Social Events & Meetings
SPONSOR - Aon - Cyber risks; protecting your firm and your clients
SPONSOR - Aon - Cyber risks; protecting your firm and your clients
Cyber risks; protecting your firm and your clients
The media has recognised the newsworthiness of financial crime and, in particular, criminals’ attraction to law firms and their client accounts. As a consequence, TV time and column inches have been dedicated to the plight of solicitors falling victim to scams. Banks are also playing their part through prominent TV advertising campaigns alerting their customers to the risk of financial crime.
Insurers welcome the increased awareness generated by this publicity but, unfortunately, ongoing claims notifications demonstrate that the profession is still firmly in the fraudsters crosshairs. It’s all too easy to assume that fraud is yesterday’s problem and that fraudsters will have moved on to different victims, perhaps even in different countries but this is not the case.
To put the enduring nature of this problem into context, one Participating Insurer has recently announced its exit from the Solicitors’ Professional Indemnity market citing client account fraud as one of its key motivators and predicting that this type of fraud is unlikely to abate.
One only has to look at the scale of cyber-crime in the UK to empathise with the pessimistic views that are being expressed. BBC’s Moneybox reported there were 7.6 million reports of cybercrime in the last 12 months. In the first 6 months of 2015, financial crime in the UK rose by 6% to £325m, with losses arising from telephone fraud rising by 95% to £14.4m in the same period according to Financial Fraud Action UK. Property-related man-in-the-middle attacks have cost firms and their clients £10m over recent months warns the Telegraph.Law firms hold significant sums of money in their client accounts, particularly if they handle property, estate administration, trusts or high value personal injury and clinical negligence claims. Those sums are very attractive to fraudsters.
Any successful fraud is a threat to your practice. The consequences vary from reputational damage to negligence claims, regulatory investigation, intervention and worse. If your business failed as a result and you were made bankrupt, you wouldn’t be the first solicitor to face such a bleak outcome. The consequences for your clients can be as serious if they end up losing a deposit saved up over several years.
Partners should be sending strong leadership messages, at least annually, to all personnel about the risks of fraud and the threat it represents to the firm. Underlying this message should be written fraud prevention and awareness training policies and supporting procedures to which all personnel are required to adhere strictly. These policies and procedures, and the adequacy of their performance, should be under ongoing review by a member of senior management, executive committee or similar senior team.
The Institute of Risk Management defines cyber risk as any risk of financial loss, disruption or damage to the reputation of an organisation from some sort of failure of its information technology systems. The Solicitors Regulation Authority use cyber risks as a convenient label to describe the current wave of frauds even though many of them do not fit easily within this definition. A more common threat arises from social engineering risk.
Social engineering is a low-tech but still highly effective scam where fraudsters raid information from social media and intercepted emails. Using this to make themselves appear convincing and trustworthy, they manipulate their victims into sharing confidential information or transferring funds. LinkedIn is as vulnerable to attack as other types of social networking.
According to the City of London Police (confusingly for law firms known by the initials COLP), the two most common types of social engineering involve email (77%) and phone calls (12%), the remainder being made up of text messages, mobile phone calls and post.
Vishing attacks are telephone calls which aim to obtain personal or financial information in order to commit fraud or identity theft. Do not underestimate how convincing fraudsters can sound, playing on their victims’ fears and persuading them to transfer significant sums to ‘safe’ accounts to protect them from attack. Five vishing attacks are reported to the SRA every week. One resulted in transfers totalling £1.9m after 3 hours on the phone. ActionFraud (www.actionfraud.police.uk) has produced reconstructions to demonstrate just how convincing vishing can be.
Prevention is better than cure and we would urge you to consider the following simple but effective controls:
• Vishing relies on creating panic and the need for immediate action. Do not allow yourself to be panicked into doing something you have never done before.
• Understand what banks ask for in terms of security information. Look at the guidance supplied by your bank. A bank will never ask for your full password, PIN or memorable information via email, phone call or text. Nor will it ask you to transfer money to an account that you do not recognise or to share screenshots of login pages or accounts.
