Wire Fraud: One big, costly, oops

Why lawyers, doctors, and other service professionals need to stay alert against wire fraudsters

Authored by Megan Zurn, AXA XL Claims Manager for Select Professional Insurance and Shehla Qureshi, AXA XL Claims Manager for Cyber & Technology.

The first “online” transfer of money dates as far back as 1872, when Western Union launched its first wire transfer service on its existing telegraph network. A sender would pay money to one telegraph office that could transmit a message or “wire” the money to another office. The office would use passwords and code books to authorize the release of the funds to a recipient at the receiving location.

For more than 150 years, wire transfers have been a fast and reliable way to make a business transaction, domestically and internationally. In more recent years, however, criminals have found wire transfers a lucrative opportunity to dupe unsuspecting businesses to direct money in the wrong direction and into their pockets.

Wire fraud is a criminal offense that uses telecommunications or information technology to carry out fraudulent activities. Wire fraud often involves creating a web of deceit that includes various channels of communication, like emails, phone calls, and online platforms. Scammers may pose as legitimate institutions or individuals to manipulate the victims into misdirecting funds.

While this kind of fraud can affect anyone, service professionals — including lawyers, doctors, insurance agents, real estate agents, and title companies among them — can find themselves prime targets.

Transactional targets

As part of their services, many lawyers, real estate agents, and doctors, among others, need to exchange sizeable amounts of money. Consider lawyers: They routinely handle sensitive information and have large financial transactions come through their firm’s trust account for their clients’ legal settlements, real estate transactions, or trust and estate distributions.

Scammers may pose as clients, opposing counsel, vendors, or other interested parties, and use a spoofed email address to send fraudulent wire instructions or intercept an email through a breach of a lawyer’s network to insert fraudulent wire instructions.

Lawyers should also be wary of any new clients where the scope of the representation involves an imminent depositing of a settlement check in the firm’s trust account and immediate disbursement of settlement funds to the new client or opposing party by wire. Criminals in this kind of scheme will pose both as the plaintiff and the defendant in an imaginary dispute. The law firm will receive a check purportedly settling this fake dispute, and, not knowing the check is fake, will deposit the check and immediately wire the client the settlement funds. By the time all realize that the check was illegitimate, the criminals are in the wind with the wired funds, and the bank has swept the amounts from the bounced check from the law firm’s trust account, leaving the law firm holding the bag.

Doctors and other healthcare providers also face unique challenges related to wire fraud. Billing fraud, for instance, involves submitting false claims to insurance companies using stolen patient information. They, and other service professionals, might be targeted with fraudulent invoices and contracts, leading to unauthorized transfers of funds.

Another concern for any doctor, lawyer, or service professional is a simple social engineering fraud when paying vendors. This would involve receiving an email from the criminal saying a known vendor’s banking information has changed and providing new banking information. If the payment department does not verify this change in banking details, the office can end up sending payments to the fraudsters.

People in the industry — lawyers, real estate agents, bankers, town clerks, title insurers — are issuing urgent warnings with tools and guidelines for vigilance to beat back fraud. They’re tightening up the steps they take in a sale and are overall suggesting caution whenever wiring funds. Many say they have not seen anything like the scam attempts emerging over the last few years.

Wire fraud is very costly and currently appears to be trending upward. In 2022, for instance, bank transfer or payment fraud resulted in losses amounting to USD 1.59 billion. And that’s up since 2021 when an estimated USD 756 million was lost on wire transfer scams.

That’s why it’s so crucial that service professionals, along with their staff, stay alert to wire fraud scams and put protocols in place to double-check, even triple-check, the validity of wire transfers.

Preventing wire fraud requires a multifaceted approach:

Pay attention to cyber security. Protection against wire fraud starts with assuring that criminals can’t access the information that helps them carry out the scam. Keep computer and mobile devices protected with updated antivirus and security software. Install and update security software and use strong, unique passwords: This adds an extra layer of protection if a scammer attempts to access your accounts. Enable multifactor authentication, or MFA, for your online accounts. This adds an additional layer of security.Educate to keep a high level of awareness. Professionals need to stay up-to-date on common scams and red flags. Understanding potential risks can lead to early detection and prevention. Understand common frauds and the typical language or tactics used by scammers.Be skeptical. If any sudden and emergency changes to prior wire instructions occur, businesses should be on alert and verify that the changes are authentic. Scammers may request unusual payment methods such as gift cards or other untraceable methods. If a client or party approaches you with a job that seems too good to be true, it most likely is .Don’t act in haste. Many fraud attempts rely on pressuring the victim to act quickly. Take your time, consult with someone you trust, and make sure you’re comfortable with the transaction.Verify, verify, verify: This can’t be stressed enough. Always verify the identity of the person or company you are dealing with. If unsure, look up their official contact information independently and reach out to confirm the communication is legitimate. Call phone numbers known to be valid rather than those referenced in emails directing the wiring instructions. Verbal confirmation of wiring instructions can be provided, preferably by an individual whose voice is known to the lawyer or support staff member making the call.Consider writing a check: Making payments by check sent to a physical address takes days and requires a physical presence that many criminal enterprises avoid, thus making this payment method often safer with regards to potential wire fraud. If there are concerns about wiring funds, writing a check is still a viable means of transferring funds and may be preferred.Report it. Wire fraud is a crime. Victims of wire transfer scams report them to their banks immediately. They can also report the fraud to the Federal Trade Commission at ReportFraud.ftc.gov. The FBI and the Secret Service also take cyber-crimes seriously. Wire fraud victims can notify the FBI via its Internet Crime Complaint Center (IC3)Consult with professionals. If you’re dealing with large sums of money or complex transactions, consult with financial professionals who can help ensure the transaction’s legitimacy. Some professionals contract with escrow agents, for instance.

By maintaining vigilance and following these guidelines, service professionals can reduce your risk of falling victim to wire fraud. It can also be beneficial to consult with your insurance brokers and carriers to understand your insurance coverage and discuss other coverages, like crime insurance, available to address wire fraud situations.

Avoiding coverage confusion

Given the rise, many service professionals have become more concerned with how to protect themselves should they fall victim. So, one might think that it is covered under an Errors & Omission policy. After all, it was a mistake, an error, right? E&O insurance policies, however, are not typically designed to cover criminal activities like wire fraud, and not all instances of wire fraud involve any professional services as defined by E&O policies. Some policies have applicable exclusions, specifying that issues including wire fraud caused by social engineering or hacking or email spoofing, etc. is excluded from coverage, while other policies may have endorsements sub limiting exposure in these circumstances.

Others might think that a cyber policy might provide coverage because wire fraud often involves emails and online transfers. Depending on the cyber coverage purchased, socially engineered wire fraud may be specifically covered or carry sub-limits and perhaps carry a higher deductible. But it’s important to remember how wire fraud is often initiated, as it may affect the coverage analysis in the event of a claim. Often, there is no cyber coverage for the professional under their cyber policy because the professional did not have any data breach or computer network breach on their end, but instead fell victim to changed instructions sent by a criminal when some other entity was breached or spoofed. Additionally, many cyber policies require verbal confirmation of settlement instructions as a condition precedent to coverage, which can be an issue if this condition precedent was not met.