Updated October 2026: This article was originally published in November 2016 following a Financial Ombudsman decision concerning money diverted during a conveyancing transaction. It has been updated to reflect subsequent developments in authorised push payment fraud, bank liability, reimbursement protection and conveyancing risk management.
A homebuyer receives an email that appears to come from their conveyancing solicitor. It contains information about the transaction and asks for the deposit or balance of the purchase price to be transferred to a particular bank account.
The buyer makes the payment. Only later do they discover that the correspondence has been compromised and the money was sent to an account controlled by a fraudster.
This form of conveyancing email fraud has been described as “Friday afternoon fraud”, payment diversion fraud and authorised push payment fraud. Whatever terminology is used, the consequences can be devastating. The purchaser may lose the money needed to complete, the transaction may collapse and questions may arise about the conduct of the buyer, the conveyancing firm and the banks involved.
How the £47,508 conveyancing fraud happened
In 2016, the Financial Ombudsman considered the case of a couple who believed they were transferring a deposit of £47,508 to their conveyancing solicitor.
The couple had received what appeared to be a legitimate email containing alternative payment instructions. In reality, a fraudster was impersonating their solicitor and directing the money into an account under the fraudster’s control.
Once the transfer was made, the money disappeared.
The couple complained about the bank account into which the stolen money had been paid. The relevant account was reportedly newly opened, and the Ombudsman considered whether the receiving bank should have recognised that the incoming payment was inconsistent with what it knew about the account and taken action.
Why the Ombudsman required Lloyds to reimburse the couple
The Financial Ombudsman reportedly directed Lloyds Bank to reimburse the £47,508 together with interest. The decision focused on what the bank knew, or ought reasonably to have identified, about the receiving account and the suspicious payment entering it.
That made the decision significant for conveyancing firms and their professional indemnity insurers. Where money had been diverted through a fraudulent bank account, it suggested that responsibility might not rest exclusively with the victim or the conveyancing practice.
However, a Financial Ombudsman decision is based on the circumstances of the particular complaint. It does not create a binding legal precedent equivalent to a judgment of the courts.
Was this finally good news for conveyancing lawyers?
At the time, the decision offered some encouragement to a profession facing increasingly sophisticated cybercrime while handling large payments under considerable time pressure.
Conveyancers are often among the first parties scrutinised when a property payment is stolen. Their email security, warnings to the client, bank-detail verification procedures and response after discovering the fraud may all be examined.
The 2016 decision indicated that the receiving bank’s conduct could also be relevant, particularly where a newly opened account received a substantial payment that was inconsistent with its expected use.
It did not establish that a bank must reimburse every victim of conveyancing payment fraud. The legal and regulatory position has developed considerably since then.
What changed after Philipp v Barclays?
In Philipp v Barclays Bank UK plc, the Supreme Court considered the obligations of a bank where a customer had personally authorised payments after being deceived by fraudsters.
The Court did not accept that the established Quincecare duty should be extended so that a bank must decline a clear and valid payment instruction merely because it has reasonable grounds to suspect that the customer has been deceived.
Where the customer gives the payment instruction personally, the bank’s ordinary duty is to execute it. That differs from a situation in which an agent purporting to act for the customer gives an instruction and the bank has reason to suspect that the agent is attempting to defraud the customer.
The judgment did not make banks immune from every claim connected with authorised push payment fraud. Questions about what happened after notification of the fraud, including whether reasonable steps were taken to recall or recover the payment, may need to be considered separately.
Read the Supreme Court case summary for Philipp v Barclays Bank UK plc.
Mandatory APP fraud reimbursement from October 2024
A new mandatory reimbursement regime came into effect on 7 October 2024. It provides protection for qualifying victims of authorised push payment fraud involving payments made through Faster Payments and CHAPS.
The protection generally applies to individuals, microenterprises and charities. Subject to the applicable rules, qualifying claims can be reimbursed up to the maximum limit of £85,000.
The rules do not mean that every loss will automatically be repaid. Matters such as the date and type of payment, whether the payment falls within the scheme, the status of the payer and compliance with the applicable consumer standard of caution may all be relevant. Special provisions apply where vulnerability affected the victim’s ability to protect themselves.
The Payment Systems Regulator explains the current APP fraud reimbursement protections.
The applicable framework also depends on when the payment was made. Complaints concerning payments before 7 October 2024 may fall to be considered under different arrangements, including the former voluntary Contingent Reimbursement Model Code where the relevant payment provider was a signatory.
Why conveyancing firms still need strong payment controls
The reimbursement regime does not remove the need for robust fraud-prevention procedures within a conveyancing practice. A loss may fall outside the scheme, exceed its financial limit or involve a payment route that is not covered.
A firm’s conduct may also be examined by its client, professional indemnity insurer, regulator, lender or the Legal Ombudsman. The file should therefore demonstrate what warnings were provided, how bank details were communicated and what verification took place.