• Do not use the number supplied by the caller to verify their bona fides. Note that fraudsters can spoof the phone number that appears on your caller display so do not trust it. If telephoning your bank after a suspicious call, use a different phone line as the phone line can stay open for up to 2 minutes if the person on the other end does not hang up (although BT are taking steps to reduce this time).
• If you receive a suspicious call, end it immediately (or put them on hold while you ask someone else to contact your bank).
Establishing safeguards against low-tech criminal attacks is relatively simple and, we hope, being widely adopted throughout the profession.
Phishing attacks target identity theft via a link in an email which includes malware. The link directs victims to a fake website where they are asked to provide user names and passwords in the belief that they are supplying them to a trusted organisation, such as a bank. Malware and botnets can lie dormant on your computer for months or years. Soft (screen based) keyboards are as vulnerable to malware as physical keyboards. The risks can be minimised if everyone is reminded to think twice before clicking on links in emails.
A variation on phishing involves ‘man in the middle’ attacks. The fraudster joins a public Wi-Fi network and relies on an established connection to the victim’s device to redirect emails through the attacker’s host network. This allows the hacker to intercept emails. Reports in the Telegraph suggest that there are two successful cases involving property-related fraud every week, netting on average £1m per month for fraudsters.
There is a worrying lack of awareness about how cyber criminals use public Wi-Fi hotspots (270,000 in the UK alone according to ActionFraud) to steal personal and financial details. The top two public Wi-Fi activities, emails and social networking, often reveal plenty of personal information, with online banking close behind. Many firms allow lawyers to use personal devices for business, but little more than a third of firms exercise any control over the configuration and security of such devices.
A recent example occurred as the firm was about to complete a client’s purchase of a second home. The email incorporating the firm’s client account details was intercepted and altered. The client’s email back confirming transmission of funds was intercepted and edited to say there would be a short delay before the funds were sent – giving the fraudsters time to transfer the funds beyond reach, into other accounts or withdrawn in cash.
To minimise your exposure to man in the middle attacks:
• Advise clients face to face and in writing (not by email) of your bank details, that they will not change during the transaction and to ignore contrary instructions by email. Also, only accept bank details from clients that are given face to face, by post or by another trusted method.
• Think of your clients as well as yourselves. Warn them not to post details of their home move on social media as this makes it easier for fraudsters to mount such attacks.
• Ensure that newly set up payee details are verified by more than one person.
• Instruct your bank to place a restriction on the number of high value payments that can be made within a specified period of time.
More generally, other steps that firms should take to protect themselves, include:
• Training everyone on the risks and providing regular staff updates with intelligence bulletins. The people in your firm may unwittingly be your weakest link.
• Avoiding passwords that can be guessed easily (such as ‘password’, 123456 or your postcode and avoid pets’ names which can be found easily on social media).
• Keeping passwords secure and change them frequently. Don’t tape them to the underside of your keyboard where a cleaner could find them.
• Keeping software up to date, as updates include the latest patches to combat vulnerabilities.
• Google your firm name regularly to ensure your profile has not been cloned.
• Thinking about behaviour that you want to restrict or modify and then compare it against your email and internet policies. Update your policies and procedures as necessary.
Fraud is so indiscriminate that most Professional Indemnity insurers have developed a comprehensive set of controls they would like their insured firms to adopt. If you are unaware of your insurer’s advice, we would strongly recommend that you contact them and check your policies and procedures against them. Aon’s clients have been sent correspondence on this subject. If you would like additional copies or you have any questions, please contact your Client Manager.
In case the worst happens, set up a crisis management process within your firm so that you know, in advance, who will do what as time may well be of the essence. If you think you have been a victim of fraud, contact your bank immediately, as the more quickly you contact your bank, the greater the chances of recovering funds. Next contact Action Fraud (the police) on 0203 123 2040. If the fraud involves client money, notify your Professional Indemnity insurer as the definition of a claim includes a shortfall on client account. Remember, however, that notifying your insurer does not relieve the Partners of their obligation to make good any shortfall on client account on discovery (your office policy or cyber risks policy may also cover losses on your office account). Finally, you must be conscious of your professional obligations in the SRA Code of Conduct and the Accounts Rules. Apart from the wide ranging obligations in chapter 10 of the Code, your Compliance Officer for Legal Practice (COLP) and/or Compliance Officer for Finance and Administration (COFA) have reporting obligations.
