Stopping clients paying fraudsters' bank details
How a law practice cuts the risk of clients paying a fraudster after a fake e-mail: pay links, a clear payment rule and a plan for the day it happens.
By Achekam · · 5 min read · For Legal businesses in South Africa, Nigeria, Kenya
The e-mail looks exactly like the firm's. Same logo, same signature block, same tone as the candidate attorney who has been writing to the client for weeks. It says the practice's bank details have changed because of an audit, and asks the client to pay the outstanding fees, or the deposit on a property transfer, into a new account. The client pays. The money is gone within hours, and the first the practice hears of it is a phone call asking why the fee note still shows a balance.
Payment-detail fraud targets law practices because clients trust them and pay them large sums by transfer. No software stops a criminal from sending an e-mail. What a practice can do is make the genuine way of paying so clear, and so consistent, that a fake request stands out. This article explains how, using Achekam's invoicing and pay links, for practices in South Africa, Nigeria and Kenya.
How payment-detail fraud usually reaches a client
The common routes are few:
- A compromised mailbox. A criminal gains access to a staff member's e-mail, reads the correspondence, and sends a convincing request from the real address.
- A lookalike address. The e-mail comes from a domain one letter different from the firm's, and nobody notices.
- An altered attachment. A genuine fee note PDF is intercepted, the bank details on it are changed, and it is sent on.
- A phone call that follows up. The fraudster calls to "confirm" the new details, which makes the request feel safer.
All four rely on the client believing that bank details can change by e-mail. Your defence is to tell them, early and plainly, that yours do not.
Tell clients once, in writing, how you will and will not ask for money
Put a short payment notice in your mandate or engagement letter, in your e-mail signature and on every fee note:
- Our bank details will never change by e-mail.
- We will never ask you to pay into a personal account.
- Before paying a large amount, call us on the number in your mandate, not a number in an e-mail.
- Every fee note can be paid through a payment link, which opens our own payment page.
- If anything looks different, stop and call us before you pay.
Repeat it at the moments of highest risk: just before a transfer, a settlement or a large deposit is due. Clients forget what they signed months ago.
Pay links that open the practice's own branded pay page
A pay link takes the client away from typing bank details at all. A business can create a payment link for an issued invoice, copy it or e-mail it with the invoice, and the client pays on a public page that shows the practice's name and branding. There is no link for a draft or voided fee note, and an open link for the same amount is reused rather than duplicated.
An issued invoice can be downloaded as a PDF on the practice's letterhead and e-mailed from the invoice, with or without a pay link, and a failed send is reported as not sent. Sending fee notes from Achekam rather than from a staff member's mailbox means the invoice and its link come from one route your clients learn to expect.
When a client pays through a gateway, the payment is verified and recorded as a receipt against the fee note, debiting that gateway's clearing account and crediting trade receivables, and the fee note shows as paid or part-paid. The amount is checked against what the link asked for. How fee deposits work on a link is covered in taking a fee deposit with a pay link.
Bank details and a payment reference shown on the pay page
Some clients will still pay by transfer. For them, the pay page can show the practice's bank details and a payment reference, and a staff member marks the payment received once it shows on the bank statement. Each bank account takes one currency.
The useful point is consistency. If the client's instruction is "always take our bank details from the pay page, never from an e-mail or an attachment", then an e-mail with different details is wrong by definition, however genuine it looks. South African practices weighing which online payment methods to offer can read online payments on invoices.
Who in the workspace can change payment gateway settings
Fraud can also come from inside, or through a compromised staff login. Limit who can change where money goes.
A workspace administrator enters the practice's own payment gateway credentials in Settings under Payment Gateways & Checkout, and can test the connection with a real call to the gateway. Non-administrators can view those settings but not save them. Keep the number of administrators small, review the list whenever someone leaves, and protect administrator logins with two-step sign-in wherever you can. Setting up a gateway from the start is explained in setting up your payment gateway.
What to do on the day a client says they paid someone else
Speed matters more than anything else. Agree this list in advance, so nobody has to think on the day:
- Ask the client to call their bank at once and report the payment as fraud; banks can sometimes stop funds that have not yet left the receiving account.
- Call your own bank with the details of the fraudulent account.
- Keep every e-mail, header and attachment; do not delete or forward them casually.
- Check whether a staff mailbox was compromised, change passwords and review mailbox rules.
- Report the matter to the police, and take legal advice on where responsibility lies.
- Send the client a statement of account so both sides agree what is still owed; the server produces a customer statement of account as a PDF that can be e-mailed, and the screen says whether it was sent.
If a mailbox was compromised and clients' personal information was exposed, South African practices may have to notify the Information Regulator. Its step-by-step guide to reporting security compromises on the eServices portal explains how a breach is notified under section 22 of POPIA. Nigerian and Kenyan practices should check the notification rules of their own data protection regulator.
This month
Add the payment notice to your mandate template and fee notes, switch fee notes to pay links, and review who your administrators are. Then tell every active client, in one clear message, how you will and will not ask them for money.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
