Solicitor Conveyancing Scam - HELP! (life savings lost!?)
Discussion
My sister has rang me in tears.
She is in the process of buying a flat. Very arduous and drawn out process.
Monday she received an email from the solicitor she'd been dealing with requesting the balance of the deposit. She had already paid the 10% of it.
It had all the correct details, her name, the required balance, addresses etc and written in exactly the same 'style' the solicitor had used to date.
The account was different to the one that she paid the original deposit into. It advised to call someone in the 'accounts department' to confirm the account details to pay the money into.
She called the number given to the 'accounts department' and they confirmed the situation so the money was transferred (in person at the bank).
She replied to the email to the solicitor confirming the money had been send. The solicitor replied with thanks.
48 hours later she received a phone call from the conveyancing solicitor querying that they hadn't received the funds. Confused, my sister sent her the email chain. Within a couple of hours, the partner from the law firm called her.
It seemed their system had been cyber attacked and my sister had been a victim of the solicitor conveyancing scam (that we've discussed here before).
The email was a fake. They knew all her details.
The bank transfer was to a fake amount.
The accounts department was fake.
She's of course been in contact with the bank and the fraud team, they've opened a case.
The law partner is looking into it from their end. It does seem to be a hack on their side (rather than my sister's side).
Where does this leave things?
She's understandably devastated. This is a massive amount of cash and her entire life savings.
I presume the bank bear no blame, after all they transferred the amount to the account specifically requested by the client.
If it is proved the law firm were hacked and their cyber security was not up to scratch, should they be shouldering this blame?
Do they have (fraud) insurance for this kind of situation?
My sister doesn't know if others have been affected.
She was supposed to complete this weekend.
Any help/advice gratefully received. I have a terrible terrible feeling my sister will be left with nothing.
She is in the process of buying a flat. Very arduous and drawn out process.
Monday she received an email from the solicitor she'd been dealing with requesting the balance of the deposit. She had already paid the 10% of it.
It had all the correct details, her name, the required balance, addresses etc and written in exactly the same 'style' the solicitor had used to date.
The account was different to the one that she paid the original deposit into. It advised to call someone in the 'accounts department' to confirm the account details to pay the money into.
She called the number given to the 'accounts department' and they confirmed the situation so the money was transferred (in person at the bank).
She replied to the email to the solicitor confirming the money had been send. The solicitor replied with thanks.
48 hours later she received a phone call from the conveyancing solicitor querying that they hadn't received the funds. Confused, my sister sent her the email chain. Within a couple of hours, the partner from the law firm called her.
It seemed their system had been cyber attacked and my sister had been a victim of the solicitor conveyancing scam (that we've discussed here before).
The email was a fake. They knew all her details.
The bank transfer was to a fake amount.
The accounts department was fake.
She's of course been in contact with the bank and the fraud team, they've opened a case.
The law partner is looking into it from their end. It does seem to be a hack on their side (rather than my sister's side).
Where does this leave things?
She's understandably devastated. This is a massive amount of cash and her entire life savings.
I presume the bank bear no blame, after all they transferred the amount to the account specifically requested by the client.
If it is proved the law firm were hacked and their cyber security was not up to scratch, should they be shouldering this blame?
Do they have (fraud) insurance for this kind of situation?
My sister doesn't know if others have been affected.
She was supposed to complete this weekend.
Any help/advice gratefully received. I have a terrible terrible feeling my sister will be left with nothing.
Edited by g3org3y on Thursday 14th June 23:48
I would suggest getting in touch with the bank ASAP, but probably long gone. Also action fraud, but again probably difficult to recover.
Not sure if there is some forensic IT company that can prove your sisters computer has not been hacked, might help with a claim against the lawyers in due course.
Not sure if there is some forensic IT company that can prove your sisters computer has not been hacked, might help with a claim against the lawyers in due course.
greygoose said:
Has she reported it to the police too? I suspect the money is long gone sadly.
Action Fraud are involved.wattsm666 said:
I would suggest getting in touch with the bank ASAP, but probably long gone. Also action fraud, but again probably difficult to recover.
