Ordinary Business Email Compromise scams redirect a supplier invoice for a few thousand dollars. Trust account BEC fraud targets the single largest, most time-pressured transaction a client will ever make through your firm - a property settlement, a litigation payout, or an estate distribution - and the amounts involved are routinely six figures.
Why Trust Accounts Are a Different Risk Category Entirely
General BEC scams rely on guesswork about when a payment might happen. Trust account fraud doesn't need to guess. Conveyancing files have known settlement dates. Probate matters have known distribution timelines. Litigation files show clear signs when a matter is heading toward resolution. An attacker who has been quietly monitoring a compromised mailbox, or who has registered a look-alike domain for a conveyancer or settlement agent, knows exactly when to strike and exactly how large the payment will be.
This is also why these scams are so convincing. The fraudulent email doesn't ask for an unusual payment - it asks for a payment the client or solicitor was already expecting, just to a different account, citing a plausible reason like a bank switching or an error in the original details.
How the Conveyancing Settlement Scam Plays Out
- Surveillance - an attacker gains visibility into the email thread between the firm, the client, and often the other side's conveyancer or settlement agent, either through a compromised account or a forwarding rule planted in an earlier phishing attack.
- Timing - the attacker waits until close to settlement day, when bank detail changes are most plausible and time pressure is highest.
- The intercept - an email arrives, often from a near-identical domain or a genuinely compromised account, advising that the settlement funds should now be paid to a different account "due to a banking error" or "an account migration."
- The transfer - settlement proceeds, sometimes the client's entire deposit or full purchase price, are paid to the fraudulent account and moved offshore or through several accounts within hours.
Litigation Payouts and Estate Distributions Carry the Same Risk
The same pattern applies wherever a known lump sum is due to leave a trust account. A litigation settlement that's been negotiated over months, or a deceased estate distribution to multiple beneficiaries, gives an attacker the same predictable timing and the same opportunity to insert a fraudulent bank detail change into an existing, trusted thread.
Controls That Actually Stop It
- Mandatory phone verification for any bank detail change - call the client or the other party on a number already held on file, never a number provided in the email itself, before any trust account payment goes to new or changed details.
- A written policy with no exceptions for "regular" clients - the scam works precisely because it exploits trust built over a long-running matter. The policy needs to apply even when the request appears to come from someone the practice has dealt with for years.
- MFA on every mailbox with trust account visibility - this closes off the account-compromise route, which is how many of these scams begin.
- DMARC enforcement on the firm's domain - prevents criminals from sending mail that appears to come from your own firm to clients or other parties.
- Dual authorisation on trust account transactions above a threshold - a second set of eyes on large or unusual payments catches what a single reviewer under time pressure might miss.
- Client-facing warnings - many Perth conveyancing firms now include a standard warning in early correspondence telling clients that bank details will never change by email and to call the office directly to confirm any request that suggests otherwise.
What to Do If a Payment May Already Be Compromised
Contact your bank immediately to request an emergency recall - successful recoveries almost always happen within hours of the transfer, not days. Report the incident to ReportCyber, notify your professional indemnity insurer, and review whether a mailbox was actually compromised (rather than just impersonated) so access can be revoked. Document the timeline carefully, since this will matter for both insurance and any regulatory follow-up.
Frequently Asked Questions
Why are law firm trust accounts specifically targeted by BEC scams?
Trust accounts hold large, predictable lump sums tied to known dates - settlement day for a property purchase, the release of litigation proceeds, or a deceased estate distribution. Attackers don't need to guess when money will move or how much; conveyancing files and probate matters often telegraph both, making the timing of a fake bank detail change far more convincing than an ordinary supplier invoice scam.
Can a law firm be held liable if a client's settlement funds are redirected by a scammer?
It depends on the circumstances, but firms have faced findings of liability where they failed to take reasonable steps to verify account details or where their systems were found to have facilitated the interception of email correspondence. This is a question for your professional indemnity insurer and legal advisor in any specific case, but the safest position is to never rely on email alone for any change to trust account payment instructions.
Does MFA alone stop trust account BEC fraud?
MFA significantly reduces the risk of an attacker compromising a real mailbox, which is one common entry point. But many trust account scams use look-alike domains or compromised third-party accounts (a conveyancer, bank, or settlement agent) rather than the firm's own mailbox, so MFA needs to be paired with a strict phone-verification policy for any change to bank details, regardless of how the request arrives.
What should a Perth law firm do if a trust account payment may have already gone to a fraudulent account?
Contact your bank immediately and request an emergency recall or hold on the funds, report the matter to ReportCyber, and notify your professional indemnity insurer and the Law Society as required. Speed is critical - most recovery success happens within hours, not days, before funds are moved through further accounts.
We help Perth law firms lock down trust account workflows, email domains, and verification processes against BEC fraud.
Legal & Accounting IT Services →No phone-verification policy for trust account payments yet?
Call 0433 087 091 - we work with Perth law firms to close off the email-based attacks that target settlement and trust funds.
Book a Confidential IT ReviewFor related reading, see our guides to Business Email Compromise: How Perth SMBs Can Stop Invoice Fraud and IT Support for Perth Law Firms and Accounting Practices.
This article is general information only and is not legal or compliance advice. Speak with your professional indemnity insurer and legal advisor about obligations specific to your practice.