Cybersecurity

The single most common attack on Australian law firms and their clients is payment-redirection fraud: a criminal gains access to an email account (often the client’s, sometimes the firm’s), monitors correspondence, and at a critical moment sends a convincing email asking that funds be sent to a “new” or “updated” bank account. The funds go to the criminal and are usually unrecoverable.

To reduce that risk, the following rules apply to every matter we handle.

Our bank account details will not change

We will not change our trust or office account details during the course of your matter. If you receive any communication (email, SMS, letter, or phone call) that appears to come from us and asks you to send funds to a new or different account, do not act on it. Telephone us on the number on this website (not a number contained in the communication) and speak to your matter contact before transferring any funds.

What we will not do

If we are acting for you on your instructions, we will not:

• Contact you using a phone number set out in an email, SMS, or other communication that asks for money or provides account details, without you first verifying that number against our published contact details, prior correspondence, or our website;
• Transfer money on your behalf without first speaking to you by telephone (on a known number) to verbally verify the account name, BSB, account number, and amount; or
• Ask you to open attachments, click links, or scan QR codes contained in unexpected emails without you first verifying with us that the email is genuine.

What we will do

We will:

• Telephone you to verbally confirm any change to our bank account details (which, as set out above, will not change in any event);
• Verbally verify account details before sending or receiving funds on your behalf;
• Give the same warnings to others involved in your matter (agents, brokers, family members, accountants, or other third parties) who may also handle funds; and
• Respond promptly to any concern you raise about an email, message, or call that purports to come from us.

What we ask of you

To protect yourself, please:

• Treat any change to payment instructions as suspicious until you have spoken to us on a known number;
• Read out and confirm BSB and account numbers verbally before transferring funds to us, no matter the amount;
• Check the sender’s email address carefully — fraudulent domains often differ from the real one by a single character;
• Use strong, unique passwords and multi-factor authentication on your email account (compromised client email is a very common starting point for fraud);
• Check your email account for unauthorised auto-forwarding rules from time to time; and
• If anything feels wrong, stop, do not transfer funds, and call us.