Attorney trust account fraud is aimed at the one account where a firm’s own money is not at stake. Trust accounts hold client settlements, closing funds, and escrow deposits, often in large sums, and the lawyer is personally responsible for every dollar. That combination makes the account worth far more to a criminal than any operating account, and far more painful for the firm to lose.
The email arrives on a Monday morning from a company the firm has never heard of.
The sender introduces himself as the finance director of a manufacturer owed money by a customer in Florida. He wants to hire the firm to collect it. He is polite and in a hurry. He is traveling, so he can only communicate by email and text. He signs the fee agreement the same afternoon.
Two days later, a FedEx envelope arrives with a cashier’s check for $186,000. The customer has agreed to pay in full, the “client” explains. He asks the firm to deposit the check, take its fee, and wire the balance to his company’s bank, as a favor, today, because payroll is due.
The firm’s bookkeeper deposits the check. The bank’s online system shows the funds as available within a day. The partner, who has no reason to doubt a cashier’s check, approves the wire.
Nine days later, the bank calls. The cashier’s check was counterfeit. The bank is reversing the deposit.
The wire is gone. The trust account is $160,000 short, and every dollar belongs to other clients.
Why the Trust Account Is the Prize
Criminals do not attack trust accounts at random. They attack them because of what the account holds and how the law treats it.
Trust accounts often contain substantial sums at any given moment: settlement proceeds, closing funds, retainers, and client deposits for matters of every size. A single account can hold the money of dozens of clients.
Unlike the firm’s operating account, the money is not the firm’s. A loss is not a business expense. It is a shortage in funds the lawyer holds as a fiduciary, which the lawyer must make good, while also facing questions from clients, the bank, and the Florida Bar.
The Bar has said as much. Its publications describe attorney trust accounts as attractive targets precisely because they often hold substantial amounts and because perpetrators hope the attorney will assume a cashier’s check will clear and disburse funds before the bank discovers the fraud.
The Four Main Ways Trust Accounts Are Attacked
The Florida Bar and its practice resource center have documented several recurring schemes. They differ in method, but they share a pattern: a request that moves fast, a check or instruction that looks legitimate, and a delay before the truth surfaces.
1. The counterfeit cashier’s check. A stranger poses as a client, often in a collections matter, real estate transaction, or divorce settlement. The firm receives what appears to be a valid cashier’s check. The “client” asks the firm to wire the proceeds, less its fee, to another party. The bank later returns the check as counterfeit, sometimes a week or more later, and reverses the deposit. The FBI has warned that these schemes target law firms anywhere a lawyer helps collect or transfer money.
2. The overpayment. A genuine or fake client sends more than the agreed fee, apologizes for the error, and asks the firm to return the excess by wire. Any overpayment followed by a request to wire back the difference is a warning sign by itself.
3. The compromised wire instruction. An attacker watches an email thread, then sends altered wiring instructions near a closing or disbursement. This is the scenario covered in an earlier article in this series on voice cloning and law firm wire fraud.
4. The cloned or forged trust check and the unauthorized debit. Criminals who obtain a firm’s trust account number and routing number can print counterfeit checks that look authentic and negotiate them at other banks. The Florida Bar has reported instances of exactly this. Others try small, unauthorized electronic debits, as in the case of a Sarasota lawyer who noticed a 47-cent charge that could have been the first test of a larger attack.
Each of these exploits the same gap: the gap between money appearing in an account and money actually being collected.
The Rule Is Part of the Problem, and the Bar Knows It
One feature of Florida’s trust accounting rules deserves particular attention, because fraudsters build their schemes around it.
Rule 5-1.1(j) allows lawyers to disburse against certain instruments, including cashier’s checks, before they are finally collected, because the rule treats them as carrying a limited and acceptable risk of failure. The Florida Bar has acknowledged that this is exactly why the cashier’s check scam works. If a lawyer disburses against uncollected funds in circumstances where an exception does not apply, the lawyer may have violated the trust accounting rules and be required to report it.
The practical lesson is that what the rules allow is not the same as what is safe. A firm can be technically permitted to disburse and still lose its clients’ money. A conservative firm waits until a deposit is fully collected, particularly for a new client, a transaction it did not expect, or any request to move funds out quickly.
What the Trust Accounting Rules Already Require
Fraud prevention in a trust account starts with a set of obligations lawyers already have, and many firms underuse them as security controls.
Monthly reconciliation. Rule 5-1.2 requires lawyers to reconcile the bank balance against the account journal and against each client’s ledger every month, and to identify and resolve any discrepancy. This is one of the most effective fraud detectors available, because a theft that the firm did not authorize shows up as a difference between the bank and the books.
A written trust account plan. Firms with more than one lawyer must maintain a written plan naming the lawyers who sign and review trust checks, who oversee reconciliation, and who answer questions about the trust account. Those lawyers must be shareholders, partners, or owners.
Six years of records. The minimum records, including bank statements, deposit records, wire details, and the fronts and backs of canceled checks, must be kept for at least six years. The Bar’s own guidance advises lawyers to obtain these records from the bank every month, since banks may not be able to provide old records later.
