For a law firm, the money moving through the client account is the whole game to a fraudster. It is large, it is expected to move at completion, and the deadlines are real. That combination is why conveyancing and probate teams see so much of the “change of bank details” email: the attacker does not need to break anything technical if they can get one convincing message in at the right moment.

The mechanism is almost always the same. Somebody watches a mailbox, learns the rhythm of a transaction, then sends an email that looks like it comes from the other side's solicitor or the client, saying the account for the final payment has changed. On a quiet Friday with a completion looming, a tired fee earner updates the payee and sends the funds. The money is gone within minutes.

The control that holds up under that pressure is the four-eyes rule on any new or amended payee. One person sets up the payment; a different person verifies the new account details against a source that did not arrive by email - a phone number held on the file from the start of the matter, not one supplied in the message itself. It is dull, it costs a few minutes, and it is the thing that catches the fraud after everything else has been fooled.

The rule only works if it cannot be waived by the person under pressure. That means it is set in the banking system, not left to good intentions, and it applies even when the sender is a partner and the deadline is today. The classic loss happens when someone with authority overrides the check “just this once” because the transaction feels urgent. Urgency is the tell, not the exemption.

For SRA-regulated firms there is a second reason to get this right: a client account loss is a reportable matter and a professional one, not merely an IT incident. Building the verification step into your account rules, and recording that you did, is part of showing you took reasonable care with money that was never yours to lose.