The attack may begin before any payment request. Our guide to conveyancing phishing through fake sale memoranda and document requests explains how early correspondence can be used to seek access to an email account.
Practical controls for conveyancing payments
Conveyancing practices should consider procedures that:
- warn clients at the outset that criminals may attempt to intercept or impersonate email correspondence;
- state clearly whether the firm will ever change its bank details during a transaction;
- tell clients not to act on changed payment instructions received solely by email;
- require clients to verify bank details using a trusted telephone number obtained independently of the payment email;
- require staff to verify any request to change a client’s payment instructions through a separate communication channel;
- restrict access to bank details and payment information to staff who require it;
- use appropriate email security, multifactor authentication and access controls;
- train staff to recognise impersonation, account takeover and social-engineering attempts;
- provide a clear internal escalation process where fraud is suspected;
- require immediate action when a payment is diverted; and
- preserve emails, call records and payment evidence for any subsequent investigation.
Telephone verification is only useful if the telephone number itself is reliable. Calling a number contained in the suspicious email may simply connect the victim to the fraudster. Clients should use a number obtained independently, such as one already held, published on the firm’s genuine website or confirmed at the beginning of the transaction.
Do your policies address mortgage and property fraud?
Individual precautions should form part of a documented and consistently applied framework. Conveyancing firms should ensure that responsibility for fraud prevention, payment verification, client warnings, staff escalation and incident response is clearly addressed within their policies and procedures.
The CQS CPMS Mortgage and Property Fraud Prevention Policy template addresses matters including client identity, linked transactions, mortgage fraud schemes, warning signs, the firm’s client account and the safeguarding of other people’s bank details.
Fraud prevention should also form part of the firm’s broader approach to operational and regulatory risk. The CQS CPMS Risk Management Policy template provides a wider framework within which cybercrime controls, staff responsibilities and responses to identified risks can be managed.
Review the relevant templates: Mortgage and Property Fraud Prevention Policy or Risk Management Policy.
What should client terms and fraud warnings say?
Policies alone are not sufficient. Clients need clear warnings explaining how bank details will be communicated, whether those details may ever change and how payment instructions should be verified.
Our article on the cybercrime update to conveyancing terms and conditions identifies wording dealing with payment verification, changed instructions, returning money to clients, secure communications and the risks of relying on bank details supplied by email.
Firms reviewing their engagement documentation can also consider the Lexsure precedent wording on guarding against cybercrime in client terms.
Fraud warnings are most useful when they are specific, prominent and repeated at the point when the risk becomes immediate. A warning buried in lengthy terms of business may not be enough to change behaviour when a convincing payment request arrives several weeks later.
Clients should understand that:
- an email that looks genuine may have been sent by a criminal;
- the fraudster may know details about the transaction;
- urgency and last-minute changes are warning signs;
- bank details should be checked before any substantial transfer;
- a small test payment does not necessarily establish that the account belongs to the intended recipient; and
- suspected fraud must be reported immediately because delay can reduce the prospect of recovering the money.
Cloned conveyancing websites and false credentials
Email is not the only method used to impersonate a law firm. Criminals may create a cloned website, use a misleading domain name or copy a firm’s branding and regulatory information.
Our related article asks whether authentication badges can help combat conveyancing website fraud. Badges and accreditation logos may provide reassurance, but they should not be treated as proof of identity because a dishonest operator may copy them.
What should happen when money is diverted?
Speed is critical. The sending bank should be contacted immediately and asked to begin its fraud and payment-recall procedures. The receiving bank, the conveyancing firm and the relevant authorities may also need to be notified.
The parties should preserve the fraudulent emails, complete email headers, telephone records, payment confirmations and any earlier correspondence containing bank details. Changing passwords and securing compromised accounts is important, but evidence should be retained before information is deleted or devices are reset.
A victim whose bank refuses reimbursement may be able to use the bank’s complaints procedure and, where eligible, refer the complaint to the Financial Ombudsman Service.
The lesson for conveyancing practices
The 2016 Ombudsman decision was encouraging because it recognised that the operation of the fraudster’s bank account could form part of the story. It was not a complete answer to the allocation of responsibility for conveyancing payment fraud.
The current position combines legal principles, regulatory reimbursement rules and the facts of the individual payment. Even where reimbursement protection is available, prevention remains far better than attempting to recover a house deposit after it has entered a criminal network.
Conveyancing firms should ensure that their fraud warnings, payment-verification procedures, staff training and incident-response arrangements reflect the way these frauds now operate. The question after a loss will not simply be who sent the payment. It will be what each party knew, what controls were in place and how quickly everyone acted when the fraud was discovered.
This article provides general information and does not constitute legal advice about liability, reimbursement or any particular fraud claim.
Leave a Reply