Client Account Fraud and Payment Diversion Risk in Law Firms

A conveyancing transaction can move six figures in a single transfer, and criminals know it. Client account fraud — and payment diversion fraud in particular — has become one of the most common and most damaging risks a law firm faces, not because firms are careless, but because the fraud is designed to look completely ordinary until the money is gone.

How payment diversion fraud actually works

The typical pattern is simple and effective. A criminal gains access to (or spoofs) an email account belonging to the firm, the client, or another party to the transaction, such as an estate agent or a second law firm. At the point a genuine payment is due — completion funds on a house purchase is the classic example — the fraudster sends an email that looks like it comes from a trusted party, saying the bank details have changed. The new account is, of course, theirs. Because the email arrives in an existing thread, references real names and real deal details, and often lands at a moment when everyone is under time pressure to complete, it is easy to miss.

Firms are also targeted through more direct routes: fake invoices for firm expenses, "urgent" requests purportedly from a partner asking a junior member of staff to make a transfer outside normal process, and business email compromise where an attacker sits quietly inside a mailbox for weeks, learning how a firm communicates before striking.

Why law firms are particularly exposed

Conveyancing, probate and commercial transactions routinely involve one-off, high-value transfers to accounts the firm has not paid before — exactly the profile fraudsters exploit, because there is no established payment history to compare against. Add tight completion deadlines, multiple parties copied into email chains, and client account funds that sit outside the firm's own balance sheet, and you have conditions that reward speed over scrutiny. The controls set out in the SRA Accounts Rules exist precisely because client money needs a different level of protection than a firm's own funds — see our related piece on client money controls under the SRA Accounts Rules for the underlying framework.

Controls that actually stop it

The good news is that payment diversion fraud is largely preventable with a small number of consistently applied controls.

• Verify any change of bank details by phone, using a number you already hold on file — never a number taken from the email itself, which may also be controlled by the fraudster. Call the client or the other firm using contact details from an earlier, verified communication or your own records.
• Treat "urgent" and "confidential" as warning words, not instructions. Genuine urgency is common in legal practice, but fraudsters rely on urgency to shut down the instinct to double-check. Slow down precisely when you are being pushed to move fast.
• Require dual authorisation for any payment above a set threshold, and for any payment where bank details have changed. A second person, working from the same verification steps, catches what one person under pressure might miss.
• Train every fee earner and support staff member to recognise spoofed or lookalike domains (a single swapped character in a domain name is a common trick), inconsistent formatting, and requests that deviate from how a client or firm has communicated before.
• Give staff a clear, blame-free escalation route. Someone who suspects a payment instruction is fraudulent needs to know exactly who to flag it to immediately, without worrying about slowing down a transaction or looking foolish if it turns out to be genuine.

If a payment has already gone

Speed matters enormously. Contact your bank's fraud team immediately to request a recall of funds — banks can sometimes freeze money at the receiving end if notified within hours. Report the incident to Action Fraud (or the equivalent in your jurisdiction), notify your professional indemnity insurer, and consider what your regulatory reporting obligations require. Firms with clear, rehearsed escalation routes recover funds far more often than those improvising under pressure for the first time.

Building this into everyday practice

None of these controls are exotic. What makes them effective is consistency — applying them every time, especially on the transactions that feel routine, because routine is exactly what fraudsters count on. Good supervision plays a real part here too: a junior member of staff who has been shown, not just told, how to challenge an unusual payment request is your best line of defence. Our piece on effective supervision in legal practice looks at how firms build that kind of environment.

Is payment diversion fraud covered by professional indemnity insurance?

It depends on the policy and the circumstances — many PI policies do respond to certain cyber-enabled fraud losses, but cover, excesses and conditions vary significantly. Check your policy wording and speak to your broker before you need it, not after.

What is the single most effective control against payment diversion fraud?

Verifying any change of bank details by phone, using a number obtained independently of the email requesting the change. It is simple, low-cost, and closes off the fraud at its most common point of execution.

Should firms warn clients about this risk directly?

Yes. Many firms now include a standard warning in their client care letter and at the point completion funds are due, telling clients the firm will never change bank details by email alone and inviting them to call a known number to confirm anything unusual.

How does this connect to wider CPD requirements?

Fraud awareness sits naturally alongside a firm's broader continuing competence obligations, since recognising and responding to financial crime risk is part of maintaining day-to-day practice standards. You can browse relevant courses on our CPD hub.