Sophisticated attempts to defraud New Zealand lawyers are now common and the New Zealand Law Society is warning all lawyers to be very careful when receiving any emailed instructions or directions.

A number of New Zealand firms have been victims of "spoofing" emails where a member of the firm appears to instruct another member to transfer money.

The fraud uses an email with a forged sender address, making the message appear to be genuine. The amounts asked for are often relatively small, thus potentially avoiding scrutiny.

Another variant to the fraud is apparently sent from one lawyer's iPhone.

Other firms have been caught up in frauds where a message is sent by the fraudsters to a client, purportedly from the law firm. The email asks the client to deposit money into a bank account, said to be the firm's trust account.

The Law Society says all lawyers and law firms should continue to focus on ensuring their IT networks and systems are as secure as possible, and are also advised to use a means other than email to check any instructions which involve the transfer of money. It may also be prudent to advise clients of the need for caution with any apparent instructions or advice they might receive by email.

While the methodology and wording differs, the following attempted frauds have been reported to the Law Society recently. Any identifying details of law firms have been removed or changed (shown by *).

"iPhone" instructions - several attempts made, last by email

From: Jill Hill* <iphonesemailss@gmail.com>
To: Doug Slug* [Slug Lawyers*]
Subject: Urgent

Have a pending payment to be paid to the UK now, are you available to handle right away? What is our current balance as of today?

Regards
Jill Hill

Sent from my iPhone

From: Jill Hill* <iphonesemailss@gmail.com>
To: Doug Slug* [Slug Lawyers*]
Subject: Urgent

Are you available to handle an international payment this morning? Have one pending, let me know when to send bank details.

Regards
Jill Hill

Sent from my iPhone

From: Jill Hill* <donjohnsons@gmail.com>
To: Doug Slug* [Slug Lawyers*]
Subject: Urgent

Doug

Are you available to send a transfer? Let me know so i can send payee's details

Regards
Jill

Emails purportedly from lawyer to other member of law firm

First email

Hello Moana*

How are you today? I will need you to process a bank wire transfer, which needs to go out of the country today as a same value day payment. Let me know if you are available now, so I can forward the beneficiary's account details.

Thanks,
Basil*

The recipient responded, noting that they were available to help but there would be a delay in processing the transfer.

Second email

Thanks for your email, process sum of $12,276.80 USD now as same value payment to the payee account sated [sic] below:

BANK NAME: Bank of American [sic]
BANK ADDRESS: [address in Texas given]

Account Name: [Provided]
Account Number: [Provided]
Routing Number: [Provided]

As soon as the transfer is done, email me the confirmation slip. So, i can forward it to the beneficiary.

Regards,

Phone contact was then made between Moana and the real Basil and the fraud was discovered. A few hours later, the final fraud attempt was made:

Third email

What is the update on the transfer?

Not to forget the more traditional attempts to infiltrate IT systems with malware (Don't click the link!)

From: John Kelly <jKelly@argusfire.co.nz>
Subject: E-Docs

We have just sent you an important Document of a remittance invoice Via Drop-Box, Browse Here to View it.

Thanks
JK.

Email: