Many clients view their attorneys as immune to the trials and tribulations of ordinary folk. However, we are just as susceptible to deception, fraud and scams as anyone. There is a recent trend targeting attorneys and their clients to perpetrate fraudulent schemes and steal money.
One example involves real estate purchasers receiving an email on the morning of a scheduled closing, seemingly from their "attorney's" office. The email says that the attorney’s office will no longer accept a bank check from the purchasers for their closing funds. The email goes on to instruct the purchasers to send their closing funds by wire transfer to an account and provides the wiring instructions. The purchasers dutifully follow the email instructions and receive a thank you email. The purchasers arrive at the closing without a check for the money due at closing and tell their attorney they made the wire transfer as instructed. Of course, the attorney has no knowledge of the wire transfer because the email to the purchasers did not come from the attorney's office. The purchasers’ funds are gone.
Many victims have lost significant money ― even their life savings ― due to this type of scam. While the FBI is investigating these attacks, it is likely too late for the attorneys' clients. There is little or no hope of ever recovering the money. Variations on this scheme abound.
Although there are many precautions attorneys must take to guard your information and protect the privacy of your communications, these attacks can occur without the attorney’s email system ever being hacked. It is possible your email account, that of a real estate broker, mortgage broker, loan officer, or any of the large number of people involved in the transaction and privy to your email communications might have been hacked. Once the criminals get into the system, they monitor email traffic and, at the opportune moment, insert themselves by impersonating one of the parties, hijacking your trust to steal your money.
This means that everyone involved in the transfer of funds for any reason should be vigilant against fraud and deception.
The best way to protect yourself is to call your attorney’s office yourself if you receive this kind of email. If someone involved in your transaction requests funds or personal information from you by email, fax, or any other form of indirect communication, you should verify the request verbally (by telephone or in person) with someone known to you.
This scam highlights the importance of the personal relationship between attorneys, their staff, and their clients. At the beginning of your relationship, your attorney should provide you with a phone number. Any subsequent communication using a different number should be viewed with skepticism and verified by calling the original number.
There are some simple steps you can take to protect yourself, and others, from your email account being hacked:
- If you are using web based email such as Gmail, Yahoo or Hotmail, use 2-step verification to authenticate your account.
- Use strong passwords and change your password every six months. Strong passwords include numbers, symbols, capital letters, lower-case letters, and in some systems punctuation marks. Don’t write your password down on a post-it and stick it to your device. There are many ways to generate memorable strong passwords. Here are a few.
- Use strong security questions and answers. Not your cat’s name that anyone who looks at your Facebook profile can find out.
- Examine emails carefully before opening to make sure they are really from a trusted source.
- Delete emails from untrusted sources without opening them.
- If you’ve already opened an email, don’t click on any links or attachments.
- When browsing the internet, be careful where you go and what you click on.
- Anti-malware security software should be installed on your device and kept up to date. Yes, even (and perhaps especially) your smartphone.
- Avoid accessing your email from untrusted devices, like public computers. Two-step verification helps with this.
- Minimize the amount of personal information you include in emails, and restrict personal information to the most secure email account you have.
There are many other things you can do to make your email more secure, but there is no foolproof way to secure your email. A little research will reveal other, more complicated measures you can take, such as using proxy servers and secure VPNs.
Criminals are out to get your personal private information because it is valuable to them and those they sell it to. Your best protection is to be careful and vigilant, so you can help us help you.
