Payment fraud · Law firms

Payment fraud against law firms: cases from the public record

Cases in which a payment was redirected to the wrong account, involving law firms, their clients and the other side of a file. Each one is dated and linked to its source.

These are cases published by courts, police and regulators that we have read at source. Not every fraud is made public.

Check my firm Read the cases
Courts, police and regulatorsRead at sourceDated and linked
01 · The cases

From the public record, with the way in where the source states it.

In the United States, newest first

19 Nov 2025
Delaware, United States

A lawsuit filed in Delaware in January 2026 says a home buyer wired $2,209,240 for a closing after an email that claimed to be from the real-estate coordinator at her law firm. The claim says it came from a free webmail address. That is a claim, not a finding.

In the source's wordsa spoofed email from [email protected], purporting to be from a real estate coordinator at the law firm representing her
The way in, as the source states itSomething an outside check would not see.
WDEL, reporting a complaint filed in the US District Court for DelawarePublished 16 Feb 2026
27 May 2025
California, United States

A California appeal court decision published in May 2025 covers a $475,000 settlement payment that went to criminals. They wrote to the paying side's lawyer from a domain one letter different from the other law firm's. The court ordered the paying side to pay again.

The way in, as the source states itAn address or domain made to look like the real one.
California Court of Appeal, Fourth District, case D083655Published 27 May 2025

In other countries, newest first

2 Sep 2026
England, United Kingdom

On 2 September 2026 the Solicitors Regulation Authority in England warned that emails misusing the name of Penningtons Manches Cooper LLP gave a client payment instructions for an invoice. They came from a domain that swapped a "q" for the "g" in the firm's own.

In the source's wordsThe emails were sent from the email domain @penninqtonslaw.com. Please note that the letter 'q' has been substituted for the letter 'g'
The way in, as the source states itAn address or domain made to look like the real one.
Solicitors Regulation Authority scam alertPublished 2 Sep 2026
25 Jun 2026
Nova Scotia, Canada

In June 2026 the Nova Scotia lawyers' insurer reported that a lawyer paid over $700,000 of a client's sale proceeds into a fraudster's account. The new banking instructions came from an email address that misspelled the client's own. The money came back to the trust account about a month later.

In the source's wordsAnd what the lawyer did not notice was that this email came from XXX@xxxrealetsate.
The way in, as the source states itAn address or domain made to look like the real one.
Lawyers' Insurance Association of Nova ScotiaPublished 25 Jun 2026
June 2026
Ontario, Canada

In June 2026 the insurer for Ontario's lawyers described a case in which a fraudster got into a lawyer's email account, blocked the other lawyer's emails and supplied false banking details. A wire went to the wrong account and took several days to reverse.

In the source's wordsA fraudster accessed Lawyer A’s email account and blocked emails sent by Lawyer B to Lawyer A.
The way in, as the source states itA real mailbox was taken over. The source does not say how the mailbox was entered.
LAWPRO Magazine, June 2026Published June 2026
22 Jan 2026
British Columbia, Canada

In January 2026 the Law Society of British Columbia's insurer reported that a Vancouver law firm wired about $1.4 million in settlement funds to a fraudster. The fraudster had got into the firm's email system and sent a note from a partner's own account saying the wire instructions were verified.

In the source's wordsThe fraudster had gained access to the firm’s system and was able to monitor and intercept emails to control the conversation.
The way in, as the source states itA real mailbox was taken over. The source does not say how the mailbox was entered.
Law Society of British Columbia's insurer, as published by the Nova Scotia lawyers' insurerPublished 22 Jan 2026

Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.

02 · The government figure

What was reported, across every line of work.

The FBI's Internet Crime Complaint Center recorded 24,768 complaints of business email fraud in 2025, with $3.05 billion in reported losses. It does not break the figure down by how the email was faked.

Source: FBI Internet Crime Complaint Center, 2025 figures

Reported losses, as the publisher states them. They describe what was reported, not what will happen to your firm.

03 · What an outside check sees

What can be read from outside, before anyone asks for a payment.

01
Email anyone can forge

Your SPF and DMARC records, in plain words: whether a message that fakes your address is refused or delivered.

How we check it
02
Look-alike domains

Registered domains made from your firm’s name. We tell you which deserve a second look, with the public record behind each, and ask: is it yours?

How we check it
03
Shared addresses in breach records

Addresses at your domain in monitored breach databases. A reused password can open a real mailbox, and a real conversation with a client.

How we check it

An outside check cannot see inside a mailbox or a bank. Where a source does not state the way in, we do not guess it.

The outside watch for law firms Cases: Builders and tradesCases: Real estate, title and closingsCases: Manufacturers and suppliers Cases by line of work
04 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy