Ethics Corner Article

Dear Ethics Committee:

I have been seeing a lot of news about attorneys being the victims of wire transfer fraud, and my insurance company is asking questions about our handling of wire transfers. How can I protect myself and/or my Firm?

 

Wire transfer fraud continues to be a large problem for any company, including law firm, that handle funds belonging to third parties. Wire transfer fraud occurs when someone poses as a party in a transaction and sends wiring instructions that divert funds in that transaction from their rightful owner or recipient. Most commonly these transactions include an email that appears to be coming from the correct people, but the email address is slightly different than the regular email address. These emails often appear when the closing is imminent, but they can appear at any time to modify where funds are going. Having good procedures in place can protect you and your Firm from being the victim of wire fraud, and your insurance carrier may be able to provide best practices to help prevent the loss.

 

New Hampshire Rules of Professional Conduct Rule 1.1 (Competence) requires “attention to details … necessary to assure that the matter undertaken is completed with no avoidable harm to the client’s interest.” Failing to ensure that you are transferring funds to the correct party may arise to a violation. ABA comment [8] requires a lawyer to be current in the risks of relevant technology, including emails and wiring. At a minimum, attorneys should be familiar with how to spot these types of fraudulent emails and have a procedure that minimizes the risks posed when handling wire transfers.  A common tactic to reduce the risk of fraud is to call the recipient of the funds to confirm the wiring instructions, and to document that discussion, before any funds are wired. Do not rely solely upon emailed wiring instructions.

 

Further, New Hampshire Rules of Professional Conduct Rule 1.15(e) Safekeeping Property requires … ”a lawyer shall promptly deliver to the client or third person any funds or other property that the client or third person is entitled to receive…” Comment 5 indicates that an attorney only serving as an escrow agent, and not providing legal services is subject to the applicable laws relating to fiduciaries and not this particular Rule, however, most attorneys serve in both the role of escrow agent and legal counsel to at least one party in the transaction which may implicate this rule if the attorney is subject to wire transfer fraud.

Some things to consider to protect yourself and your Firm:

 

  1. Have a written policy on how you/your Firm accepts/transmits wire instructions;
  2. Train staff and be familiar with how to identify phishing emails;
  3. Confirm that the bank routing number provided resolves to the expected bank (FRBServices.org or https://routingnumber.aba.com)
  4. Check your Malpractice insurance for coverage for this type of loss, and make sure you are complying with ALL of the requirements for your coverage to apply, and/or consider cyber-liability coverage;
  5. Verify any outgoing wire instructions directly with the Payee (or a known, trusted representative of the Payee, like an attorney, realtor, lender) over the telephone at a known telephone number or a number obtained independently of the wire instructions;
  6. Hover your cursor over suspicious email addresses to check for indicating of display name deception or spoofing, but do not hover over links embedded in suspicious emails;
  7. Notify your clients how they are going to receive wire instructions from your office and make sure that they verify those wire instructions with someone at your office over the telephone at your normal office telephone number;
  8. If there is a modification to the wire instructions, make sure that you verify those modifications with the Payee (or a known, trusted representative of the Payee) over the telephone at a known telephone number obtained independently from the instructions;
  9. Have a Written Checklist for your File that verifies whom you received the instructions from and how the instructions were verified;
  10. Confirm/verify receipt of the wire when it is sent;
  11. Consider a separate account only used for wire transfers to minimize access to other funds.
  12. Regularly check your email account log-in activity for possible signs of compromise and new “rules”, such as auto-forwarding or auto-delete.
  13. Be cautious of “new” clients and/or others you don’t know who ask you to open or download documents or sign into a separate window or click on a link to view a document.

This Ethics Corner Article was submitted for publication to the NHBA Board of Governors at its May 20, 2021 Meeting. The Ethics Committee provides general guidance on the New Hampshire Rules of Professional Conduct and publishes brief commentaries in the Bar News and other NHBA media outlets. New Hampshire lawyers may contact the Committee for confidential and informal guidance on their own prospective conduct or to suggest topics for Ethics Corner commentaries by emailing the Ethics Committee Staff Liaison.