Lawyer-Based Money Laundering Scam

Attorney/Law Firm/Lawyer-Based Money Laundering Scams: A Practical Guide For Attorneys And Business Leaders

Legal practices and corporate finance teams handle large sums, trusted information, and time-sensitive decisions. That combination attracts organized criminals who try to launder illicit funds through law offices and in-house legal workflows. Lawyer-based money laundering scams now borrow the language of mediation and settlement, copy document flows, and exploit ordinary billing habits. This guide explains how the schemes work, what warning signs appear early, and which controls help a firm or business avoid losses while preserving client service.

A Recent Attempt: Anatomy Of A Near Miss

One firm received a detailed approach to arrange a mediation on a business dispute valued at 600,000 dollars. Scheduling took weeks. Retainer agreements were circulated and signed through a common e-signature tool. Courier delivery brought two checks to the office. The first covered the full-day mediation fee. The second, unexpected, claimed to be a prepayment on an “undisputed” portion from one party to the other.

The second check did not sit right. The transaction structure felt unusual. Physical details on the checks raised quiet doubts. Before depositing only the fee check, the firm notified its bank, documented concerns, and attempted a deposit into the general account rather than the trust account. Monitoring confirmed the suspicion. The bank later determined that the check was fraudulent. The firm reported the attempt to local authorities and closed the loop with staff so the lessons would stick.

How The Scheme Typically Works

Criminals script a credible commercial dispute and present it to a lawyer or a corporate legal team. They build patience into the script to lower suspicion. They stage calls, circulate retainer drafts, and confirm a date. Then they ship one or more checks by overnight courier to anchor the story with a physical act.

The day after delivery, the criminals often claim that the dispute had been resolved. They express gratitude, ask the lawyer to keep a fee, and request a refund of the balance to a designated payee. If the firm deposits into the trust account, transfers an earned “fee” into the operating account, and refunds the remainder, the trap snaps shut. The original check later bounces as counterfeit or altered. The refund was real. The trust account is now short by the refunded amount, and the lawyer faces liability for the entire loss.

Common Red Flags And Early Signals

Seasoned teams look for patterns, not perfection. The following signals tend to appear in these scam attempts:

• Unsolicited engagement that bypasses a normal referral channel.
• Urgent scheduling paired with a polished backstory and unusually easy agreement on terms.
• An unexpected second check that purports to settle an “undisputed” amount between the parties.
• Requests to deposit quickly and hold funds for near-term disbursement.
• Instructions to keep a generous fee that exceeds effort to date.
• Email domains that look close to, but not exactly like, known companies.
• Courier labels, return addresses, or phone numbers that do not match the supposed client’s company records.
• Physical check irregularities, including mismatched fonts, poor microprint, nonstandard paper, inconsistent perforations, stale dates, routing numbers that do not match the printed bank name, or a magnetic ink line that fails bank imaging.
• Changes in payee or account details after funds arrive.
• Pushback when the firm proposes verification, bank holds, or slower disbursement timing.

Why Law Firms And Corporate Counsel Are Attractive Targets

Law offices and corporate legal departments often hold client funds, disburse settlement proceeds, and route payments between parties. Trust accounts are designed to move money predictably. Criminals want to exploit that trust by inserting counterfeit deposits to trigger real refunds. Busy calendars, remote collaboration, and compressed closings add time pressure that can reduce scrutiny. The professional desire to meet deadlines and reduce friction becomes the lever.

Risk Points Across Legal Workflows

Several everyday workflows deserve special attention:

• Mediation retainers and settlement disbursements.
• Cross-border matters with unfamiliar payors or payees.
• Debt recovery, asset sales, and escrow-style arrangements.
• Real estate closings and earnest-money transfers.
• Vendor settlements and refund processing after contract disputes.
• File-opening fees collected by check from new, non-referred clients.

Controls That Reduce Exposure

Firms and businesses can protect themselves by formalizing a small set of controls. The point is not to slow everything down. The point is to build predictable friction where risk is highest.

Client And Matter Vetting

• • Confirm the client’s identity with independently sourced contact details, not those provided in the inbound email.
  • Verify the business entity, physical address, and a direct phone number.
  • Speak with a human at each company on a published phone line before accepting third-party funds.
  • Require a signed engagement letter that names permitted payment methods and disbursement rules.

Payment Acceptance Rules

• • Treat all first-time checks and all third-party checks as high risk.
  • Prohibit acceptance of overpayments or funds unrelated to the firm’s services.
  • Require bank wires for significant retainers, and verify instructions by calling the bank or client on a known number.
  • If a check is unavoidable, require a bank-verified bank check drawn on a domestic bank, and still apply a long hold.