Annual certification. Lawyers certify their compliance with the trust accounting rules to the Bar each year, and failure to file, a returned trust check, or other triggers can lead to an audit.
Overdraft reporting. If a trust account is overdrawn or a trust check is dishonored, the lawyer must notify the Bar.
These are compliance duties, and they are also the foundation of a security program. A firm that follows them rigorously is far better placed to spot fraud.
Monthly Is Not Fast Enough
A monthly reconciliation catches fraud, but it can catch it three or four weeks after the money has left. By then, wires cannot be recalled and funds have moved through several accounts.
The Bar’s guidance goes further than the minimum. It recommends daily or weekly monitoring of trust account activity so that unauthorized transactions are noticed in days, not weeks. The Sarasota attorney who caught the 47-cent debit did so because he was watching closely, and the Bar highlighted his story for that reason.
Speed matters because recovery depends on it. The FBI’s 2025 Internet Crime Report, discussed in an earlier article in this series, recorded more than $3 billion in business email compromise losses, and the agency’s recovery process works best when victims and banks act within hours. A firm that discovers a fraud on the 30th of the month has far fewer options than one that discovers it on the second day.
Bank Controls That Make Trust Accounts Harder to Attack
Many of the strongest protections are services the bank already offers, and many firms never turn them on.
Positive pay. The firm sends the bank a list of the checks it has issued, and the bank pays only those checks. A cloned check with the right account number but no match in the firm’s list is rejected. The Bar specifically recommends enrolling in positive pay for trust accounts.
ACH debit and credit blocks. ACH transactions can be initiated by anyone with the account and routing numbers, and ACH credits can be reversed by the originator. The Sarasota lawyer instructed his bank to block ACH debits and credits, and set the account to require wire transfers only. Many trust accounts do not need ACH activity at all.
Wire controls. Require two approvals for any wire, set limits, and use callback verification for any new or changed destination. Do not allow a wire to be released on the strength of an email alone.
Account alerts. Set the bank to send immediate alerts for any debit, any wire, any new payee, and any login from a new device.
Restricted online access. Give each person individual banking credentials with only the permissions that person needs. A bookkeeper who reconciles does not need the ability to release wires.
A direct line. Know who the bank’s fraud contact is before an incident, and keep the number where the whole team can find it.
Separate the Roles
Fraud is not always external. The Bar’s emphasis on a written plan with named responsible lawyers reflects a long-standing principle: no single person should control the entire chain.
The person who receives funds should not be the only person who disburses them. The person who signs checks should not be the one who reconciles the account. The person who reconciles should not be able to alter the records. In a small firm, with one bookkeeper and two partners, this takes deliberate design, but it can be done by assigning reconciliation review to a partner who does not process transactions.
Separation of duties protects the firm against internal misconduct, and it also reduces the damage from an attacker who takes over a single employee’s account.
Technology Is Part of the Defense
The trust account is only as secure as the computer, the email account, and the banking login behind it.
Multifactor authentication on banking and email. An attacker who steals a bookkeeper’s banking password should hit a second barrier. Phishing-resistant methods are best, for the reasons discussed in an earlier article on Microsoft 365 credential theft.
A protected device for banking. Trust account banking should happen on a computer that is fully patched, protected by modern endpoint security, and not used for casual browsing or personal email.
Email security. Because fraudulent wire instructions and fake client requests arrive by email, filtering that flags lookalike domains, newly created sender domains, and external messages impersonating partners reduces how many reach the inbox.
Monitoring. Alerts on unusual banking logins, new mailbox forwarding rules, and changes to payee information can reveal a compromise early.
Training. Staff who handle trust deposits and disbursements should be trained on the specific schemes described above, including the overpayment request and the urgent wire.
A Short Rule Set Every Firm Can Adopt
Many of the losses described by the Bar and by other states’ disciplinary offices share one cause: someone acted before the money had actually arrived. A firm can protect itself with a few plain rules.
Never disburse trust funds against a deposit until it has fully cleared, and understand that “available” in the online banking screen is not the same as “collected.”
Treat any request to wire funds quickly, especially to a foreign account, as a red flag requiring a partner’s review.
Verify any new client independently, including a phone call to a number you find yourself, and insist on a video call or in-person meeting for any engagement that involves moving money.
Never return an overpayment until the original deposit has fully cleared, and never return one by wire.
Never rely on email alone for wire instructions, and verify every change by callback.
Insist on receiving funds by wire when the transaction allows, since wires are final and a counterfeit instrument cannot be substituted.
If a Loss Occurs
Acting immediately gives the firm the best chance of recovering funds and protecting clients.
Call the bank’s fraud team and request a recall or freeze. Report to the FBI’s Internet Crime Complaint Center. Preserve every email, check image, and wire record. Determine exactly which clients’ funds are affected and cover any shortage promptly from firm funds so no client is left short. Consult your malpractice carrier and ethics counsel about notice and reporting obligations, including any report to the Bar of an overdraft or returned check. Notify affected clients honestly and quickly.