The opportunities that digital technologies, devices and media bring to firms are many and varied, but so are the risks, which are constantly evolving. Cyber risk is never a matter purely for the IT team. Whilst cyber risk insurance policies can provide some comfort, the COLP and COFA need to keep their firm’s processes constantly under review.
For more information on this, please contact:
Marco D’Ovidio, Associate Director, Aon UK Limited, on 0117 948 5116.
Like Back to Top Seen 486 times Liked 0 times
Subscribe to Updates
If you enjoyed this, why not subscribe to free email updates and join over 1274 subscribers today!
Subscribe to updates
Alternatively, you can subscribe via RSS 
All email subscriptions must be confirmed to comply with GDPR.
Related Posts
11th September 2017 | May 2016
Law Care - Working from home LAWCARE HELPLINE: 0800 279 6888Open 365 days a year from 9.00 a.m. to 7.30 p.m. on weekdays,10.00 a.m. to 4.00 p.m. weekends and bank holidays.help@lawcare.org.uk • www.lawcare.org.uk • Admin: 01268 771333 Studies have shown that 80% of employees consider working from home a job perk[1] , one in four people would accept a reduction in salary if it meant we could work from home[2] , and remote workers are 13% more productive and take fewer sick days than their office-based workers[3] . Add in the benefits of saving time and money on the commute (for the employee) and freeing up office space (for the employer), it might seem surprising that only 14% of employees regularly work from home. Part of the problem may be the issue of trust. Although 75% of managers claim they trust their employees to work from home[4] , it seems that partners and supervisors who have made the effort to come into the office expect their subordinates to do the same. Phil Flaxton, chief executive of Work Wise UK, says: "The fear factor for many managers is: 'If I can't see you how do I know you are working?' Managers need training on how to assess a home-worker on their output, not their input." Working from home isn’t for everyone, however, even where it is possible in the legal profession (and in many client-facing high-street firms it isn’t). Drawbacks include not being able to consult and brainstorm with colleagues easily, and the temptation to work when you shouldn’t, blurring the lines between work and leisure. Those with young families should also be aware that homeworking is not an alternative to competent childcare. Many employees also worry that if they work from home they’re out of sight, out of mind: if they’re not showing up daily in the office they could be passed over for promotion, or are seen as less committed. Others thrive on social contact and the water-cooler moments which keep them connected with colleagues. For those who have the opportunity and the desire to work from home, five simple tips can help make it easier. [1]Globalworkplaceanalytics.com[2]Wrike.com[3]Stanford University[4]Globalworkplaceanalytics.com 1. Set aside time and space for work and keep them clearly defined and separate from the time and space which is home. If possible, have a separate office and close the door. 2. Make phone calls rather than emailing, where appropriate. It can be isolating to work alone, so call work colleagues and contacts regularly. 3. Improve your technical skills. No IT department is upstairs to rescue you, and you can’t ask the person in the next office to show you how the system works, so it’s your responsibility to train yourself to use the tools you need. 4. Take regular breaks, including a lunch break, just as you would if you were at the office. 5. Set boundaries with family members, and others. Just because you’re at home, it doesn’t mean you’re available to them. LawCare’s free and confidential helpline is available 365 days a year Monday to Friday 9 .a.m. to 7.30 p.m. and at weekends and Bank Holidays 10 a.m. to 4 p.m. The number to call is 0800 279 6888. There is also a comprehensive website at www.lawcare.org.uk LawCare Ltd. Registered as a charity in England and Wales no. 1061685 and in Scotland no. SCO39335. ...