Check Handling And Bank Holds

• • Deposit suspect checks only into the operating account, never into the trust account.
  • Request extended holds for unfamiliar instruments and confirm with the bank when collected funds become final, not merely available.
  • Do not disburse against any check until final collection is confirmed by the bank.
  • Document the bank’s confirmation with date, time, and the name of the banker.

Trust Account Safeguards

• • Prohibit commingling new, unvetted deposits with other client funds.
  • Disburse trust funds only from cleared, verified deposits tied to the same matter.
  • Enforce dual authorization for all disbursements above a set threshold.
  • Reconcile the trust account daily during any period of high-value activity.

Communication Integrity

• • Require verification of any change in payment instructions through a second channel, such as a phone call to a number on a signed engagement document.
  • Decline to act on instructions received only by email when money movement is involved.
  • Maintain a standing script that explains verification as standard policy, not as suspicion toward a client.

Technology And Email Security

• • Enforce multifactor authentication on email, document-sharing, and accounting systems.
  • Train staff to spot look-alike domains, link masking, and spoofed email headers.
  • Quarantine unusual messages that contain file-sharing links, unsigned wire instructions, or new bank details.
  • Log and review failed sign-ins and new device alerts for accounts that handle money.

Verification Playbooks

Teams respond faster when a playbook is close at hand. The following playbooks cover high-risk moments.

For New Funds Arriving By Check

• • Photograph the check front and back.
  • Confirm the routing number and bank name using a trusted directory.
  • Call the issuing bank on a published number to ask whether the account exists and whether the instrument appears consistent with their check format.
  • Record the name of the banker and the date and time of the call.
  • Place an extended hold.
  • Inform the client that disbursement will occur only after confirmed final collection.

For A Requested Refund Or Redirection

• • Pause the transaction.
  • Contact the client on the previously verified phone number.
  • Confirm the request verbally and document the call.
  • If the client cannot be reached, do not disburse.
  • Escalate to a partner or finance leader for a second review.

Immediate Steps When A Suspicious Payment Arrives

When a payment triggers concern, a short sequence helps preserve options and evidence:

• Separate the funds. Deposit only into an operating account with an extended hold, or return the check unprocessed.
• Notify the bank’s fraud team of the concern and request monitoring on the account.
• Preserve all emails, envelopes, courier labels, and shipping receipts.
• Capture screenshots of email headers, message metadata, and any e-signature logs.
• Inform firm leadership and the risk manager.
• Open a matter file to store all records related to the event.
• Decline any request for immediate disbursement until verification is complete.

If Funds Were Disbursed Before The Bounce

Mistakes happen. Swift, organized action may reduce loss:

• Call the bank’s wire or ACH department and request an immediate recall or reversal, providing transaction identifiers and the reason.
• File a fraud claim with the bank and obtain a reference number.
• Notify professional liability and crime insurers within policy deadlines.
• Report to local law enforcement and record the report number.
• If a courier or postal service was used, provide tracking details to support investigation.
• Inform the bar authority if required by trust accounting rules in the jurisdiction.
• Conduct an internal review to identify process gaps and communicate corrective actions to staff.

Coordination With Banks And Insurers

Banks can help, but only when the relationship is active and information is specific. Firms may improve outcomes by taking these steps before any incident:

• Establish a fraud-response contact at the bank and keep the number in the playbook.
• Enable alerts for large deposits, withdrawals, and changes in payee instructions.
• Review the bank’s definition of “available” versus “collected” funds and align internal rules accordingly.
• Confirm daily cutoff times for wire recalls and ACH returns.
• Maintain current contact details for insurance claim reporting and understand evidence requirements.

Staff Training And Culture

Training works best when it stays practical and tied to daily work. Teams build resilience when habits are simple and repeatable.

• Walk through a recent public example of an attorney refund scam and identify the points of failure.
• Practice phone-back verification with a short script.
• Teach staff to slow down when a message contains money movement, a request for secrecy, or a last-minute change.
• Rotate responsibilities so that no single person controls both receipt and disbursement.
• Reinforce a culture where anyone can pause a transaction without blame.

Scripts That Keep Conversations Calm

Standard language helps reduce friction with legitimate clients while blocking criminal pressure.

• “Our policy requires verification of any change in payment instructions by a phone call to the number on your signed engagement document.”
• “Disbursement occurs only after the bank confirms final collection. The hold protects both parties.”
• “A refund cannot be processed from a check that has not cleared. We will contact you once the bank confirms collection.”
• “For significant amounts, we use dual authorization. This adds a day, and it protects the client and the firm.”

