US Edition 
'Fraudsters hacked emails to my solicitor and stole £340,000 from my property sale'
In a growing form of cybercrime fraudsters are targeting property sellers and their solicitors
Hacking into email accounts and impersonating the owners to steal money, information or both is a growing form of crime that almost cost this family the entire proceeds of their property sale.
At the start of the year Paul and Ann Lupton sold the flat they had bought for their daughter, Tracey, near Waterloo, south London, for £340,000. She had recently had a child and moved to a bigger home.
Two days before the set completion date of February 27, Mr Lupton’s solicitor, Perry Hay & Co in Richmond, Surrey, emailed him requesting his bank account details for the sale proceeds to be paid into.
As millions of people do regularly and without thought, he duly replied, sending his Barclays bank account number and sort code.
The email was intercepted by fraudsters. Possibly using technology that “X-rays” millions of emails to identify patterns of data that could contain valuable financial information, the criminals homed in on Mr Lupton’s email – and pounced.
Posing as Mr Lupton, the fraudsters swiftly emailed Perry Hay & Co again – from the same email account – and told it to disregard the previous details and send the money to a different account instead.
The sale completed as planned and the solicitor sent the funds, worth just over £333,000 after fees and charges, to the criminals’ account.
A few days later, Mr Lupton called the solicitors to chase the payment and the crime was discovered. Both parties contacted Barclays and the police.
Barclays was the account provider for all three involved: the solicitors, the fraudsters and the Luptons. The account was frozen and £271,000 was returned to the Luptons, still leaving them £62,000 out of pocket.
The crime followed a pattern that other law firms say is on the rise.
Rob Hailstone, of Bold Legal Group, a national network of 350 law firms, said email scams and other financial fraud aimed at legal firms had increased significantly in the past six to 12 months. He said financial information should never be sent in an unprotected email, which could be easily hacked by criminals.
“There is a lot of money in home-moving transactions and fraudsters are targeting conveyancing firms as a result,” he said.
“Firms have a responsibility to look after their clients’ money. We recommend both firms and their clients use encrypted emails for confidential or financially sensitive information. This means emails cannot be opened without a secure password. Some firms are so worried about the rise of fraud cases involving email that they’re going back to using faxes for confidential and sensitive information.”
Increasingly, the advice to consumers is never to include account numbers and sort codes within emails.
Banks do not explicitly forbid passing on bank account and sort codes by email, or by any other means, despite warning customers not to write down or tell other people their account passwords or Pins. Instead, most banks have some general wording requiring customers to “take care of” account details.
Government security service Get Safe Online, which offers advice on protecting against fraud, said the Lupton’s case was a stark reminder of how sophisticated cyber criminals had become.
Tony Neate, head of Get Safe Online, said: “In this case, the user would have had no idea that their emails had even been intercepted by a criminal or that the money had been fraudulently hijacked. It goes to show the importance of protecting online accounts in as many ways as possible.
“Your first line of defence for your email account is a strong password that is different to other online accounts and is changed regularly. Protecting your devices with security software and regularly installing updates will also help.”
Meanwhile, the Luptons are battling for the return of their outstanding cash.
Following the crime, Perry Hay & Co said it did not believe it was at fault and that the Luptons would have to suffer the loss.
Mr Lupton then made a formal complaint to the firm, which replied by saying the fraud was “cleverly administered and well organised in such a way that this firm could not have been expected to have identified the fraud or acted any differently”.
But the legal watchdog, the Solicitors Regulation Authority (SRA), took a different view. It said member firms were responsible for safeguarding client funds, and must replace any money that was “improperly withheld or withdrawn from a client account”.
The SRA said cyber criminals were increasingly targeting law firms, and that mail interception followed by the theft of clients’ funds was one of the biggest types of crime.
Robert Loughlin, executive director at the SRA, said: “We are very concerned about this continuing activity. The fraudsters are highly sophisticated in their approach. All firms should ensure that their own, internal systems for guarding against scams are up-to-date and that staff know how to implement them.”
Telegraph Money put this to Perry Hay & Co. Senior partner Peter Hay said: “We are sympathetic with Mr Lupton’s position, but as far as we are concerned there have been no shortcomings on the part of Perry Hay & Co.”
Mr Lupton has also complained to Barclays, which transferred the money to an account named “Chidani Ltd”, and which had been dormant for some time.
“Barclays should not have transferred such a large amount of money into an account that was not in my name and had no connection to me whatsoever,” Mr Lupton said.
But Barclays said it used sort codes and account numbers to process electronic payments, rather than payee names. A spokesman said: “Barclays is not liable for the £62,000 that was withdrawn prior to the bank being informed of the fraud.”
How to complain
If you have a problem with your lawyer or solicitor, you can complain to the SRA or to the Legal Ombudsman.
The SRA makes sure firms comply with its regulatory rules and principles, which include acting independently, fairly and with integrity.
The Legal Ombudsman deals with complaints about poor service. This includes failures to keep you properly informed, disclose costs, work to a promised timescale, or follow instructions.
- nicole.blackmore@telegraph.co.uk