Not sure if there is some forensic IT company that can prove your sisters computer has not been hacked, might help with a claim against the lawyers in due course.
Bank have been contacted through Action Fraud. I don't know whether the fake account has been cleaned out or whether money remains that can be frozen.Not sure if there is some forensic IT company that can prove your sisters computer has not been hacked, might help with a claim against the lawyers in due course.
cuprabob said:
What a terrible thing to happen. Sorry can't help but I really do hope your sister gets her money back.
Me too, feel ill just imagining the situation. 
You would like to think the solicitor's lack of IT security (something warned about in previous thread on pistonheads, apparently common place) means they are liable for this.
If their systems were hacked, negligence on their part for not securing it...? I really hope so, for the sake off your sister.
Could try using house insurance legal cover? Or seeking a solicitor separately?
I'd be amazed if your sister completes this weekend.
Whole thing is not unheard of eg
https://www.telegraph.co.uk/money/consumer-affairs...
https://www.telegraph.co.uk/money/consumer-affairs...
Make sure your sister keeps all the e-mails from the fraudster - the message headers may indicate if the e-mail originated inside the solicitors network (a sign of potential compromise) or has been spoofed and is coming from Gmail / Hotmail / etc.
Whole thing is not unheard of eg
https://www.telegraph.co.uk/money/consumer-affairs...
https://www.telegraph.co.uk/money/consumer-affairs...
Make sure your sister keeps all the e-mails from the fraudster - the message headers may indicate if the e-mail originated inside the solicitors network (a sign of potential compromise) or has been spoofed and is coming from Gmail / Hotmail / etc.
Awful thing to happen. Hopefully the police will be able to confirm the solicitors did not take adequate precautions to protect customers identities. When we buy properties, we now always make a small test payment of £10 and only transfer further funds when we have spoken to the solicitor dealing with our case to confirm funds have been received correctly.
This is scarily common. A friend of mine was in a similar position a couple of years ago. Intercepted email from the solicitor with false bank and contact details just as the OP..
Luckily(!) it was the deposit rather than the balance, so £35k rather than the £155k balance.
Reported to action fraud, bank & solicitors, and after 2 years so far it looks like they will almost certainly get the money back, either from the solicitors or bank or both once liability is agreed by them. Solicitors didn't have their systems properly secured and the bank didn't properly follow procedures for opening the pirate account.
An incredibly stressful situation for them. Money wasn't recovered and no one was detected.
Terrible for the OP.
Luckily(!) it was the deposit rather than the balance, so £35k rather than the £155k balance.
Reported to action fraud, bank & solicitors, and after 2 years so far it looks like they will almost certainly get the money back, either from the solicitors or bank or both once liability is agreed by them. Solicitors didn't have their systems properly secured and the bank didn't properly follow procedures for opening the pirate account.
An incredibly stressful situation for them. Money wasn't recovered and no one was detected.
Terrible for the OP.
cuprabob said:
What a terrible thing to happen. Sorry can't help but I really do hope your sister gets her money back.
Thank you. I hope so too.Andehh said:
You would like to think the solicitor's lack of IT security (something warned about in previous thread on pistonheads, apparently common place) means they are liable for this.
If their systems were hacked, negligence on their part for not securing it...? I really hope so, for the sake off your sister.
Could try using house insurance legal cover? Or seeking a solicitor separately?
Yes, I think a lot will depend on where the hack occurred.If their systems were hacked, negligence on their part for not securing it...? I really hope so, for the sake off your sister.
Could try using house insurance legal cover? Or seeking a solicitor separately?
Harpoon said:
I'd be amazed if your sister completes this weekend.
Whole thing is not unheard of eg
https://www.telegraph.co.uk/money/consumer-affairs...
https://www.telegraph.co.uk/money/consumer-affairs...
Make sure your sister keeps all the e-mails from the fraudster - the message headers may indicate if the e-mail originated inside the solicitors network (a sign of potential compromise) or has been spoofed and is coming from Gmail / Hotmail / etc.