The Florida Bar’s practice resource center, LegalFuel, publishes guidance on these scams, and the Bar asks lawyers to report trust account fraud to its Attorney Consumer Assistance Program so it can warn others.
Name an Owner for Trust Account Security
The Bar already requires a written plan naming the lawyers who sign trust checks, oversee reconciliation, and answer questions about the account. That plan covers the accounting. It rarely covers the technology.
Add a technology owner to the plan: the person, or the managed IT services partner, responsible for the devices, accounts, and bank portal access that touch trust funds. That owner confirms that multifactor authentication is on, that former employees have lost access, and that the banking computer is patched and protected.
Pair that role with monitoring. When cybersecurity monitoring flags a new sign-in to the bank portal, a new forwarding rule on a partner’s mailbox, or a change to payee details, the firm learns about it the same day, which is the timeline the Bar’s guidance on daily or weekly review assumes.
What This Means for Miami and South Florida Firms
South Florida attorneys operate in an environment that makes trust account protection especially important.
Real estate is a large share of the local legal market, and closings move large sums through trust accounts on short timetables. That volume gives attackers more cover and gives firms less time to verify.
International work is common. Clients, buyers, and investors from other countries send and receive funds across borders, so a request to wire money overseas does not look unusual, which is exactly what scammers count on. The Bar has reported fake yacht purchase schemes aimed at South Florida maritime lawyers, using local brokers to gain credibility.
Hurricane season disrupts offices and shifts staff to remote work, so trust account banking sometimes happens from home computers and unfamiliar networks during exactly the weeks when a firm is most stretched.
And the market is competitive. Firms feel pressure to say yes quickly to new clients and to move money promptly, and fraudsters build their pitch around that pressure.
Ask Your IT Provider Questions Like These
Is multifactor authentication enforced on our trust account banking and on every email account that can approve a payment?
Is our banking done on a protected, patched device with modern endpoint security?
Do we have positive pay and ACH blocks enabled on the trust account, and do we get immediate alerts for any transaction?
Does our email system flag lookalike domains and newly created sender domains?
Do we monitor for hidden forwarding rules and unusual sign-ins on partner and bookkeeper accounts?
Who in the firm would the bank call first if it suspected fraud, and do they know what to do?
If your IT provider cannot answer these clearly, the account that holds your clients’ money may be protected by less than the account that holds yours.
The Fiduciary Duty Does Not Come With a Fraud Exception
Clients entrust a firm with their settlement proceeds, closing funds, and deposits, and expect them to be safe. Neither the bank’s delay nor a fraudster’s skill changes who is responsible.
The firms that avoid trust account losses are not the ones with the best instincts. They are the ones that built habits and controls so the right answer does not depend on someone guessing correctly under pressure.
ITva Technologies provides managed IT and cybersecurity services for law firms across Miami-Dade and Broward, with specific experience securing the banking, email, and devices behind client funds.
Our managed IT services include protected banking workstations, email security configured to catch impersonation and lookalike senders, and documented procedures that support your written trust account plan.
Our cybersecurity services include phishing-resistant multifactor authentication, monitoring for account takeover, and training on the cashier’s check, overpayment, and wire fraud schemes that target law firms.
If your firm has never reviewed the technology protecting its trust account, that is worth doing before the next urgent request arrives.
Schedule a free trust account security assessment with ITva.
We will review how your trust account is accessed, approved, and monitored, and show you where a convincing request could get through.
Because the account holds other people’s money.
Your protections should reflect that.
Frequently Asked Questions
Why are law firm trust accounts targeted by fraudsters?
They often hold large sums belonging to many clients, and a loss is a shortage in funds the lawyer holds as a fiduciary. Criminals also exploit the gap between a deposit appearing as available and the funds actually being collected, hoping the lawyer will wire money out before a fraudulent check is returned.
What is the counterfeit cashier’s check scam?
A stranger poses as a client and sends a cashier’s check, then asks the firm to wire the proceeds, less its fee, elsewhere. The check is counterfeit and is returned by the bank days or weeks later, but the wire cannot be recovered. A variation is the overpayment, where the firm is asked to wire back the excess.
What does Florida Bar Rule 5-1.2 require?
It requires specific trust accounting records, monthly reconciliation of the bank balance against the account journal and each client’s ledger, a written trust account plan for firms with more than one lawyer, and retention of records for at least six years. Lawyers also certify compliance to the Bar annually.
What bank controls should a trust account have?
Positive pay so only approved checks are honored, ACH debit and credit blocks, wire approval controls with dual authorization, immediate account alerts, restricted individual online credentials, and a known fraud contact at the bank.
Is a monthly reconciliation enough to catch fraud?
It is required and valuable, but it can detect a theft weeks after the money has left. The Florida Bar recommends daily or weekly monitoring of trust account activity so unauthorized transactions are found sooner.
What should a firm do if it sends money in a trust account fraud?
Call the bank’s fraud team immediately to request a recall, report to the FBI’s Internet Crime Complaint Center, preserve all records, cover any client shortage promptly, and consult your malpractice carrier and ethics counsel about notice and reporting duties, including any report to the Bar.