New Jersey Law Journal: What Law Firms Need to Know About Wire Fraud Scams
As online banking has become the norm when processing various client-related financial transactions, the risk for scams and cyberfraud has risen. Attorneys must be vigilant and keep an eye out for communications that are maliciously designed to appear as though they are coming from trusted parties. When in doubt, attorneys must pick up the phone and call the client to confirm wire transfer information, as well as the financial institution to report suspicious activity. By analyzing recent cases involving alleged cybercrime and relevant rules of professional responsibility, this article will provide guidance as to the best practices for attorneys to fulfill their responsibility to their clients.
Law Firms are Lucrative Targets
Law firms are the ideal target for cybercriminals. Firms not only hold a treasure trove of valuable information; they are also teeming with extremely busy professionals who may not think to pause and second guess a seemingly normal email from a client.
Schemes that originate from fraudulent emails, commonly referred to as business email compromises (BEC), made up more than 21,000 reports to the Federal Bureau of Investigation (FBI) in 2024. See Federal Bureau of Investigation, Internet Crime Report (2024), at 9 (2024_IC3Report.pdf). BEC scams target businesses or individuals that regularly perform wire transfer payments—like law firms. BEC fraudsters compromise email accounts and other communications through social engineering or intrusion techniques in order to persuade the email recipient to wire funds to them.
In its Internet Crime Report, the FBI estimates that, in 2024 alone, more than $2.77 billion was lost as a result of BEC scams. New Jersey is one of the states experiencing the most losses, ranking the sixth-highest state in terms of reported losses with more than $435 million lost to internet fraud in 2024.
Common Wire Fraud Schemes
Wire transfers are very similar to sending cash through the mail. Once a wire transfer is sent, the transfer typically cannot be reversed. Funds sent over wire are considered the recipient’s property and may be final—making wire scams particularly appetizing to fraudsters.
Wire transfer scams tend to start the same way. A member of a law firm receives an email from what appears to be the client—except that one letter is different from the client’s true email address the attorney is familiar with. For example, a fraudster may use the email “CL1ENT@GMAIL.COM” instead of “CLIENT@GMAIL.COM.” The “1” in place of the uppercase “I” in “client” may go unnoticed by an unsuspecting associate, paralegal, partner, or other staff member. Assuming the sender is the client he or she is used to communicating with, the staff member continues to communicate with the fraudster as normal.
Often, the fraudsters will send an email requesting that the law firm alter its normal procedure for wire transfers. For example, the fraudster may ask that the firm wire money to a different account number. The fraudster may embed a fictitious email in an email string supposedly from a senior person at the firm to give credence to the email. Frequently, the fraudster claims that time is of the essence or that the matter needs to be handled that same day and tries to force the firm into quickly wiring the money over. Once the firm wires the money over to the fraudster, the fraudster immediately transfers those funds to another account before the firm becomes wise to the fact that it was duped. By that point, the funds are typically out of reach and may be entirely or partially unrecoverable.
Applicable Rules of Professional Responsibility
Although no firm thinks any of its employees could fall victim to such wire fraud schemes, these events are becoming increasingly more common. Attorneys and firms must take the appropriate steps to safeguard their firms from such schemes; otherwise, they risk being held liable under various rules of professional responsibility.
Competent and Reasonable Measures to Safeguard Client Information
Attorneys are guided by the common law duty to take competent and reasonable measures to safeguard client information.
New Jersey Rule of Professional Conduct (RPC) 1.1 pertains to an attorney’s competence when handling client information. The RPC states that “[a] lawyer shall not … handle or neglect a matter … in such manner that the lawyer’s conduct constitutes gross negligence.”
The American Bar Association’s Model Rules served as a guide for the New Jersey RPCs. Similar to RPC 1.1, ABA Model Rule 1.1 states that “[a] lawyer shall provide competent representation to a client” requiring the attorney to display “the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.”
ABA Model Rule 1.1 also requires attorneys to consult with experts on matters of tech security. The 2012 amendments to the Model Rules added the following language: “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.”
An attorney’s duty to take competent and reasonable measures to handle client information extends to a client’s account information. Attorneys are expected to be up-to-date on all relevant technology—as well as the risks associated with that technology.
Protection of Information Relating to the Representation of a Client
RPC 1.6(f) pertains to an attorney’s responsibility to protect client information. It reads: “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” This rule also requires a lawyer “to act competently to safeguard information … against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons or entities who are participating in the representation of the client or who are subject to the lawyer’s supervision.”
“Inadvertent disclosure” can include situations like disclosing bank information to the wrong recipient. Attorneys must take steps to protect client information from “unauthorized access” by hackers, criminals, malware, and insider threats.
Protection of Clients’ Money and Property
RPC 1.15 requires attorneys to protect their clients’ money and property the attorney holds. Attorneys have a duty to account fully to clients for funds entrusted to an attorney’s care, notify clients promptly upon receipt of funds, promptly deliver any funds to the client or third person that the client or third person is entitled to receive, and also to not use client funds for any purpose other than as directed by the client.
Duty to Supervise
RPC 5.1 requires law firms to “make reasonable efforts” to ensure that member lawyers comply with the RPCs. A supervisory lawyer will be responsible for another lawyer’s violation of the RPCs if the supervisory lawyer “knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action.”
