Bank-detail change scams in law and conveyancing

How these scams work

Criminals intercept or imitate emails between a firm, its clients and the other people involved in a matter. At a key moment, often close to exchange or completion, a message arrives saying the bank details have changed. If nobody checks, deposits, completion money or settlements can be sent to an account the criminal controls.

The SRA describes conveyancing as a common target, but not the only one. Probate, litigation and other matters that involve client money have been targeted too.

The message might come from a lookalike address that differs by a single character, from a genuine mailbox that someone has broken into, or from a criminal who has quietly watched the conversation for a while, sometimes using a hidden forwarding rule.

What to do when payment details change

1. Pause. Don't send money to new or changed details on the strength of an email or message alone, however urgent it sounds.
2. Verify independently. Contact the person using a phone number or process you already hold from earlier in the matter. Never use a number, link or contact detail given in the message that asked for the change.
3. No confirmation, no payment. If you can't get a clear confirmation, don't make the payment. Being told to "just get on with it" isn't confirmation.
4. Agree a clear procedure and share it. Decide how your team checks any change to payment details, make sure everyone knows it, and tell clients early on how you will and won't communicate bank details. For example, you might tell them that your bank details won't change by email.
5. Make it easy to question a payment. Anyone who feels pressured should be able to stop and ask a colleague, without blame.

If money may already have gone

1. Contact your bank straight away, using its official website or phone number, not details from any message.
2. Tell whoever looks after your IT as soon as you can, so they can check for a compromised mailbox or forwarding rules.
3. Then use our First Response steps for when money has been sent for official reporting routes.

We can't say whether money can be recovered. Your bank can tell you what it's able to do. The SRA's guidance covers reporting for regulated firms.

Technical defences help, but they aren't proof

Some measures make these scams harder, but none of them shows that a particular message or payment instruction is safe.

• Email authentication (SPF, DKIM and DMARC) makes it harder for criminals to send email that appears to come from your own domain. It doesn't stop lookalike domains or messages sent from a mailbox that has been taken over.
• Multi-factor authentication, sometimes called two-step verification, means a stolen password alone isn't enough to sign in to an account.
• Checking mailboxes for unexpected forwarding rules can reveal someone quietly reading messages.

Even with all of these in place, a changed payment instruction still needs independent verification.

On this site

• Kit information: Bank Details Changed? Payment Fraud Checks for Small Teams (UK)
• First Response: if money has been sent
• Where to report a scam, and checks you can use

Sources

• SRA: How to reduce the risk of being affected by cybercrime (opens in a new tab)
• NCSC: Phishing attacks: defending your organisation (opens in a new tab)
• NCSC: Business payment fraud (opens in a new tab)