The Invoice Was Real. The Bank Details Were Not

The invoice was genuine. The matter was genuine. The email came from the right firm, in the right thread, with the right signature block.

Only the account number had changed.

Payment redirection is the loss I get called about most in legal practice. It is not glamorous. Nobody breaks encryption or writes custom malware. Someone gets into a mailbox, reads quietly, and waits for money to move.

This article covers how these attacks run, why law firms carry more exposure than most businesses, what happens in the hours after a bad transfer, and the controls that stop it. There is a callback rule near the end written so your firm can adopt it word for word.

How it actually runs

The pattern is consistent enough that I can describe most matters before I see the logs.

It starts with a mailbox. A phished password, a reused credential, an MFA prompt approved at the wrong moment. The mailbox might be yours, your client's, the agent's, or the other side's. The attacker only needs one seat in the thread.

Then they wait. This is the part people underestimate. The attacker reads. They learn who signs off, who pays, how the firm writes, and when settlement falls. They often create a mailbox rule that hides replies or forwards anything mentioning "invoice", "settlement" or "trust". The person whose mailbox it is notices nothing.

Then they time it. When the real invoice or settlement statement goes out, a second version follows with new bank details. Sometimes the original is intercepted and re-sent with changes. Sometimes it comes from a lookalike domain one character off the real one, slotted into the same thread. The wording is right because they have read the last forty emails.

The pressure is part of the design. Settlement is tomorrow. The vendor is anxious. The client wants it done. Urgency is not a coincidence. It is why the timing was chosen.

Why law firms

Three things make legal practice an especially good target.

The sums are large and predictable.  Conveyancing deposits and settlement funds, estate distributions, damages, counsel's fees. Money moves on known dates, in known amounts, and often between parties who have never met.

The thread carries trust. Clients trust their lawyer's email more than almost anything else in their inbox. When a message arrives in the right thread from the right person, the reader's guard is down by design.

Responsibility is spread thin.  The person who receives the request, the person who updates the payee, and the person who authorises the transfer are often three different people. Each assumes someone else checked.

Firms of every size are affected. A small practice running a busy conveyancing book carries as much exposure per transaction as a large one, with fewer people to notice something odd.

What happens after the money moves

The question I get every time is: can we get it back?

Sometimes. Not reliably. The honest version is this.

Banks can sometimes stop or recall a payment, or freeze funds still sitting in the receiving account. Once the money has moved on, usually to a second account and then out of reach, recovery gets much harder. That movement can happen quickly.

So the first call is to the bank. Not to IT, not to the insurer, not to the partner who is in a meeting. The bank, on its official number, asking for an urgent recall. Everything else can follow in the next hour. The recall request cannot.

Confirmation of Payee now runs across most Australian banks. It checks the account name against the BSB and account number for a new payee and shows a match, close match or no match. It helps, and your accounts team should treat a "no match" as a hard stop. But it is not a substitute for verification. A mule account opened in a plausible name will pass, and a "close match" invites the very rationalising attackers rely on.

The callback rule

Most firms tell me they already verify changed bank details by phone. The useful question is which number.

Verification only works if the channel is independent of the message. Calling the number in the email signature is not verification. Replying to the thread to ask "can you confirm?" is not verification. If the mailbox is compromised, the person you are checking with is the person you are checking on.

Here is a rule that works. Adapt the names, keep the substance.

Changed payment details. Any new or changed payment details, for any amount, must be confirmed by phone to a number the firm held before the request arrived. A held number means one recorded in the engagement letter, the client file or the practice management system. It never means a number taken from the email, the invoice, or a website searched for at the time. The person who makes the call must not be the person who received the request, and the call is recorded on the file with the date, time, number called and the name of the person spoken to. No payment is made until the call is complete. There are no exceptions for urgency.

That last sentence does the heavy lifting. Settlement pressure is the attacker's tool. A rule with an urgency exception is a rule with a published bypass.

Two practical points.

Write it down and put it where the work happens.  A rule in an induction pack is not a rule. It needs to live in the accounts team's procedure, on the payment checklist, and in the settlement workflow.

Tell clients early. Put one line in your engagement letter and your first matter email: "We will never change our bank details by email. If you receive an email saying otherwise, call us on the number in this letter before paying." It protects the client's money and your firm's reputation, and it costs nothing.

Four supporting controls

The callback rule stops the payment. These four make the attack harder to set up and easier to catch.

1. MFA on every account, including the shared ones. The accounts inbox, the reception mailbox, the conveyancing team address and any account your IT provider uses. Shared accounts are where MFA most often gets skipped and where attackers most like to sit.

2. Alerts on new mailbox rules and forwarding. Hidden inbox rules and external forwarding are the attacker's signature in almost every matter I see. Most email platforms can alert on them. Ask your provider whether yours does, and who receives the alert.

3. Dual approval above a threshold. Any payment above an amount your firm sets needs a second authoriser who checks the callback was made and recorded. The second person is not there to check the arithmetic. They are there to ask "did we call, and which number?"

4. Out of band confirmation for every new payee. Not just changed details. First payments to anyone new go through the same callback, and the Confirmation of Payee result is recorded with the payment.

The first hour if it has already happened

If a payment has gone to the wrong account, work through this in order.

1. Call your bank on its official number.  Ask for an urgent recall and for the receiving bank to be contacted. If your client made the payment, tell them to call their own bank now, while you are on the phone if possible.
2. Secure the mailbox without destroying the evidence. Reset the password, sign out all sessions and check the MFA methods registered on the account. Do not delete the suspicious rules or emails. Record them first. They show how long the attacker was there and what they read.
3. Report it through ReportCyber at cyber.gov.au and keep the reference number. You can also report to Scamwatch.
4. Notify your insurer under the terms of your policy before engaging outside help, where the policy requires it.
5. Warn the other parties in the thread by phone, on numbers you already held. If one mailbox was compromised, assume the attacker has seen every address in the conversation.
6. Preserve your logs. What you can investigate is limited by how long your systems keep their records. If your retention is short, ask your provider to extend it today.

Notification obligations

This is not legal advice, and you should get your own. But three obligations come up in most of these matters.

Trust money. Under section 154 of the Legal Profession Uniform Law, an irregularity in a law practice's trust account must be reported to the local regulator as soon as practicable. The Law Society of NSW lists fraud and cybercrime among the irregularities it expects to hear about, regardless of the amount. The Uniform Law applies in NSW, Victoria and Western Australia. If you practise elsewhere, check your own legislation and your law society's guidance.

Personal information. A compromised mailbox usually contains client personal information. Whether that becomes an eligible data breach under the Privacy Act depends on what was accessed and the likely harm. The assessment has a clock on it, so start it early.

Your insurer. Policies vary widely in what they cover for social engineering and funds transfer losses, and many have conditions about notification and which providers you engage. Read yours before you need it.

The short version

Payment redirection is not a technology failure. It is a process failure that technology makes easy to exploit.

The firms it happens to almost always had a rule. It was unwritten, or it lived in a document nobody opened, or it allowed a callback to a number from the email. The fix is one paragraph, written down, given to the people who move money, with no exception for urgency.

Download the callback rule as a one page PDF for your accounts team.  No form, no email address required. Print it, put it on the wall, and send it to anyone in your firm who touches a payment.

If it has already happened, talk to our incident response team. The first hour matters more than any hour after it.