After maintaining this blog for over fourteen years the most common question posted in the comments is, "what’s the scam?" In today's digital age, a very simple, tried and tested way to scam the legal profession (and their staff) is a phishing scam. Attorneys and law firms have become prime targets for these phishing scams. In this blog post, I will explain how attorneys often fall victim to phishing scams and what steps they can take to protect themselves and their clients.
Understanding Phishing:
Phishing is a deceptive technique employed by cybercriminals to trick individuals into revealing sensitive information such as passwords, credit card numbers, or personal identification details. These scams usually come in the form of seemingly legitimate emails, messages, or websites that mimic trusted entities or individuals. In the case of attorney email scams, the trick is to get the attorney to deposit a large settlement check into their IOLTA. Shortly after getting hired (sometimes before any substantial work can be done, but usually no more than a demand letter goes out), the opposing party reaches out and says they will settle and that they are sending in settlement. Lawyer gets the check and tells the new client. Hooray!
Unsuspecting lawyer deposits the check in IOLTA. The Phisher tells the lawyer to send him a check, less the attorneys fees. Sometime later (2-3 weeks), the banks catch up, realize the settlement cashier’s check is fraudulent, and place a negative balance on the account. But the lawyers check has already been cashed and the Phisher has disappeared. FBI and other law enforcement agencies will not do much. Actually, we have never heard of law enforcement doing anything other than take a report.
Why Attorneys Are Vulnerable:
Trusting Nature: Attorneys often receive a high volume of emails and communication from clients, colleagues, and opposing parties. Their work relies heavily on responding promptly to messages, making it easier for phishing emails to slip through the cracks.
Lawyers Want Clients: The potential client looks well funded and the issue is within their practice area.
Busy Schedules: The demanding nature of legal work often leads attorneys to multitask, which can reduce their vigilance when scrutinizing emails and messages.
Common Phishing Scenarios for Attorneys:
Impersonation of Potential Clients: Cybercriminals will impersonate clients, sending emails that appear genuine, and request to start a case.
Common terms and style: They often will say, “in your jurisdiction” and other
turns of phrase that allow them to reuse the letter as a template and the name and address of the company is often times in a different font.
Real Businesses and Websites: They often use local businesses (in your jurisdiction) and they often have their own, fairly legit looking website.
No Retainer: I have rarely seen a retainer check sent before the other side "settles." When they do, it is a cashiers check that will eventually bounce. See more on that below.
Protecting Attorneys from Phishing Scams:
Verify Email Sources: Always double-check the sender's email address and be cautious of any discrepancies or unusual requests, especially those related to money transfers.
Employee Training: Law firms should invest in cybersecurity training programs to educate their staff about phishing risks and best practices for identifying and mitigating such threats. Most IT programs provide this training for this type of scam for free.
Beware of Urgency: Always take a moment to pause and verify any urgent or high-pressure email requests, especially those related to financial transactions or confidential data. Once you wire funds, you can never get them back.
Google Emails: Almost everyone that ends up at this blog had the good sense to google a portion of the email when their "spidey senses" started going off. They found themselves here. Do some sleuthing before taking on clients.
Look at Patterns: A majority of the phishing emails look like the ones you see here. But often times they include contracts and other information lending it credibility. Gone are the days of being able to spot scammers with bad grammar and spelling errors.
MOST IMPORTANT
Never Send Money That Has Not Cleared: We are taught that cashiers checks are as good as cash. We are not taught that it is easy to create fraudulent cashiers checks and the banks will not catch this when they are initially deposited. Make sure that your bank has confirmed the check has cleared, preferably in writing before refunding money.
Add to the conversation: If you got sent a variation of one of these scams, add it to the comments. That is how we stop these creeps and protect each other.
Conclusion:
It's crucial for legal professionals to remain vigilant and adopt cybersecurity measures to protect themselves from falling victim to these scams. By staying informed, educating staff, and being diligent, attorneys can continue to navigate the digital landscape.
