Several identity theft scams have recently been reported by Nova Scotia lawyers.
The basics of the scam are these. A member of the public (the “target”) is contacted by telephone/robocall, email, or sometimes paper mail by a person who appears to be a lawyer looking to complete a transaction or payment of an inheritance. This “lawyer” is actually a fraudster and will provide seemingly legitimate contact information and a link to their website which may include the contact information for the actual lawyer with the name they are using. What makes this fraud difficult for the target to detect is that the emails and paper letters often feature logos or other legitimate information of the firm of the actual lawyer the name belongs to so it appears authentic.
After proving their legitimacy to the target, the fraudster will send the target an electronic but fraudulent link to a trust cheque, certified cheque, bank draft, administration fee, or other transaction that appears to debit the lawyer’s trust account or some other link for the target to download. Either way, once the target clicks the link, a virus is downloaded to their computer.
To carry out this fraud, the fraudster often creates a duplicate but bogus copy of the legitimate lawyer’s website. Very often, these replicated sites feature actual lawyers’ names and photos. But on a deeper dive, usually after the fact, it becomes clear that the email addresses and/or telephone numbers featured on the mirrored website are phony and connect with the scammers – not with the legitimate lawyer(s). For example, if the actual lawyer’s email address is [email protected], the bogus email address might be [email protected] or [email protected].
We’ve reported on these types of scams before, the most recent/relevant being:
- FRAUD ALERT: NS Lawyers’ Website, Contact Information “Spoofed” (Sep 27th, 2021)
- FRAUD ALERT: Fake Law Firm “Lawman & Associates” (October 2020);
- FRAUD ALERT: Fake Law Firm Websites Targeting Lawyers (July 2020); and
- FRAUD ALERT: Inheritance Scam Attempt “John Westwood” (April 2016)
If you discover that your website or identity has been co-opted, your first step is to report the duplicate site to the web host as a fraudulent representation of your identity. To find out who hosts the duplicate website, go to who.is and enter the URL and, as the hosting company is listed under the registrar information, search the company name to find contact details.
Next, filing a complaint with Competition Bureau Canada for deceptive marketing is also an option.
Halifax Regional Police have issued numerous similar warnings of identity misrepresentation involving robocalls purporting to be from the police, border services, etc. (including June 17, 2020; and November 23, 2021). They note that “if your identity has been compromised as a result of a fraud’ to call them at 902-490-5016. They may be able to provide further guidance in this matter.
The RCMP also recommends contacting the Canadian Anti-Fraud Centre (CAFC) in cases of identity fraud. The CAFC website notes “If you have been a victim of a scam, fraud or cybercrime, please contact your local police as soon as possible. It is also recommended that you report the instance of a scam, fraud or cybercrime, whether you are a victim or not, to the CAFC.”
You may also want to update the contact information for your firm with Google, as that information is more reliably verified, while a spoofed website/phony contact information can be posted through any platform. You can begin that process here: Google: Update your Business Information. Essentially, if anyone else has received a similar email or letter, it would be easier for them to cross-reference the phony information from the letter with your verified Google business listing, and therefore prevent them from falling for the scam.
As always, sensitive personal data and/or banking information should never be shared based on an unsolicited communication. It is best to contact the company, firm or person directly (if by email, without responding to that email), in order to independently verify the sender. Use the NSBS Lawyer Directory (or other relevant law society directory) to verify a lawyer’s identity and obtain their contact information to ensure that you are not speaking with an identity thief or scammer.
Overall, where possible in transactions, use the Bank of Canada’s Lynx system (formerly the Large Value Transfer System (LVTS)), an electronic funds transfer system that allows large payments to be exchanged securely and immediately.
Finally, always remember that links and attachments in unsolicited or unanticipated emails should not be accessed unless the sender can be positively verified as they may contain viruses. If a bogus attachment is opened and the user does not have anti-virus software or firewall programs on their computer, their system could become infected.
For tips to avoid being victimized, and to report or seek advice on dealing with fraud and scam attempts, contact Cynthia Nield at [email protected] or 902 423 1300, x346.