How does social engineering fraud in law firms occur?

A common scenario for social engineering fraud begins with a cyber breach or business email compromise at a law firm, client company, or financial institution. Often, the fraudster uses stolen email credentials to infiltrate the organization’s systems. They can then use information they find to convince an individual to redirect the payment of funds to the fraudster.

For example, a fraudster may create an email address that resembles a trusted address by slightly altering the letters in the domain or using a sub-domain. The fraudster may use the fake email address to intercept an existing email chain with a client, financial institution, or other trusted source, and provide transfer instructions that will redirect funds or property to the fraudster’s account. Fraudsters may even attempt to manipulate an invoice from a trusted source to include alternative pay instructions.

Some sophisticated social engineering scams may target individuals to gain their trust by using personal information, such as their name and phone number, or by using voice or video technology to impersonate someone else in the organization.

Be vigilant against social engineering fraud attempts

By paying close attention throughout the transfer process, social engineering fraud may be detected before it’s too late. Red flags that may indicate a social engineering scam include:

What can lawyers do to protect themselves against social engineering fraud?

Lawyers and law firms can be proactive to prevent losses from social engineering fraud, including taking these steps:

• Establish clear transfer protocols to be used by all law firm staff and lawyers that contemplate what to do if there is a request for a change in payment instructions (either internally or externally).
• Use multi-factor authentication protocols such as out-of-band verification, which requires a secondary verification method through a separate communication channel and does not rely on contact information provided in the instructing correspondence.
• Follow-up with an independent communication to confirm the transfer of funds has occurred.
• Provide employee training on how to spot social engineering attempts.

There are also many ways to protect against cyber breaches more generally:

• Be mindful of attachments from unknown sources, particularly attachments that request sign-in information.
• Be vigilant in public. Avoid connecting to public, unsecure Wi-Fi and do not access private or confidential information.
• Perform penetration testing to the firm’s cyber network.
• Increase cyber security at the firm in other ways:
  • Avoid password recycling.
  • Use multi-factor authentication for accessing secure resources.
  • Introduce email quarantine for correspondence that appears suspicious.
  • Restrict log-in attempts.
  • Monitor changes to logging and configuration. 
  • Ensure all legacy protocols are disabled (IMAP & POP).
  • Consider investing in anti-phishing software.
  • Provide anti-phishing training to employees.
  • Update software regularly.

Coverage for social engineering fraud

The Universal Cyber Coverage Program, provided by Beazley Canada Limited (“Beazley”),
offers coverage to Subscribers for the costs associated with cyber breach response, data recovery, and cyber extortion, and third-party coverage for claims against Subscribers or their law firms for data or security breach, subject to the terms, conditions, exclusions and limits of the policy. More information on the Universal Cyber Coverage Program may be found on ALIA’s website: Universal Cyber Coverage Program – ALIA.

There is no coverage for social engineering fraud under the Alberta Lawyers’ Professional Liability and Misappropriation Indemnity Group Policy or the Universal Cyber Coverage Program. We recommend lawyers and law firms speak with their brokers about what options are available and appropriate to their circumstances, such as a social engineering fraud endorsement to an existing property or commercial policy, or a separate crime or cybercrime insurance policy.

Resources

We recommend lawyers and law firms review further resources and information to protect against social engineering fraud:

Business Email Compromise | beazley

Social engineering – ITSAP.00.166 – Canadian Centre for Cyber Security

Deceptive and manipulative: social engineering techniques – Office of the Privacy Commissioner of Canada

Social engineering: how cyber scams trick us – Get Cyber Safe

Safeguard your organization from cyber risk