The attack followed the same approach as previous alerts on 4 August, 28 August and 17 October.

In this instance, the fraudster purported to be calling from the practice’s bank, AIB. The caller, speaking with an Irish accent, followed the banks normal procedure lending to the authenticity of the call. He claimed that there was an attempted fraudulent payment on the client account and requested that the solicitor follow a url so that he could help resolve the issue.

At this point the solicitor stated that they wished to contact the bank to verify the call and requested the caller's name and direct dial. The fraudster stated that bank practices prevented him from disclosing his direct dial number but that he would hang up, and phone back from the bank’s main fraud phone number and that the solicitor could google the bank's fraud phone number to verify. 

The fraudster did so and the phone number displayed was that of the bank’s fraud number. The solicitor separately contacted the bank, who confirmed that this was an attempted fraud and that fraudsters are able to mirror bank phone numbers. The solicitor ended all communications with the fraudster. The bank confirmed to the solicitor that, if they had followed the url, they would have allowed the fraudster access to their system.

Checking legitimacy of calls

Solicitors are urged to remain vigilant and to end any suspicious call and contact their bank through a known phone number to verify the bona fides of the caller. Solicitors should never go to a website or click on a link that is sent to them, nor should they allow anyone to take remote access of their computer.

In addition, they should never give anyone a one-time code from the online banking app, no matter who they say they are or why they say they need the code.

Resources and support

The Law Society aims to help solicitors minimise their cybersecurity risk through information and resources targeted to the profession.

• Get more cyber security knowledge and resources