11th September 2017 | May 2016
SPONSOR - PKF Francis Clark - Is your practice providing banking facilities whilst acting under a Lasting Power of Attorney / Court of Protection appointment? Is your practice providing banking facilities whilst acting under a Lasting Power of Attorney / Court of Protection appointment? In December 2014 the SRA issued a warning notice on the improper use of a legal firm’s client account as a banking facility. The notice served as a reminder and provided additional clarification that a legal firm must not provide banking facilities through their client bank accounts. Whilst this requirement has in fact been in place for some time and is as stated in the SRA Accounts Rules 14.5, the issue of the warning notice generated a number of enquiries in the legal sector. A common enquiry from the above related to firms, where a solicitor has for example been appointed under a Lasting Power of Attorney and the client has subsequently become mentally incapacitated. Alternatively the solicitor has been directly appointed as a deputy under a Court of Protection in their professional capacity. One of the duties that can apply under these appointments through The Office of the Public Guardian for mentally incapacitated clients is to manage the client’s financial affairs to settle items such as household utility bills, etc. on their behalf. This has led to a debate, on if it is considered acceptable for a solicitor in a law firm acting under these types of appointments, to hold the incapacitated client’s funds within the firm’s client bank accounts as part of the financial duties. What is the proposed justification to use the firm’s client account to hold the clients funds under these appointments? The main justification put forward, so that firms could hold such funds in their client bank account to manage the financial duties of a mentally incapacitated client, is by virtue the solicitor has been appointed to provide the service as a result of their professional standing. In addition as a result of the appointment in this professional capacity the solicitor would issue fees for providing this service. It was therefore considered that it could be justified that there was an underlying legal transaction. This was seen to be supported by virtue the client is mentally incapacitated and not capable to manage their own financial affairs. It could therefore appear to be reasonable to assume that the solicitor could hold the clients fund in the firm’s general client bank account. Additional points had been put forward to use the firm’s client bank account in these situations; these are:i) Provides additional protection to the funds being held in a client bank account as afforded from the full application of the SRA Accounts Rules 2011 ( As opposed to a limitation of the SRA Accounts Rules 2011 within rules 8/9/10) ii) Where such funds are recorded through the general client bank account and the legal firm’s accounting records, this would enable a greater oversight of the transactions other than just the appointed attorney / deputy themselves. iii) Allowing the attorney / deputy to appropriately delegate routine processes / tasks under the appointment (but not responsibility) within the firm. iv) As a result of iii) achieving a cost benefit and improved efficiency in dealing with the case type for the benefit of the client matter. All of the above appear to be reasonable justifications to place the client funds into the firm’s client bank account, in order to manage the financial duties under the appointment for the incapacitated client. However it has been apparent there has been conflicting guidance in the legal sector on the above application. Clarification on the use of the client bank account whilst acting under a Lasting Power of Attorney / Court of Protection. We have sought informed clarification on this particular issue based on the facts above. This has been supplem...
11th September 2017 | May 2016
SPONSOR - Alchemy Turns Ransomware into Solid Gold Security Antivirus is unable to stop advanced ‘zero-day’ Ransomware attacks so you and your clients need extra security. Endpoint, Detection & Response Specialist IT Providers, Alchemy Systems would like to share a case study on a recent incident. Situation Every day you hear of a hospital, school, government department or business being attacked by Ransomware, disabling their networks by encrypting important files. “No business is too big or too small to be targeted,” comments Nathan Mills of Alchemy Systems heading up our south east operation, “hackers will lock your network and hold your valuable data to ransom.” Hackers no longer need to be technical whizz-kids, they can buy readymade Ransomware toolkits on the ‘dark-web’ for as little as £100, and this means more attackers and therefore more victims. Small and Medium-sized Businesses (SMBs), who don’t have a dedicated IT Security person and sophisticated antivirus and backup solutions in place, are especially vulnerable. This was the situation an award-winning building consultancy firm found itself in. Attacked by ransomware that their antivirus