I don't know what will happen.Whole thing is not unheard of eg
https://www.telegraph.co.uk/money/consumer-affairs...
https://www.telegraph.co.uk/money/consumer-affairs...
Make sure your sister keeps all the e-mails from the fraudster - the message headers may indicate if the e-mail originated inside the solicitors network (a sign of potential compromise) or has been spoofed and is coming from Gmail / Hotmail / etc.
As mentioned, the partner from the law firm called her very quickly after the fraud was identified. She is to only deal with him from now on. I will be interested to see what happens tomorrow.
It is a local firm, a lot of their bread a butter work is conveyancing. I don't know whether they would admit fault and recompense my sister for the sake of local reputation. Probably (very!) wishful thinking.
My understanding is that they've just recently undergone a merger with another local firm.
eldar said:
This is scarily common. A friend of mine was in a similar position a couple of years ago. Intercepted email from the solicitor with false bank and contact details just as the OP..
Luckily(!) it was the deposit rather than the balance, so £35k rather than the £155k balance.
Reported to action fraud, bank & solicitors, and after 2 years so far it looks like they will almost certainly get the money back, either from the solicitors or bank or both once liability is agreed by them. Solicitors didn't have their systems properly secured and the bank didn't properly follow procedures for opening the pirate account.
An incredibly stressful situation for them. Money wasn't recovered and no one was detected.
Terrible for the OP.
I presume your friend had another group of solicitors involved to action the above? A costly and drawn out process I suspect.Luckily(!) it was the deposit rather than the balance, so £35k rather than the £155k balance.
Reported to action fraud, bank & solicitors, and after 2 years so far it looks like they will almost certainly get the money back, either from the solicitors or bank or both once liability is agreed by them. Solicitors didn't have their systems properly secured and the bank didn't properly follow procedures for opening the pirate account.
An incredibly stressful situation for them. Money wasn't recovered and no one was detected.
Terrible for the OP.
When we bought we used the Safe Buyer Scheme: https://www.safebuyerscheme.co.uk/
My sister's lawyers do not.
If the bank can't recover the money then she will need to take legal advice in regards to seeking compensation from the solicitors. The new GDPR laws should help with this as it specifically provides for compensation where a data breach has occurred.
Make sure the solicitors have notified the Information Commisioners Offfice and the Solicitors Regulation Authority of the breach.
Make sure the solicitors have notified the Information Commisioners Offfice and the Solicitors Regulation Authority of the breach.
plasticpig said:
If the bank can't recover the money then she will need to take legal advice in regards to seeking compensation from the solicitors. The new GDPR laws should help with this as it specifically provides for compensation where a data breach has occurred.
Make sure the solicitors have notified the Information Commisioners Offfice and the Solicitors Regulation Authority of the breach.
Thank you.Make sure the solicitors have notified the Information Commisioners Offfice and the Solicitors Regulation Authority of the breach.
dave_s13 said:
All solicitors are required by the SRA to have indemnity insurance in place so if it came to it you will have a somewhere to claim from (even if they suddenly went bust).
Monumentally stressful as it is you will get your money back eventually.
That's very helpful. Fingers crossed.Monumentally stressful as it is you will get your money back eventually.
Olivera said:
g3org3y said:
Monday she received an email from the solicitor she'd been dealing with requesting the balance of the funds. She had already paid the 10% deposit.
Wasn't there a mortgage involved? Confused about why she would be paying the balance of the funds.She had already paid 10% of the deposit. She was now paying the balance of the deposit.
She has not yet exchanged (was due to do this and complete tomorrow). Small blessing as from my understanding she'd then have been legally bound to paying all the money.
It's not just house purchase where these frauds occur. It an be any large value transaction in which solicitors are involved.
OP, have a read of this previous PH thread - https://www.pistonheads.com/gassing/topic.asp?h=0&...
Unfortunately far too many MoPs have little clue about security and leave themselves wide open.
That said, this type of scam has been rife for several years and the regulators have been far too slow to act.
The banking sector appears to be finally waking up, but it needs to the SRA to get its act together as well.