RPC 5.3 applies to supervision of nonlawyer staff. “[E]very lawyer, law firm or organization … shall adopt and maintain reasonable efforts to ensure that the conduct of nonlawyers … employed by the lawyer, law firm or organization is compatible with the professional obligations of the lawyer. Note that a lawyer will be responsible for a nonlawyer’s conduct if a lawyer ratifies the conduct, knows of the conduct “at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action,” or where the lawyer failed to reasonably investigate past conduct of the nonlawyer.
If a fraudster targets a law firm, he or she may not aim for the named partners. The fraudster may opt to target a non-lawyer, like a finance employee or an administrative assistant. Regardless of who is targeted at the firm, the firm and/or attorneys can be held liable.
Duty to Communicate
Finally, a lawyer is required to “keep a client reasonably informed” and “promptly comply with reasonable requests for information.” Thus, if a law firm experiences a security breach or finds that it fell victim to a wire fraud, the firm must immediately communicate such to the client.
Recent Instances of Wire Fraud Impacting Law Firms
Law firms can face real consequences if they fall victim to BEC schemes. For example, in Connecticut, the Mancini Provenzano & Futtner firm was sued in September 2021 after a fraudster impersonated real estate attorney Carolyn Futtner. See Ferentini v. Mancini Provenzano & Futtner, NNH-CV21-6117046-S, New Haven Judicial District of the Connecticut Superior Court. The fraudster sent an email from a Ccomcast.net domain bearing Futtner’s name and instructed the plaintiff to order her financial adviser to wire over $90,000 to an account belonging to the fraudster. After a bench trial, the judge ruled in favor of plaintiff, finding the law firm was negligent in failing to secure its email system. The judge noted that, “[e]ven if plaintiff were responsible for or contributed to her loss,” the plaintiff’s conduct would have to be more than fifty 50 percent to relieve the firm of responsibility, and the plaintiff’s only negligence was failing to call the firm after she received wire instructions. See NNH-CV21-6117046-S, Entry No. 170.50 (Memorandum of Decision), at 26. The judge determined the plaintiff was not more than fifty 50 percent liable for her loss. Ironically, the firm had advised against requesting wire transfers via email in a cybersecurity alert.
In New Jersey, the Sarno Da Costa D’Aniello Maceri Webb firm (Sarno Firm) and Christine L. Matus, Esq. (Matus Law Group) were recently sued by a former client. See Toledo v. Sarno Da Costa D’Aniello Maceri Webb, BER-001752-25, Bergen County Superior Court. The plaintiff alleges that the firms negligently failed to recognize that fraudsters were impersonating plaintiff’s trustee in attempts to divert funds from his special needs trust. In 2017, the plaintiff hired the Sarno Firm to represent him in his malpractice claim. In 2023, the case settled for $350,000. Plaintiff then tasked the Matus Law Group to set up a special needs trust with his sister serving as the trustee. On February 1, 2024, the plaintiff and his sister opened an account at TD Bank to hold the trust funds. The pair relayed the account information to the law firms. The very next day, an unknown actor emailed a legal assistant at the Matus Law Group, notifying her that the TD account had been “closed for some reasons” and that they would send over new account information. Unnoticed by the assistant, this email address was fake and differed by the trustee’s actual email address by one letter. Thereafter, the Sarno Firm wired all of the plaintiff’s settlement funds to a Citibank account. Neither firm realized they had been duped until four days later. In his complaint, the plaintiff argues that the firms were negligent in failing to question the legitimacy of the email changing the wiring info at the last moment. The plaintiff also alleged that the firms were negligent in failing to contact him or the trustee to verify the changes and also in failing to train its employees to recognize security threats.
Note that, in both cases discussed above, the parties could have avoided falling victim to these BEC schemes by simply picking up the phone and calling to confirm the wire instructions and bank account information.
Takeaways
As evidenced, BEC schemes pose a threat to all law firms. Any firm can fall victim, but smaller firms face an increased risk, because they are often poorly protected when compared to larger firms. Additionally, smaller firms may have less funds to spend on training staff.
When an attorney realizes he or she is the victim of a wire fraud scam, they must immediately act—in this case, time is of the essence. The sooner the scammers are identified, the more likely that a portion of the funds, if any, can be recovered. The attorney should immediately contact the wire transfer company, or the bank used to wire the money as soon as possible and request that the transfer be reversed. Additionally, the attorney must call the affected clients involved in the transaction and notify the client of the incident. Finally, the attorney should report the incident to the police and federal authorities. Law enforcement will guide the attorney on appropriate reporting requirements.
Above all, attorneys must question all emails mentioning wire transfers. If it smells fishy, something is probably amiss. Scammers typically want their victims to act fast and not verify wiring instructions and account information. When normal procedures are switched up at the last second (i.e., requests to wire to a different account, reaching out to a different party at the firm, etc.), raise an eyebrow. Pick up the phone and call the client to ensure that the funds should be wired as per the new instructions. Although it might take a few extra minutes in a normal, run-of-the-mill wire transaction, calling the recipient before wiring funds can save an attorney a massive headache. An attorney should always use the client’s contact information the firm already has—and not the contact information included in the suspicious email.
Reprinted with permission from the June 3, 2025 issue of the New Jersey Law Journal. © 2025. ALM Media Properties, LLC. Further duplication without permission is prohibited. All rights reserved.