didn’t detect, it encrypted all the consultancies vital files. The consultancy needed some specialist IT advice so they called upon Alchemy Systems, an IT solutions company who offer a full managed security service. Solution As the ransomware had bypassed the consultancies existing antivirus, Alchemy made use of Panda Cloud Cleaner to deep-clean the entire network and remove all traces of the infection. “We greatly appreciate Panda Security’s channel strategy and portfolio, with their partner console we can manage our entire client base from a single point, something no other vendor is able to provide” While most likely that the ransomware attack was through a visit to a compromised website or an infected email, Alchemy wanted to ensure all network vulnerabilities were secured. Alchemy installed Adaptive Defense 360 from Panda Security which combines a complete Endpoint Protection (antivirus, firewall, device control, content filtering etc.) as well as Endpoint Detection and Response capabilities (process monitoring, application classification, vulnerability location and uniquely - forensic information). Evaluation “With Adaptive Defense 360 the process of securing the network using a single solution was much more efficient”, said Nathan “and once implemented we could see suspicious activities being automatically classified and blocked without any need for manual intervention.” Able to work alongside alternative antivirus products Alchemy were able to roll out Adaptive Defense to other prospects on a trial basis to show hidden malware and vulnerabilities, giving them options to improve security. Discover all that you need to know about Cyber Extortion and how to protect you and your clients: Download the practical Security Guide http://tinyurl.com/h5vc37z Alchemy Systems Group – Exeter, Honiton, Egham, PrestonTel. 01392 248498 sales@alchemysys.co.uk www.alchemysys.co.uk www.alchemyinternet.netAlchemy Systems have 17 years of IT systems experience and are a Microsoft Partner. Alchemy SystemsDesigns, Supplies, Installs, Supports and Protects clients’ IT systems. The legal sector has always been a strategic focus. Our staff are experienced in the specific needs and challenges of law firms from service desk to strategy to protection services. ...
11th September 2017 | May 2016
President's Charity NORTH DEVON HOSPICE PROUD TO BE DASLS CHARITY OF THE YEAR It is with great pride that North Devon Hospice has been named as charity of the year for the Devon & Somerset Law Society, as nominated by new President Mark Roome. Mark is a big personal supporter of the charity and recently took part in their Mission:Unbreakable fundraising event, a grueling obstacle challenge in which he had to tackle 10km of mud, water, fire and ice! But he and the rest of the team at Toller Beattie pushed themselves through this in order to support a cause that he is passionate about. North Devon Hospice’s Chief Executive, Stephen Roberts, says that many people have misconceptions about hospice care. “A lot of people hear the word ‘hospice’ and think that it’s the end, but in fact, we are all about living life to the full.” He said. “We believe that the important thing is the life that you have in your days, not the days you have in your life. So we do everything we can to help our patients and families deal with the impact of illnesses such as cancer, allowing them to live the fullest life possible.” Stephen added that the hospice provides a multitude of care, all tailored to suit the needs of each individual. “We like to get involved from the moment someone is diagnosed with a life-limiting illness. When someone is diagnosed with a terminal illnesses, it’s not just their lives that change forever it’s also their loved ones. Hence we believe in being there for all of the family. Whilst Our Community Nurses Specialists offer care and expertise in patient’s own homes, we have a whole care team that look after the emotional well-being of the entire family including children. When symptoms become more complex we have a Hospice to Home team that provide care round the clock, plus a purpose-built Bedded Unit where our doctors and nurses are on hand 24/7. People often describe our care as like walking in to a big hug, and that’s how we like to make people feel.” We need to raise over £3m from scratch every year as a local independent charity. We are not part of the NHS and as such we are reliant on the generosity of people who believe in us and the care we provide. Stephen said, “We would like to thank Mark Roome and everyone involved in the DASLS, because without support from people like you, we couldn’t be here to care for people at a time in their life when they and their loved ones need all the support they can get. All of the team here at North Devon Hospice we’re delighted when we heard the news of Mark’s decision and as such we look forward to working in partnership with you all this year to achieve great things and hopefully have some fun along the way.” To find out some of the ways in which you could support the work of North Devon Hospice, please visit www.northdevonhospice.org.uk. ...
