InView Autumn/Winter 2015

Issue 2 | Autumn/Winter 2015
11
Professional service firms are a key target for cyber criminals
owing to the type of data they hold, the type of transactions they
do, the access they can provide to other organisations and, in the
case of some law firms, the large sums of money they hold on
client account.
No professional firm considers itself bomb-proof against cyber
attacks but there are still a large number who view cyber fraud
as an IT problem and tackle it with an IT solution. That attitude
is outdated. Fraudsters rely on human fallacy and our desire to
be helpful. Weightmans have been instructed to deal with cases
involving two distinctive types of cyber scam that demonstrate
the lengths the fraudsters are prepared to go to, the lucrative
nature of cyber crime and just how helpful staff members can be.
The delayed transaction scam
Phishing is the practice of sending emails attaching PDFs or links
that when opened release a virus (malware) into the system that
will, unbeknown to the recipient, sit there gathering information
for the fraudster – in this particular instance, confidential details
about a client transaction.
Armed with the necessary information the fraudster was able to
manipulate the communications between lawyer and client to
redirect the proceeds from the transaction in his direction.
The scam went along the following lines:
The fraudster sent an email to the solicitor purporting to be
from their client, notifying the solicitor of new bank account
details into which the monies due to the client on completion
of the transaction were to be paid. At the same time an email
was sent by the fraudster (purporting to be the solicitor) to the
client in terms that completion of the transaction will be
delayed for seven days.
The solicitor, acting on what it believed to be the client’s
instructions, paid the completion monies to the new account,
an account connected to the fraudster. The client did not miss
the money until the seven day period had expired, by which time
the fraudster had moved the monies, or a considerable part of
them, beyond the jurisdiction.
The leak of confidential information and the loss of money
exposed the firm to the risk of legal action by the client. There
can be severe regulatory implications too; implications that
could, in the above example, have been avoided through the
implementation of a simple financial governance procedure
concerning the release of client funds.
The online banking scam
Vishing is phishing conducted over the telephone, a form of social
engineering where the fraudster uses information they have found
out about the firm or the particular individual to gain that person’s
trust and to trick them into giving up confidential information. In the
cases in which we acted this included the passcodes to the firms’
client accounts.
Targeting firms holding significant sums on client account, the
fraudsters struck on a Friday afternoon when, typically, the accounts
teams are very busy. The fraudsters, using information about the
firm obtained from public sources and about the client account itself
(probably obtained using phishing email and malware) to gain their
confidence, duped staff into assisting them transfer large sums of
money into bank accounts that they controlled.
The key to the fraudster’s success was persuading the unsuspecting
member of the account’s team that they were calling from the fraud
team of the firm’s bank because suspicious activity had been noted
on the firm’s account. This was done by referring to legitimate
transfers that had been actioned, transfers the fraudster could detail
because they had accessed the firm’s online bank account. They
then asked the individual if the firm was attempting to send a large
amount of money to a named third party – a transfer they claimed to
be able to see someone attempting to do. This was entirely fictitious
but had the desired effect of creating panic in the individual’s mind
so when the fraudster asked the individual to help him stop the
transaction he obliged by providing passcodes that allowed the
fraudster to withdraw significant sums from the firm’s client account.
This money was then quickly transferred out of the jurisdiction so it
could not be traced.
Tips for better protection from cyber crime
1. Raise awareness – staff need to be alive to the risk that the firm
could be attacked through them and of the need to be vigilant
at all times.
2. Keep pin numbers and security records safe and ensure that
work stations are locked when not in use.
3. Monitor password and information security policies and
ensure they are adhered to.
4. Record incidents of attacks, learn from them and make
staff aware of them.
5. Ensure antivirus software is up to date and firewalls
are installed.
Mickaela Fox, Partner
0151 242 7963
mickaela.fox@weightmans.com