Dastardly email scam

pjn100

I am wondering if I have any case against my solicitor as a consequence of what has occurred. In a nutshell my solicitor's system was cracked and I received an email - as these things inevitably go - indicating that I should transfer funds into their client account and details were given etc. The detail of this is interesting. The email came from the EXACT same domain as usual, and it was part of an email exchange that she and I were already having precisely about where to direct some funds. So the "answer" I received was not in any way an unexpected one, and it dovetailed in with previous legitimate emails. Fortunately I spotted a spelling mistake and further scrutiny suggested that it was a spoof email.
My issue is that for this level of compromise to have occurred in my solicitors email system suggests a level of carelessness or incompetence that represents a failure of the duty to safeguard my personal data. As the fake emails were in a string (and highlighted as such by my email software) it seems clear that fraudsters had gained access to the email exchange for long enough to be able to set a very specific trap. They therefore my know quite a lot about my situation. The practice secretary let on that emails were missing from their system - further confirmation of the extent of the hack. The email headers within the fraudulent emails indicate them issuing from the solicitors domain name through Microsoft. My understanding is that to gain access would require the absence or failure to implement a number of security checks prior to a remote device gaining access to an email account . It could have turned out really badly but fortunately it didn't. It doesn't quite feel right to say these things happen - so be it.

davidmcn

What evidence do you have that the breach of security was at the solicitor's end rather than yours?

In any event, if you haven't suffered any actual loss I'm not sure what "case" you think you might have?

anselld

No competent solicitor would rely on email to instruct where to direct funds in either direction, regardless of the security or otherwise of their email server.

00ec25

pjn100 wrote: »

It doesn't quite feel right to say these things happen - so be it.

well they do, and there are plenty of posts reporting that they happen and that you should never rely on e mail instructions from solicitors for money transfers when buying or selling property

Slinky

Solicitors are wise to these scams and you'll most likely find some instructions in your paperwork not to be taken in by any instructions to pay into a bank account whose details you received via email. Our solicitor posted account details to us, with a warning that the account details would never be changed and that if we received such a request to report it to them urgently.

Kyresa

I tell clients in my client care letters about bank details and they won't change. I now also deliberately send my clients a separate sheet of paper in duplicate containing bank details and telling them that they will NEVER change. I also make them sign and return one copy precisely to cover my firm against the compensayshun brigade.

It's amazing how much paperwork client's don't read! :mad:

Email is NOT secure and no one should ever accept bank details, no matter who they purport to come from, via email!

pjn100

The evidence that the fraudulent emails came from the solicitors server is embedded in the emails themselves. It's possible to see the source of an email and the route it's taken between sender and receiver and it's entirely clear where these came from in this case.

DaftyDuck

... it's also easy to spoof those, and so the hack would come from your own computer...

Their being missing from the solicitors computer increases this likelihood.


What has this actually cost you, financially? That's the only sum you should be compensated for, if (IF) the attempted fraud was from their end.

If the answer to that is nothing, then why are you wasting anyone's time?

G_M

1) you've suffered no loss so have no 'case' against the solicitors

2) as others have said, you have no evidence the hack came from them - it may have been your email that was compromised

3) you should inform your solicitor of what has happened so they can take appropriate precautions.

4) apart from the advice others have given about not relying on email for bank details, you should always start by sending £1.00, and confirm safe receipt before sending the full transfer amount

pjn100

Thank you all for taking the trouble to respond. I have had the fraudulent emails independently analysed and indeed they did originate from the solicitors server and not my side. They was the very first thin that I established. I have informed the solicitors but their response gave no acknowledgment of there being a problem their side whatsoever - but that's not suprising. I will report the matter to the information commissioners office and leave it at that.

Davesnave

Kyresa wrote: »

It's amazing how much paperwork client's don't read! :mad:

OTOH, if they do read it, and it contains a basic punctuation error, they might be suspicious.....


Just sayin'