure
b: a documented review of the procedure at least annually, to verify they are in effective operation across the practice.
(Wills & Inheritance Quality Scheme, 2.5)
Given the risk, and the potential costs in client monies, insurance and reputational damage, it is advisable that when it comes to red flags we should consider steps we need to incorporate into our risk mitigation for accounts that are less than 12 months old.
Lawyer Checker, the leading provider of funds transfer fraud risk mitigation tools now include a 12 month check within their Consumer Bank Account Check. Alongside the ability to verify bank account details of client to whom you are transferring funds, there is a traffic light alert to incorporate into your risk assessments to enable an informed decision about the transfer of funds.
For more information about Consumer Bank Account Checker please contact Tom Lyes on 0800 133 7127or email tom.lyes@lawyerchecker.co.uk
Lawyer Checker clients have access to a range of fraud mitigation tools, including our popular law firm to law firm bank account verification service, our law firm to client bank account verification service and remote client ID tool.
To find out more about how we can help you continue to mitigate the risks of funds transfer fraud please contact Tom Lyes (tom.lyes@practicalvision.co.uk) on 0800 133 7127
