Conveyancing Fraud: The Controls That Stop Payment Redirection

A client is about to send their deposit. An email arrives that looks exactly like it came from your firm, in the same thread, with the same signature. It says the firm’s bank details have changed. The money goes to a fraudster, and it’s gone within hours.

This is payment-redirection fraud, and conveyancing is one of its favourite targets. The sums are large, the timing is predictable and the client trusts the email. It isn’t purely an IT problem or purely a process problem. It exploits both, so the defence has to cover both.

How the attack works

The pattern is consistent:

1. A mailbox is compromised. Often it’s the client’s personal email, sometimes the firm’s. The usual route is a phishing email that captures a password.
2. The attacker watches quietly. They read the thread, learn the names, the tone and the timetable. They may set up a hidden rule that diverts or hides replies.
3. They strike when money moves. Just before completion or a deposit, an email “from” the firm gives new bank details. It may come from the real mailbox or from a lookalike domain that differs by one character.
4. The money is moved on fast. By the time anyone notices, it has passed through several accounts.

The Law Society of Northern Ireland has run its “Call, Check and Confirm” campaign on exactly this risk since 2018. Its advice to clients is to “call the other party, check they sent the email and confirm that matters are correct” (Law Society of NI).

The technical controls

These reduce the chance of the firm’s own email being the weak point:

• Multi-factor authentication on every account, with conditional access blocking sign-ins from unexpected places and devices. A stolen password alone should not be enough.
• Alerts on suspicious mailbox rules. Rules that forward, delete or hide messages are a classic sign of a compromised mailbox. They should trigger an alert, not sit unnoticed.
• Impersonation and lookalike-domain protection. Email security that flags messages pretending to be from your firm, or from domains that look like yours.
• DMARC at enforcement on your own domain. This stops others sending email that claims to be from your exact domain. It does nothing about lookalike domains or a compromised mailbox, which is why it’s one layer of several. Our guide to DKIM, DMARC and SPF explains how it works.

The process controls

These work even when the technology fails, and they’re what protects clients whose own email is compromised:

• Give bank details once, at engagement, in the client care letter, and never by email alone.
• Never change bank details by email. The Law Society has noted that “it is very unusual for a solicitors’ firm to change its bank account details in the course of a conveyancing transaction”. Make that a firm rule, and tell clients.
• Confirm by phone on a number you already hold. Never a number from the email asking for the change.
• Warn clients, repeatedly. In the client care letter, in email footers and in a call before completion: “We will never change our bank details by email. If you receive such an email, call us.”
• Use Confirmation of Payee. UK banks now check whether the account name matches the account before a payment is sent. A “no match” or “close match” result is a reason to stop and call. Encourage clients to treat it that way too.
• Check outgoing payments the same way. When the firm pays out, for example to a seller’s solicitor or a client, confirm the details by phone before sending.

The first hour after a suspected redirect

Speed decides whether money can be recovered. Have this written down before you need it:

1. Call the bank immediately, and ask the client to call theirs. Banks can sometimes stop or recall a payment if they act fast.
2. Report it. Report Fraud replaced Action Fraud in December 2025 and covers Northern Ireland (Report Fraud). The PSNI asks for a call to 101 instead when the fraud happened within the last 24 hours or police action is needed to stop a loss, such as halting a large transfer (PSNI).
3. Preserve the evidence. Don’t delete emails or reset everything in a panic. Secure the mailbox, revoke sessions and change passwords, but keep logs and messages intact.
4. Assess data protection obligations. If personal data was exposed, a notifiable breach must be reported to the ICO (now formally the Information Commission) without undue delay, and where feasible within 72 hours (ICO). Reporting to the police doesn’t meet that obligation.
5. Notify your insurer under the terms of your policy.
6. Take advice on your regulatory position from the Law Society of NI.

For the wider email security picture, see our email security guide for professional services.

Related: Cybersecurity for professional firms

Find out where your IT stands

Book a free 15-minute call. If it’s a fit, the next step is our IT Risk and Ownership Review: £295 + VAT, using read-only access to your Microsoft 365, and credited against your first month.

Book a 15-minute call