Practical Scenarios And Responses

Scenario: A new client asks the firm to deposit a check from an overseas counterparty and then remit most of it to a domestic account.

• • Response: Decline to accept third-party funds unrelated to billed services. Offer to proceed only after verified engagement, verified counterparties, and final collection confirmed by the bank.

Scenario: After courier delivery of checks, the counterparties announce an overnight settlement and ask the firm to keep a fee and return the remainder.

• • Response: Explain that the firm will disburse only after final collection. Initiate bank verification. If pressure escalates, pause all activity and escalate internally.

Scenario: An email arrives with updated wire instructions that differ from those in the engagement letter.

• • Response: Do not act on the email. Call the client at the verified number, confirm the instruction, and then verify with the bank again. If any detail fails to match, stop.

Governance For Corporate Legal And Finance Teams

Businesses face similar exposure when legal and finance teams manage settlements, earn-outs, and refunds. A few governance steps help close gaps:

• Define standard payment methods for settlements and refunds, with clear exceptions and approvals.
• Require maker-checker controls for all disbursements above a set threshold.
• Centralize the master record for bank instructions and track every change with a timestamp and approver.
• Align procurement, legal, and treasury on a single escalation path for suspicious payments.
• Test the recall process quarterly with a dry run to confirm contact paths and timing.

Reporting And Information Sharing

Transparency supports prevention. After any attempt or loss:

• Report the incident to local law enforcement.
• Notify relevant professional bodies if trust accounting rules require it.
• Share sanitized indicators of compromise with peers through appropriate channels, such as bar association alerts or industry groups, without exposing client identities.
• Update internal training materials with the new example so that staff can recognize similar patterns.

A Short Checklist For Busy Days

• Verify the client and counterparties on a published number.
• Accept funds only by approved methods, and set holds on unfamiliar instruments.
• Disburse only from collected funds linked to the same matter.
• Confirm any change in instructions through a second channel.
• Require dual authorization for large disbursements.
• Document every verification step.
• Pause when pressure rises.

Closing Guidance

Lawyer-based money laundering scams succeed when pressure outruns process. A steady policy, a short playbook, and a culture that values verification over speed protect client funds and professional standing. The recent near-miss described above shows what disciplined skepticism and bank partnership can achieve. By teaching staff to look for common signals, by separating unverified deposits from trust funds, and by refusing to disburse before final collection, a firm or business can keep criminals from turning good systems against the people who rely on them.

