No trusted number on file
The file contains only the number in the latest email, so staff either call the attacker or waive the check. Capture and confirm contact details at engagement, before money is in motion.
Conveyancing guide · Flagship procedure
“Call before you pay” is policy. Vericode records one part of it.
The strongest procedure is not the sentence in a manual. It is the independent call, complete read-back, accountable handler and record a reviewer can reconstruct after the pressure has passed.
Respect the doctrine
LPLC owns the risk guidance. Firms own the execution.
LPLC’s guidance is direct: verbally verify bank details using a trusted, independently sourced telephone number before money is paid. Read the details out and back, make a clear file note and ensure the person handling the payment owns the control. The procedure applies whether the firm pays settlement proceeds, estate funds or trust money, and whether the client is paying the firm.
Vericode does not replace or reinterpret that doctrine. It operationalises one part of it: a code check to a known contact point, with a consistent record of the result. Firms still need payment authority, full account read-back, separation of duties, file notes, supervision and an escalation process.
The distinction matters because a tool can support a sound procedure but cannot rescue a weak one. If staff send a code to a new number supplied by the suspicious email, the interaction may be recorded perfectly and still verify the attacker’s channel.
LPLC’s four-step control
The verbal check is precise for a reason.
A compromised mailbox can contain real names, matter details and prior messages. The control moves the decision to an independent number and compares the exact information the criminal wants changed.
- 01
Use an independent number
Call a trusted number already held on the file or sourced independently. Never use the number in the email or attachment that supplied the bank details.
- 02
Read out and read back
Confirm the full BSB and account number verbally. A general question such as “are the details correct?” is not the same control.
- 03
Document the call
Make a clear file note: who called, who answered, which number was used, when the call occurred and exactly what details were confirmed.
- 04
Use one accountable handler
The person responsible for the payment should control or directly own the verification. Avoid fragmented hand-offs where nobody can see the complete instruction and check.
This is out-of-band verification: the check does not rely on the email, attachment, signature block or incoming caller ID under review. It is deliberately inconvenient to the attacker, who may control the message but not the trusted contact record and real person’s device.
Four failure modes
How a sensible policy fails on a busy settlement day
The call is not documented
A staff member remembers speaking with someone but cannot show the number, time, person or details checked. A memory cannot be reviewed like a contemporaneous record.
The check is delegated to whoever is free
A busy operator receives one narrow task without seeing the instruction, the trusted record or the risk flags. The hand-off dissolves accountability and context.
The account is not read in full
The caller confirms that a transfer is expected, or checks only the final digits. The compromised detail itself (the complete BSB and account number) never receives an independent comparison.
Why “I called” is not enough
Calling the number in the fraudulent email simply changes the medium while leaving the attacker in control. Calling a genuine person but failing to read the complete account does not test the disputed instruction. Performing the right call without a record leaves the firm unable to demonstrate what occurred. The procedure succeeds only when all four parts stay connected.
The cost of a trusted-looking email
More than $400,000
In the claim example described by LPLC’s “Call first to avoid cyber fraud” article, a Victorian law firm distributed more than $400,000 in estate funds to accounts controlled by cybercriminals after a compromised client email account was used to send false bank details.
The figure is not a general loss statistic and this guide adds no case detail beyond LPLC’s public account. Its importance is structural: an otherwise genuine matter and a real client relationship did not authenticate the changed account. The false instruction entered through a channel the criminal controlled.
An independent call to a number already on file, with the complete BSB and account number read out and back, was the missing break. A documented outcome would also have shown whether the firm completed the control before distribution.
Read the LPLC sourceProcedure with evidence
Make the control reconstructable.
A reviewer should not have to infer whether verification happened from a payment approval or a vague attendance note. Keep the instruction, the check result and the payment decision connected.
- The instruction as received, including the original message or attachment
- The independently sourced number and where it came from
- The verifier and the person reached
- The date, time, method and complete read-back outcome
- Any mismatch, failed attempt, escalation and approval
- The final payment decision linked to the matter file
With Vericode, staff highlight a phone number already visible in a browser-based practice system, portal or email client, right-click and send a one-time SMS code through MobileMessage using the ACMA-registered sender ID VERICODE. The person reads the code back. Each authorised-contact check creates a timestamped, hash-chained record of requester, masked target, method and outcome; compliance-authorised users can export it as PDF or CSV.
The record proves the Vericode interaction; it does not by itself prove bank-account ownership or that the firm followed every element of LPLC’s procedure. The matter file should also show the independent source of the number, complete read-back and payment authorisation.
If Vericode is unavailable, the control does not disappear. Use the trusted-number callback, make a manual record and backfill the verification record when service resumes.
Put the policy into the matter lifecycle
Prepare before the account details arrive.
At engagement
Capture trusted phone numbers, explain the call-before-pay rule to clients and identify who may approve instructions. Tell clients to independently call the firm before sending money.
Before payment
Compare the instruction with the file, trigger independent verification for every new or changed account, read full details back and keep one accountable handler.
If it does not match
Stop. Preserve the instruction, disclose nothing further through the suspect channel, contact the real client independently and follow the firm’s escalation and incident process.
A public verification-policy template is planned, but no downloadable template exists today. Firms can still document the trigger, trusted-number rule, read-back wording, evidence fields, ownership, exceptions and escalation now, with legal and insurance guidance appropriate to their practice.
Turn policy into proof
Give every high-risk payment the same defensible pause.
Operationalise the independent call, preserve the evidence and make failed checks easy to escalate, without claiming that a verification tool replaces professional judgement.
General information only. This guide is not legal, financial, insurance or incident-response advice. Follow your firm’s procedures and seek professional advice for your circumstances.