06th March 2020 | March 2020
Dear All, This year really is flying by. I have just had my birthday. After updating you previously on the excellent catch up I had with the Law Society CEO Paul Tennant on his visit to the south west last November, I had not expected to be back in touch with him quite so soon. Sadly, this time it was in less happy circumstances. I was, like many of you, shocked and saddened in January to hear the news and see the pictures of the substantial fire at Chancery Lane in London. I have emailed Paul Tennant and James Shepherd, our Law Society Relationship Management Executive, to send our best wishes and we are hoping that the building will be back to full use very soon. As I write this report, preparations are in full swing for the 2020 DASLS Legal Awards & Dinner. As you know the Annual Dinner is being held again this year at Exeter Cathedral. The event is to take place on the 30th April 2020. After the success of last year, we are hoping that once again the event is sold out which would mean we will have around 480 people attending. If you have not done so already, please contact Llew Nicholls and the team at our Awards partners ‘Grow Marketing’ who have worked very hard alongside our very own Tony and Monique to achieve full sponsorship of this event. You can contact Llew to book the remaining places by emailing Llew directly at Llew@growmarketinguk.com. There have been more nominations than ever before with more entries making the short list. Please do not miss this dazzling occasion. You will all have received DASLS latest 2020 training courses programme. Tony Steiner and the team have worked hard to arrange these events. You will see that as members you get preferential rates and if appropriate reduced rates for multiple attendees from your firms. Please take advantage of these services as a proportion of the monies do go to support our Society’s broad continuing education offering. If I do not see you individually before I look forward to catching up with you at the 2020 DASLS Legal Awards and Annual Dinner in April. With very best wishes Nigel Lyons President 2019-2020...
06th March 2020 | March 2020
New AML Regulations and the pursuit of the beneficial owner. Introduction The new Money Laundering & Terrorist Finance (Amendment) Regulations 2019 which came into force on 10 January have modified a number of aspects of the 2017 AML Regulations, with which we have been complying for some time. However, many firms’ procedures hark back to the earlier days of the 2007 Regulations and have not been modified or updated much over recent years. This article seeks to set out what the new Regulations in fact require, and the steps we should be taking in relevant cases. The Policy It has been true for some time that the ultimate aim of all the regulatory rules is transparency – it has always been the case that the use of artificial structures such as trusts, companies, bearer shares, foundations and charities – whilst perfectly legal – have to some extent also benefitted from the extra anonymity they offer to the true owner and recipient of the funds and services we provide. If we offer services to these types of entity, the Regulations require us to go some way to identifying the individuals who are actually benefitting from our services, and this entails uncovering the true ownership of the organisation. Whilst this would be difficult in many instances – Cayman Island companies with bearer shares, for example – we must nevertheless attempt to get some assurances from the creators of the companies, accountants or registrars as to the ownership of the shares, and have some way of being notified of any change in ownership. We also need to be aware of the PEP and Sanctions status of these individuals. Further, for UK companies, the PSC Regulations 2016 impose an exactly similar obligation on the companies themselves to identify their beneficial owners and notify Companies House of any shareholder with 25% or more of the shares or exercising control over management of the business. The Regulations The Regulations provide that we must, as part of our CDD procedures Identify the client – this means coming to know who they are, by name and some other characteristic, e.g. address, date of birth, date of incorporation Verify that identity – by means of reliable and independent data and documentation Identify the beneficial owner (if the client is an entity) – though not necessarily verifying that identity Identify and verify the identity of the person actually instructing us (if not already done). What this means for us When acting for a COMPANY (that is not a listed company) the Regulations require us to obtain Details of the company as registered (which must be proven by a copy of the register entries available from Companies House or equivalent registry) – name, number, registered office address, principal place of business the law to which it is subject details of its governing documentation (its memorandum) names of the directors. Names of any beneficial owners, and the identity of any individual owners of legal entities which own the client Names and verification of the persons instructing us on behalf of the company, and their authority to do so. Note that we cannot rely on the information provided by the company under the PSC Regulations but we must undertake our own research in order to fulfil our CDD duties. Further, if as part of that research, we discover that the Companies House data on PSC’s is incorrect, then we are now under a further obligation to notify the Registrar of Companies of this fact. We also need to establish that PEPs and Sanctions checks are also undertaken. If genuinely positive entries are revealed in response we should undertake enhanced CDD steps or cease to act, accordingly. Electronic searches are a permissible avenue to use provided the search provider can offer us the necessary assurances that the person actually claiming an identity is IN FACT that person. Check also whether ...
