Payment-diversion fraud: keeping client money safe in property deals

Property transactions involve large sums, several parties and a lot of email. That makes them an obvious target. A fraudster gets into a mailbox, or sets up an address that looks almost the same as the firm's, and waits. When the transaction is close to completion, they send a message that appears to come from the advocate or the accounts team: the bank details have changed, please send the money here instead.

The email usually looks right. It may continue a real thread, use the right names and refer to the right property. Clients have no reason to doubt it, and the money is often moved on within hours.

The end of the year is when many firms are rushing to complete transactions before the break, staff are on leave and replies are slower. Fraudsters know this. A request marked urgent, sent late on a Friday or just before the holidays, is more likely to be acted on without a second check.

Ask clients and staff to stop and check whenever they see any of these:

Tell every client, in writing at the start of the matter, that the firm will never change its bank details by email, and that they should call a number they already have before sending money. Inside the firm, require a call-back to a known number before any payment out to new account details, and have a second person approve large payments.

On the technology side, turn on multi-factor authentication for every mailbox, remove accounts that are no longer used, and set up your email domain so that messages pretending to be from it are easier to spot and block. A short security review will show where your firm is most exposed.

The safest payment instruction is one a client never has to read in an email. In Global Wakili, clients see their matter and their invoices in a secure client portal and pay from there, including by M-PESA STK Push, so the details come from the firm's own system rather than from a message anyone could forge. Documents go through the portal's vault instead of email attachments, and trust payments are recorded against each client with a tamper-evident audit trail.

Speed matters. Contact your bank and the receiving bank straight away and ask them to stop the funds, report the matter to the police, and check whether the incident involves personal data that has to be reported to the Office of the Data Protection Commissioner. Then find out how the fraudster got in before the next transaction.

This article is general information, not legal advice.