A purchase at £340,000, with £61,500 sitting in client account as the balance due on completion. The figures are illustrative, the shape of the fraud is not. At half past four on the day before completion an email lands from what looks like the seller's solicitor, or from an address one character different from it. The bank has flagged a problem with the nominated account, new details are attached, and completion is tomorrow. Somebody in your office pays it away, and by the time the true recipient rings to ask where the money is it has passed through three accounts and gone.
A change of bank details never arrives calmly. It arrives late, it arrives with a reason that sounds ordinary, an audit or a branch closure, and it arrives when everyone involved wants the transaction to close. That combination is deliberate. A fee earner who has spent three months on a file, with a client sitting in a van outside the new house, will not slow things down over an administrative detail. The people who run this fraud read the correspondence first and time their intervention for the moment when hesitation feels obstructive.
Your rule has to be simple enough to survive that pressure. Any change to payment details, and any set supplied for the first time, gets verified by telephone before a penny moves, and the number you ring must come from somewhere the sender cannot reach. Take it from the original retainer correspondence, from the letterhead on the first letter in the matter, or from the Law Society's Find a Solicitor. Never ring the number in the email carrying the change, or the one in the signature block beneath it. Anyone able to send you new account details can also send you a number that answers in a professional voice and confirms them.
Making the check a step on the file
Good people do this by instinct, and instinct fails on the busy Thursday when the usual fee earner is at court and someone else covers the payment. Verification has to exist as a recorded step, with a note on the matter file naming who rang, the number dialled, where that number came from and what was confirmed. If it is not written down it did not happen, and you will find that out when the insurer asks. Build it into the completion checklist so the payment cannot be authorised without it.
Separate the roles as well. Whoever received the email asking for the change should not be the person who verifies it, because anyone living inside that correspondence has already accepted the explanation that makes the change plausible. Someone who has not read the exchange, and who is senior enough to tolerate a delay, will ask the question the recipient has stopped asking. Your exposure is worst in the last days before completion, precisely when a firm is least willing to add a step.
What your client needs telling at the outset
Your client is being targeted in the same operation, often through the same compromised mailbox, and has no professional instinct to draw on. Tell them at the outset, in the client care letter and again in the completion statement, that your bank details will not change during the matter and that any email saying otherwise is fraudulent. Give them a number to ring, one you control, and ask them to use it before they send money anywhere. A client warned in week one has forgotten by the time completion arrives in week twelve, so repeat it.
The SRA Accounts Rules govern payments out of client account, and the Standards and Regulations expect a firm to safeguard client money and assets. Where money is paid away to a fraudster, the loss and the replacement of client money ordinarily fall on the firm rather than on the client or the bank, and what follows turns on whether you can show what checks you ran and when.
This is where the Bracton AI Assistant earns its place. It plugs into the case management system you already run, reads across the whole caseload overnight, and raises the matters where bank details have been changed or newly supplied in inbound correspondence, together with matters approaching a payment out where no verification step has been recorded. It drafts the verification note for a qualified fee earner to sign off. It contacts nobody itself and moves no money, and every flag comes from a deterministic rule rather than a model's opinion. The same discipline runs through Bracton, the case and client management platform, with UK hosting and a full audit trail.
You already hold the record of where your client money went, because every payment out of client account sits in your ledgers whether or not anyone verified the details behind it. Reading those ledgers, your cash book and your bank statements against the Accounts Rules shows how your firm pays money away in practice, and it needs nothing you do not already have. To see that reading on your own figures, book a client account review.