Cyber-attacks on law and real estate firms are on the increase. With the recent real estate boom cybercriminals are targeting the property and real estate sector due to the high volume and dollar value of property settlements and deposits. Firms in these industries need to continually be alert to cyber fraud, and to take extra precautions before transferring funds to external bank accounts.

There has been an increase in business email compromise (BEC) scams, which is a scam where cybercriminals impersonate parties to a property transaction (such as real estate agents or conveyancers) and hack emails providing fraudulent bank details for settlement or rental payments.

Cyber-attacks on firms

Cyber criminals are now aware it has become more common for firms to verbally check bank account details before effecting electronic payments, and are now altering details within emails and other documents being sent to clients. These alternations could include:

• Modifying phone numbers in the body of emails and/or email signature blocks
• Altering phone numbers and even bank account details on invoices and other PDF attachments.

Cyber criminals have also been known to follow up the conversation with a text message confirming the fraudulent account details.

In order to protect your firm against fraudsters and cyber-attacks it is important to ensure:

• The firms IT systems have the appropriate level of security. For example we would recommend using two-factor authentication to access emails on different devices.
• When you call to verify bank account details with a third party that you are confident that the phone number you are calling is correct.

Cyber-attacks on clients

There have been several reported instances where clients have received scam emails allegedly from their law firm or real estate agent directing payment to a new bank account. Typically, the fraudster became aware of the work the firm was doing for the client after gaining access to either the client or firm’s email account.

To protect your clients against scam emails directing payment of trust money to cyber criminals, you need to be proactive in warning clients they might be targeted with fake emails from your firm.

We recommend at the start of every matter you communicate to your clients:

• Your firm’s trust account details are in its engagement letter and will not be changed
• If the client receives an email from your firm containing changed trust account payment details, they must telephone the firm to verify the position, and not respond to the email.
• A warning is included in your email signature, asking clients to call the firms known phone number before making payment.

AFS Trust Audit Services

AFS has a dedicated trust account audit team and vastly experienced risk advisors who can assist in all aspects from day-to-day trust accounting advice and annual trust audits, to expert advice on implementing controls to prevent cyber fraud.

AFS has recently adopted a hybrid audit approach using the latest audit and portal software. This enables us to complete time consuming areas of the audit offsite with less disruption to your day-to-day operations, while still ensuring valuable face-to-face time to discuss the current state of your business and any changes in the industry and legislation.

If you wish to discuss any of our services, please email us as afs@afsbendigo.com.au or call us on 03 5443 0344.