Conveyancing Phishing: Can Fraud Start With a Fake Sale Memorandum?

A sale memorandum arrives by email. The property address looks familiar, the message carries a recognisable logo and the attachment appears to contain documents needed to progress the transaction.

Before the recipient can view it, a page asks them to sign in to their email account.

The immediate target may be the password, rather than the purchase money. Access to an email account can give a criminal information and opportunities to impersonate someone later in the transaction.

Conveyancing fraud prevention therefore needs to begin before completion approaches. The first convincing document request may deserve as much attention as a last-minute change of bank details.

Originally published 3 November 2016. Updated 2 November 2026.

The original warning: a document designed to capture credentials

The original version of this article described suspicious emails reviewed by Lexsure. They appeared to enclose early conveyancing documents and used the name and branding of a genuine law firm.

One attachment had a filename ending in “.pdf.htm”. Instead of simply displaying a PDF, it opened a web page that imitated a protected document and requested an email address and password.

That was a historical example of a credential-harvesting attempt. It should not be treated as the only format staff need to recognise today.

The continuing lesson is to question an unexpected authentication request, even where the message appears relevant to a genuine property transaction.

Why a sale memorandum makes a plausible approach

Sale memoranda, contract papers, enquiries and redemption documents are ordinary parts of conveyancing correspondence.

A message referring to them can arrive when staff are expecting information from an estate agent or another firm. A request to open a document may therefore appear routine.

Consider this illustrative sequence:

1. A member of staff receives an apparently relevant document notification.
2. The link or attachment presents a convincing sign-in page.
3. The recipient supplies credentials without independently checking the destination.
4. The attacker attempts to use that access to obtain information or impersonate the account holder.

This is an illustration of the risk, not a report of a particular completed fraud. Its purpose is to show why a payment control at completion cannot replace secure document handling earlier in the matter.

A familiar name or email chain is not sufficient verification

A message can misuse a genuine firm’s name, logo, address and employee details. It may also come from a compromised account.

The SRA’s warning on bogus law firms and identity theft explains why apparently credible credentials require further investigation where concerns arise.

Checking that a firm exists on a regulatory register is useful. It does not authenticate every message using that firm’s identity.

Similarly, neither a familiar display name nor an existing email conversation proves that a new instruction or document link is genuine.

Check the request, not just the spelling

Poor spelling can be a warning sign, but polished wording should not end the enquiry.

Before opening an unexpected document or following a sign-in request, consider:

• Is this a transaction the firm recognises?
• Was this person expected to send these documents?
• Does the actual sender address match the established correspondence?
• Is the proposed document-sharing service one the firm expects to use?
• Does the request ask for unusual access, permissions or authentication?
• Is urgency being used to discourage checking?

A generic email address is a reason to consider the context, not conclusive proof of fraud. Conversely, a firm-branded address is not a guarantee of authenticity.

If uncertain, contact the sender through a separately established route. Replying to the suspicious message or calling the number it supplies may leave the verification under the attacker’s control.

A genuine portal may require sign-in. Verify the route first

Some legitimate document-sharing services require authentication. A workable procedure should help staff distinguish approved access from an unexpected request for credentials.

Where possible, use an established bookmark, approved application or independently verified portal address. If a new service is proposed, follow the firm’s approval and verification process before entering credentials or granting access.

Do not disable security controls, approve an unexpected authentication prompt or grant account permissions merely because a message says that doing so is necessary to read conveyancing papers.

Our article on authority to share documents through conveyancing portals addresses the separate question of what may be uploaded once the destination has been established.

Fraud controls should cover reception, support staff and fee earners

The first recipient may be a receptionist, administrator, assistant or shared-mailbox user. The procedure should work for everyone handling incoming documents.

Agree who can verify an unfamiliar sender, where staff report suspicious messages and who provides cover when the usual contact is unavailable.

A practical training exercise can use a fictional sale memorandum that leads to an unexpected sign-in request. Ask staff to explain what they would check and whom they would contact.

The useful result is a clear, repeatable response. Staff should be able to raise concerns promptly, including after clicking, without concealing the incident through fear of criticism.

What if someone has already entered a password?

Report it immediately through the firm’s incident-response procedure. Tell the IT or security contact what happened, what information was supplied and whether any authentication request or permission was approved.

The NCSC’s guidance on responding to phishing advises contacting the IT department where work equipment is involved and changing compromised passwords, including on accounts where they were reused.

Account recovery should be managed with the responsible technical team. Ask them to assess active access, suspicious account changes and the extent of any compromise. Do not assume that a password change alone completes the investigation.

Preserve the suspicious message and relevant records using the firm’s reporting process. Avoid circulating an active malicious attachment around the organisation.

If money has been sent, contact the bank immediately. The firm should also assess any regulatory, data-protection, insurance and client-notification obligations arising from the facts.

Clients need clear warnings too

Buyers and sellers also receive document links, portal invitations and requests for payment during a transaction.

Explain at the outset which communication methods the firm uses, how clients can verify a doubtful message and how payment details will be confirmed.

Warnings should remain visible when clients are about to transfer money. The Law Society’s payment-diversion guidance emphasises checking payment details directly through a reliable contact route.

A client should feel able to question a convincing message without worrying that the enquiry will be dismissed as an inconvenience.

For the separate questions of payment loss, bank complaints and reimbursement, read Conveyancing Email Fraud: Who Bears the Loss?

Connect document security with payment verification

Fraud procedures should join up the stages of the transaction: incoming documents, account access, verification of other firms, client warnings and payment authorisation.

Lexsure’s Knowledge Hub includes suggested wording on checking bank details of other conveyancers and third parties. Its public summary identifies authentication procedures and expressly calls for adaptation to the firm’s arrangements.

That is a related payment safeguard, rather than a substitute for phishing prevention. The firm’s information-security procedures should address the earlier document and account-access risks.

Our guide to the CQS Information Management and Security Policy considers how those responsibilities can be documented and implemented.

A fraud policy needs to work before completion day

Review whether the firm’s written procedures identify:

• How unexpected documents and authentication requests are handled.
• How the identity and contact details of other lawyers are verified.
• Who deals with suspected account compromise.
• How payment instructions are independently authenticated.
• What staff and clients should do when something appears wrong.
• How concerns, decisions and checks are recorded.

Support those procedures with appropriate technical controls, staff training and supervision. The NCSC’s small-organisations cyber-security guidance provides a useful starting point for reviewing email and account security.

The expression “Friday afternoon fraud” should not confine attention to Friday or completion day. A convincing document request may be the point at which the attacker first seeks access.

This article provides general risk-management information for conveyancing practices in England and Wales. The original phishing example dates from 2016. Current procedures should reflect the firm’s systems, professional obligations and technical advice. About Conveyancing and POLICYmonitor are Lexsure publications and services.