Help! Solicitor's secretary has been hacked!

[Ispywithmycynicaleye]

I don't know all the ins and outs yet, but basically DS and his DP house purchase, offer accepted, all nearly completed. Their first purchase so no prior experience.

They received an email from solicitor's secretary stating deposit must be paid now in full to x account.

Attempts made to comply with email and transfer the full amount but bank flags issues. Comes to light solicitor's secretary's email account had been hacked and the email was sent by the hackers.

What is the best course of action? Deposit thankfully not lost but did come so close! Should a complaint be made? If so, who to?

Have they looked at what the initial paperwork says about making payments? This must be a widespread problem because I remember my solicitor's initial letter giving the bank details along with instructions to not follow any later guidelines with different bank details specifically because of the potential of fraud like this.

It's normally very clear in the terms and conditions/advisorys when starting a relationship with solicitor to not reply to any payment update details via email and only use their secure portal or equivalents.
This is a very common scam and id be surprised if they didn't cover themselves at the beginning.
Learn from this and share far and wide, never send money to someone without verbally confirming the details with the recipient
Good luck with house purchase

Thankyou both! I'll check this with them. I have always rented so have no idea how to help or advise.

It's crazy that solicitor's staff being hacked is so common that warnings are included in the terms and conditions.

I’d never heard about this until it happened to someone I know. The property was being purchased by a business, the admin lady received the scam email and verified it with two of her superiors before paying. The company lost 250k. And the admin lady got sacked! (the two male superiors who verified the transaction didn’t)

@Ispywithmycynicaleye It isn't just solicitors at risk - all businesses can fall victim to hackers who then email all their contacts advising of a change of bank details. We've had a procecure at our workplace for years that all requests such as this have to be independently checked and verified.

This scam is so common and has been going on for so long I'm amazed that people still fall for it.

Such a common hack. Law firms are key targets for this precise scam for obvious reasons.

Never rely on bank details from an unsecured email. They're so easy to intercept and those details be changed. Always call and speak to the person to verify bank details over the phone.

This is so common and been going on for years. Our solicitor's admin lady called us on the day of exchange and went through everything re: paying the deposit step by step while she was on the phone to us. She asked us to deposit a pound first, then confirmed receipt and then asked us for £10 and also confirmed receipt, followed by the large deposit.

Yes, and don't call them on the phone number they give in the email they sent!!

Something similar happened to me, but it was an invoice for some plumbing work we'd had done. The email and the invoice looked official,but the bank app wouldn't let me make the payment. The plumbing company knew nothing about it. They hadn't invoiced me yet.

Thank goodness the bank was on the ball and blocked the transaction.

I’ve heard so much about these scams that if I should get an email supposedly coming from a business I am dealing with, I plan to contact then first to check that the email did really come from them. I’d rather be laughed at for being paranoid than lose money in a scam!

You say the solicitor's secretary has been hacked. Are you sure that is what happened?

The fact that you have received an email claiming to come from the secretary does not prove they have been hacked. Due to the way email works, you don't have to hack into someone's email account to send emails that appear to come from them. It is called email spoofing. Scammers are aware of this and do it all the time.

There is nothing the sender can do to prevent their email address being spoofed. They can put protections in place that make it harder, but these rely on the recipient and their ISP having good anti-spam protection in place. Even with that, some emails with spoofed addresses will get through.

Law firms (esp property departments) are often a target for fraud as large
amounts of monies are being transferred as a first transaction from clients. I think it's incredibly unlikely that the law firm won't have sent details by post with a note saying not to accept any emails changing the details. Good thing that this got picked up.

You say the solicitor's secretary has been hacked. Are you sure that is what happened

I have only heard 3rd hand so not spoken to DS direct yet, I'll do that later today. From what was relayed to me, the solicitors told DS their secretary's email was hacked.

They are both young but hopefully this is a huge awakening for then to be very careful about things like this. Tbh I nearly fell for something similar myself! Credit card company called to tell me they have placed orders on hold to querie them with myself before releasing as the location raised suspicions. They asked for my pin as security check so I told them I'd call them back myself and give those details. My credit card company knew nothing about it!

I recently remortgaged and the solicitors sent letters right at the start with their bank details and instructions to check with them and not to pay to other accounts. Glad they've still got their deposit OP.

I work for a law firm and for this reason we have to call to verify bank details every time we send any money (to other law firms, clients, other third parties etc). It is unfortunately a very common scam and for that reason I called and verified bank details with my own solicitor when I was transferring my house deposit.

My very respected accountant (well-known specialist in a particular field) sent me a request for payment that gave banking details that were different to his normal ones. It wasn’t for a massive amount of money but I’m very suspicious of anything that looks off so I contacted him and scammers had indeed been at work. It’s quite shocking how rife this is.

If I’m asked to pay anything to anyone new, I always transfer £1 first then contact the person/company and make sure it’s reached them before paying the balance.

Scammers will be scammers. I can remember hearing a story while I was working in a bank many years ago, when people paid for everything with a cheque in the post. It concerned a postman who decided to change his name and opened a new bank account in the name of Mr B T Elecom. He got away with an awful lot of money before they caught up with him!