Here is what happened:
- Just a few weeks ago, a medium-sized BC law firm narrowly escaped a funds transfer fraud. The firm acted for a lender in a refinancing transaction and a notary was acting for the borrower. The paralegal at the firm received an email, from someone she thought was the notary, instructing her to deposit the funds to an escrow account for the purported reason that the notary's trust account was being audited. As per the firm’s protocol, the paralegal immediately brought this request to the attention of the lawyer. The lawyer phoned the notary who confirmed that the email was fraudulent, and the fraud was averted.
- More recently, a large law firm in the prairies was hit when acting for a corporate client selling property in a real estate transaction. The assistant believed she had received wire instructions by email from the client, but did not call the client to verify the instructions. When requisitioning the funds, the assistant ticked off the box on the firm’s checklist, falsely claiming she had called the client to confirm the wire instructions. Over a quarter of a million dollars was wired to the fraudster instead of to the client. In this case, if the law firm had emailed the client to confirm the wire instructions, the fraudster would have intercepted that email and confirmed the instructions. That is why the phone call to verify payment instructions, which didn’t happen, is critical. And it may be too late now to claw back the funds.
What can you do? You must educate your staff about frauds and the importance of verifying client wire instructions, especially if they come by email. The crux of it is that any time you are transferring trust funds, by any means, in any kind of legal matter, you are at risk and must verify emailed instructions through direct phone or in-person contact. You must initiate the phone contact with your client, the bank, or another lawyer or notary, in-person or by using the original phone number in the file or from a reliable directory. Do not rely on a party calling you to confirm instructions. That call is likely to come from the fraudster. Never use the contact information provided in the instructing email (or confirming letter) and implement a firm-wide protocol.
This secondary verification will also reduce your insurance deductible from a hefty 35% to 15% of the indemnified loss and costs in the event a Part C claim is made. You can download this checklist and use it for every payment.
If you think you have been a victim of a funds transfer fraud, immediately notify your bank and request a claw-back of the funds. Next, contact your IT department and cyber insurer (Coalition or other) to ensure the fraudster is not lurking in your system, and then report to us. Find out additional information here about funds transfer frauds, learn the steps you can take to prevent fraudsters from hacking into your systems here and what you can do to avoid cybercrimes hitting your firm. For more tips to help keep you from being victimized, see Real estate transactions – know your client primer (Summer 2021 Benchers’ Bulletin) and the Client ID & Verification web page.
Finally, vacation season is an appealing time for fraudsters to try their scams by taking advantage of when law offices have fewer staff working and there are added distractions. If you plan to be away from the office, arrange for a competent lawyer to supervise your practice and provide the lawyer and your staff with your contact information. Make sure that the lawyer and staff will ensure compliance with the anti-money laundering obligations in the Law Society Rules Part 3, Division 11 – Client Identification and Verification and BC Code rule 3.2-7. Further, staff may not deal with trust funds, except in accordance with the Law Society Rules Part 3, Division 7 – Trust Accounts and Other Client Property. We also strongly recommend that you review the social engineering tips found here with all staff. We know this is a lot, but you don’t want to be the next victim of fraud.
For the latest updates from LIF, follow us on Twitter @Lifbc.