Glossary

• ACH return — This term refers to the reversal of an electronic transfer through the Automated Clearing House network. A bank may initiate a return when a debit or credit is unauthorized or in error. Timely requests increase the chance of stopping funds before they settle.
• Altered check — An altered check shows changes to the payee, amount, date, or routing details after issuance. Banks review microprint, fonts, and ink patterns to detect tampering. Any doubt about authenticity warrants a hold and a call to the issuing bank.
• Available funds — Available funds are amounts a bank shows as usable before final collection. This balance can change if a deposited item later fails. Firms protect client money by disbursing only from funds confirmed as collected.
• Bank fraud department — A bank’s fraud unit handles alerts, holds, and recalls tied to suspicious payments. Prompt contact with this team documents concerns and may stop losses. Recording names, times, and case numbers supports later claims.
• Bank wire recall — A wire recall is a bank request to pull back a sent transfer. Success depends on speed, cutoff times, and the receiving bank’s cooperation. Immediate calls with transaction details give the recall the best chance.
• Beneficiary change request — This is a message that asks to redirect payment to a new account. Criminals often send it by email after a counterfeit deposit. Verification through a known phone number prevents misdirection of funds.
• Business email compromise — Business email compromise is a crime that uses look-alike domains or hacked inboxes to send payment instructions that appear genuine. Attackers time messages to match ongoing matters. Staff training and two-channel verification reduce risk.
• Collected funds — Collected funds are deposits that have cleared the banking system, not just been posted as available. Banks can confirm this status on request. Disbursing only from collected funds prevents refunds against counterfeit checks.
• Counterfeit check — A counterfeit check is a full reproduction of a real bank’s format that was never drawn on a legitimate account. It may pass an initial deposit screen and then fail days later. Extended holds and issuing bank calls expose the fraud.
• Courier label mismatch — A mismatch appears when a courier label’s sender, phone number, or address does not match the claimed company. This gap signals an elevated risk of a staged payment. Photographing labels and saving tracking supports reports.
• Disbursement freeze — A temporary hold on outgoing payments pauses movement while verification occurs. A freeze protects trust balances when a deposit looks suspect. Documenting the reason and timeline keeps stakeholders informed.
• Dual authorization — Dual authorization requires two approved people to release a payment over a set threshold. This step adds minutes but stops solo errors under pressure. Many firms apply it to trust-account disbursements and large refunds.
• Engagement letter — An engagement letter defines parties, scope, fees, and payment rules. Clear terms let a firm refuse unusual instruments or changes that arrive by email alone. Referencing the letter during verification keeps conversations calm.
• Extended hold — An extended hold gives the bank time to verify unfamiliar or high-risk deposits. The hold reduces exposure to counterfeit or altered checks. Clients can be informed in advance that holds protect both sides.
• File-opening fee — A file-opening fee is money sent at the start of a matter to begin work. Checks from unknown sources pose a higher risk at this stage. Verification of the client and the instrument should occur before any deposit.
• Final collection confirmation — This is a bank statement that a specific deposit has fully cleared. The confirmation differs from an online balance that only shows availability. Recording the confirmation before disbursement prevents shortfalls.
• General operating account — A general operating account holds firm revenue and expenses. Suspect checks belong in this account with an extended hold, never in a trust account. Separation limits exposure if a check later fails.
• Independent verification call — An independent call uses a phone number obtained from a published directory or signed document, not from an email. Speaking with a known-party contact validates payment instructions. This step prevents redirection by impostors.
• Issuing bank verification — Issuing bank verification is a call to the bank named on a check to confirm the format and account status. Banks do not guarantee payment, but they can flag obvious inconsistencies. The call strengthens the decision to hold or reject.
• Look-alike domain — A look-alike domain changes a letter, adds a hyphen, or shifts a top-level domain to imitate a real company. Attackers use it to send believable instructions. Visual checks and reply-to inspections help catch the trick.
• Maker–checker control — Maker & check control separates the person who sets up a payment from the person who approves it. The split reduces insider error and external manipulation. Audit logs should show both names for every release.
• Matter vetting — Matter vetting confirms client identity, business status, and the legitimacy of the dispute before funds arrive. This review includes public registries, phone validation, and reference checks. Thorough vetting lowers exposure to staged engagements.
• Mediation fee check — A mediation fee check pays the neutral’s time or the firm’s scheduling block. In scams, a second, unexpected check may follow to bait a refund. Treat any extra check as high risk until verified.
• Overpayment scheme — An overpayment scheme sends more money than requested, then asks for a refund of the difference. When the original instrument fails, the refund becomes a loss. Refusing overpayments blocks this tactic.
• Payment instruction change — This term covers any request to alter account numbers, payees, or routing during a matter. Criminals send changes after counterfeit deposits to trigger real refunds. Two-channel verification stops the handoff.
• Playbook, verification — A verification playbook is a short, written sequence that staff follow during high-risk moments. It lists who to call, what to record, and when to pause. A ready playbook turns caution into consistent action.
• Published phone number — A published phone number appears on a company website, regulator listing, or engagement document, not in an email signature alone. Calling this number confirms identity and instructions. This habit prevents approval of impostor messages.
• Refund request pressure — Refund pressure is a demand to return funds immediately after a deposit, often with a polite tone and urgent reasons. The pressure aims to beat bank detection. A standard pause and verification defeats the rush.
• Routing number mismatch — A mismatch occurs when a check’s routing number does not match the printed bank name or geographic area. This inconsistency signals counterfeit or alteration. Banks can confirm proper routing formats.
• Settlement disbursement — A settlement disbursement moves money between parties after a resolution. Criminals try to insert counterfeit funds to trigger a genuine payout. Disbursing only from collected, matter-linked deposits prevents loss.
• Suspicious instrument — A suspicious instrument is any check or draft with irregular paper, fonts, microprint, or magnetic ink issues. Photographs, bank calls, and holds support a careful decision. Returning the item unprocessed remains an option.
• Third-party funds — Third-party funds are payments sent by someone not named in the engagement or invoice. These funds carry a higher risk of counterfeit or laundering. Clear policy may decline them or require extended verification.
• Trust account segregation — Trust account segregation keeps client funds separate and tied to a single matter. Disbursements occur only from cleared deposits for that matter. This practice protects innocent clients if a staged deposit fails.
• Unsolicited engagement — An unsolicited engagement arrives without referral or prior relationship and often proposes easy terms. Such outreach requires deeper validation before any payment handling. A polite pause and verification protects the firm.
• Verification through a second channel — This is a confirmation step using a communication path other than the one that delivered the instruction. Phone-back to a published number is common. The second channel defeats email-based manipulation.