OP, have a read of this previous PH thread - https://www.pistonheads.com/gassing/topic.asp?h=0&...
Unfortunately far too many MoPs have little clue about security and leave themselves wide open.
That said, this type of scam has been rife for several years and the regulators have been far too slow to act.
The banking sector appears to be finally waking up, but it needs to the SRA to get its act together as well.
The situation with the SRA sounds interesting. In view of the alarming prevalence of these professional scams, this does offer a glimmer of hope.
Ultimately, if we knew it was likely the money would be paid back at some point (through the SRA or otherwise), even if it did take a year it would be a massive weight lifted from the shoulders.
A couple of questions (excuse my ignorance):
1. If sufficient funds can be found in the next couple of weeks, can my sister still complete with this law firm if in the future she may need to bring legal action against them or an SRA claim be made.
2. With regards to getting the lost money back through the law firm, am I right in suggesting the two options are the firm admitting their fault and them claiming through the SRA or them being taken to court in order to prove negligence on the part of their security (and associated pay out)?
3. Is an SRA claim something a firm would strongly want to avoid? (drawing a parallel with motoring claims where drivers might want to settle without getting insurance involved). Or, would the bad PR for a local firm (if you need to take them to court) outweigh the 'negatives' of them making an SRA claim?
4. The sums involved are significant. Think new M4 money. To use the above analogy, this isn't a minor car park scrape.
Thank you to those who have contributed to the thread so far. Your help and advice (and words of support) are very much appreciated.
My sister will be speaking to the firm's partner again today and will keep me updated through the day.
I have sent her the link to this thread. She also sends her thanks.
Ultimately, if we knew it was likely the money would be paid back at some point (through the SRA or otherwise), even if it did take a year it would be a massive weight lifted from the shoulders.
A couple of questions (excuse my ignorance):
1. If sufficient funds can be found in the next couple of weeks, can my sister still complete with this law firm if in the future she may need to bring legal action against them or an SRA claim be made.
2. With regards to getting the lost money back through the law firm, am I right in suggesting the two options are the firm admitting their fault and them claiming through the SRA or them being taken to court in order to prove negligence on the part of their security (and associated pay out)?
3. Is an SRA claim something a firm would strongly want to avoid? (drawing a parallel with motoring claims where drivers might want to settle without getting insurance involved). Or, would the bad PR for a local firm (if you need to take them to court) outweigh the 'negatives' of them making an SRA claim?
4. The sums involved are significant. Think new M4 money. To use the above analogy, this isn't a minor car park scrape.
Thank you to those who have contributed to the thread so far. Your help and advice (and words of support) are very much appreciated.
My sister will be speaking to the firm's partner again today and will keep me updated through the day.
I have sent her the link to this thread. She also sends her thanks.
Edited by g3org3y on Friday 15th June 06:20
This is a very serious problem nowadays.
It's bad enough with regular email spoofing, which can be hard to spot by typical office workers who know how to use computers, but emails originating from the solicitors servers might as well be written on their headed notepaper.
If the solicitor's systems were compromised, I think your sister stands a good chance of getting her money back, but as said it won't be resolved quickly or easily. The solicitor will more than likely shift blame to their IT company, and so on. The bank has acted on instructions from their customer (her) in good faith, so it's hard to know how they would be culpable (although one wonders why there wasn't any kind of fraud intercept on a sum of that kind paid into an new (to her) bank account, or what checks had been done when creating the fraudster's account - assuming that isn't stolen too)
It's bad enough with regular email spoofing, which can be hard to spot by typical office workers who know how to use computers, but emails originating from the solicitors servers might as well be written on their headed notepaper.
If the solicitor's systems were compromised, I think your sister stands a good chance of getting her money back, but as said it won't be resolved quickly or easily. The solicitor will more than likely shift blame to their IT company, and so on. The bank has acted on instructions from their customer (her) in good faith, so it's hard to know how they would be culpable (although one wonders why there wasn't any kind of fraud intercept on a sum of that kind paid into an new (to her) bank account, or what checks had been done when creating the fraudster's account - assuming that isn't stolen too)
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff