How to Minimize the Risk of Becoming a Victim of Wire Fraud
By Mark Bassingthwaighte
Lawyers remain a high-profile target for scammers hoping to get away with wire fraud and the attack vectors they are using continue to evolve. Here’ s just one example of how these scams typically work today. A lawyer represents a seller in a real estate transaction. Unbeknownst to anyone involved, someone has hacked into and been monitoring the seller’ s email for a period of time. Once aware that a transaction is about to take place, the hacker uses a spoofed email address of the seller to send new wiring instructions to the lawyer in order to have the funds sent to an account the hacker has access to. The lawyer fails to catch the altered email address and ends up wiring the proceeds to the wrong bank. So not good.
As an aside, some may wonder what a spoofed email might look like. Although there are a number of ways to spoof email, it can be as simple as this. If an actual email address is Lawfirm @ gmail. com, a spoofed address might be Lawfirm @ gmaiI. com. If an actual email happens to be Mark. Bassingthwaighte @ RECompany. net a spoofed address might read Mark. Bassingthwaite @ RECompany. net. Given the busy days we all have, would you catch a subtle change made in an email address like the two examples above? Many would not. It’ s particularly hard to see that the small letter“ l” was changed to a capital letter“ I” in the Gmail example. Also, be aware that in situations like the above example, the person whose email account has been breached varies, sometimes it’ s a lawyer’ s account, sometimes it’ s the seller’ s, and often it’ s the realtor’ s.
Regardless, all lawyers need to understand that hackers don’ t act immediately. Often, they will monitor breached email accounts for at least several weeks, and sometimes for months, in order to understand the business practices that are in play and to wait for an opportunity to redirect a significant wire. And just as important, lawyers need to know that these scams are not directed solely at those who practice in the real estate space. Scammers know that lawyers in a variety of practice areas move money and thus view all lawyers as potentially lucrative targets.
The more common wire fraud attack vectors scammers are currently using include bogus invoices, altered documents to include e-faxes, email spoofing, false impersonation, and the
Mark Bassingthwaighte, Esq. is the resident risk manager at ALPS Insurance. To learn more about how ALPS can support your solo or small firm, visit alpsinsurance. com
oldie but goodie, counterfeit check scam that continues to trip up far too many, which begs the question of what can be done to avoid becoming the next victim. Short of never being responsible for transferring funds of any kind, there isn’ t anything you can do that will make you safe 100 % of the time. However, the good news is you can get close.
First, security basics will always play a significant role. Of particular importance are the following. Never open any attachments or click on any links in email if the email comes from someone you don’ t know or is unexpected. Make a habit of checking to make sure inbound email addresses are legitimate. Periodically review sent and deleted email for suspicious activity. With cloud-based email accounts, periodically check account rules to make sure no unauthorized rules have been created, for example, an automatic forward rule to an unknown account. Use unique strong passwords( a combination of letters, numbers, and symbols) on all email accounts. Beware of SMS text messages notifying you that your password has been reset without your knowledge. Enable two-factor authentication if available on all email and all financial accounts. Keep your firewall, operating system, and security software current and avoid using unsecured wi-fi. Limit what you post on firm websites and other social media accounts, such as information about staff roles and responsibilities and out-of-office information, because hackers can use this kind of information to determine who to target and when.
Second, establish a policy on wire transfers and couple that with appropriate training of anyone at your firm who may at some
16 THE GAVEL