The Wire Instruction

Careful people, real instructions

A wire fraud at a closing is built to work on careful people. It arrives inside a routine they already trust: an email thread they have used for weeks, a payment they expected to send, a deadline they were already watching. The only unusual thing it asks is that the money go somewhere new. So the useful question is why careful people send it there, and what would have stopped them.

This reading takes the three usual answers in turn. The email must have looked wrong. The bank should have caught the mismatch. Better passwords would have kept the thieves out. Each holds a piece of the truth, and none of them explains the loss. The last section turns to what a firm owes once an attack has happened, which is where your afternoon at Temko Eden ends in the activity.

“The email must have looked wrong”

Sometimes it does. A thief who only imitates an account sends from an address a letter or two off the real one, and a reader who checks the address can catch it. But the FBI’s description of business email compromise starts with a different move: compromising the legitimate account itself. Once a thief has someone’s password, the message comes from the real address, in the real thread. It looks like every true instruction, because whoever sent it could read the true ones first.

Trust also travels. In 2017 a Florida lawyer, Peter Shapiro, was representing his father and brother in the sale of their car dealership in upstate New York, and part of the closing was paying off a loan. On November 16, his brother forwarded him an email from the lender’s lawyer with wire instructions for the payoff. The next day his brother forwarded a second email, also appearing to come from that lawyer. It said the first bank was being audited and could not take the money, so the payoff should go to a Wells Fargo account in Texas instead.

The warning signs are easy to see afterward. The grammar was rough, and the bank changed a day after the first instructions. But the message reached Shapiro from his own brother, from inside the circle he trusted, and on November 21 he had his bank wire $504,611.13 on it. He did not call the lender’s lawyer or email him to confirm. The court that later heard his case observed in a footnote that a quick call “probably would have revealed the fraud.”

That call is callback verification, and the number it uses matters as much as the call. A number printed in the email belongs to whoever wrote the email. An incoming call that shows the right number proves nothing either, because caller ID can be faked on purpose (opens in a new tab). The number has to come from somewhere the thief never touched: the file, the contract, or a directory. The protection is a line the thief does not control.

“The bank should have caught it”

Shapiro’s wire named the lender’s lawyer as the beneficiary but carried the number of an account that belonged to someone else. Wells Fargo’s automated system noticed. Its audit trail flagged a possible mismatch in the names, but no person at the bank saw that flag before the money was credited. The account holder moved the money out promptly. Shapiro’s own bank asked for it back almost a month later, and Wells Fargo declined, because the money was gone.

Shapiro’s firm sued Wells Fargo and lost. Section 670.207(2)(a) (opens in a new tab) lets the bank that receives a wire rely on the account number when the name and number point to different people, unless the bank knows they differ. The bank need not check. In Peter E. Shapiro, P.A. v. Wells Fargo Bank, N.A. (opens in a new tab), the Eleventh Circuit held that a system built to ignore name mismatches was a reasonable routine. So the bank was not treated as knowing what its own audit trail said.

The reason is speed. Banks process wires by machine, by the number, and the statute’s official comment explains that a duty to compare names would cost them the benefit of automation. The court allowed that the rule’s wisdom is open to question. It left that question to the Florida Legislature and applied the rule as written.

Two more points in the opinion matter to a firm. The court read Article 4A, the part of the Uniform Commercial Code that governs wires, to make it irrelevant whether the sender was careless. And a separate negligence claim against the bank failed, because Article 4A itself sets the duties of the parties in a case like this one. So the loss from a misdirected wire stayed with the sender, at least as against the bank at the other end.

When the sender is a law firm and the wire left its trust account, the account is now short, and the clients’ money is not there. Rule 5-1.1(a)(1)(B) lets the lawyer deposit the lawyer’s own money to cover a shortage. It also requires the lawyer to tell the Bar’s lawyer regulation department immediately about the shortage, its cause, and the amount put back.

“Better passwords would have kept them out”

Passwords help, and a second factor helps more. Multifactor authentication asks for something beyond the password, such as a code texted to a phone, so a stolen password alone no longer opens the account. That is exactly why the next attack aims at the person holding the phone. A caller who says he is from IT, and who asks you to read back the code he just sent, has turned the second factor into a second password, spoken aloud.

The FBI has described one group’s version of this in an alert to law firms (opens in a new tab). Its members call employees while posing as the firm’s own IT staff and talk them into opening a remote-desktop session. When that fails, the group has sent someone to the office in person, claiming the computer needs a backup, to plug in a storage device and copy the files. The tools are the same remote-support programs a real IT department uses, so antivirus software is unlikely to flag them. Among the FBI’s recommendations is a set policy for how the firm’s real IT staff will contact employees and prove who they are.

This is the ground the ethics rules cover. Rule 4-1.6(e) requires a lawyer to make reasonable efforts to prevent unauthorized access to client information, and its comment extends that duty to disclosure by the people the lawyer supervises. The comment weighs the sensitivity of the information against the cost and difficulty of more safeguards. It also forgives access that happens despite reasonable efforts, which makes the question what the firm did beforehand.

ABA Formal Opinion 477R (opens in a new tab) lists seven things reasonable efforts involve, and one is training lawyers and nonlawyer staff in information security. The ABA’s opinions guide Florida lawyers without binding them, but the rule the opinion reads matches Florida’s in substance. A firm that has never told its staff how IT will identify itself, or that wire instructions get checked by a call, has left both decisions to whoever answers the phone.

After an attack

Suppose the wire went out, or the code was read aloud. What the firm owes next depends on what was reached, and two sets of rules answer that question in different words.

The ethics answer is ABA Formal Opinion 483 (opens in a new tab). Not every attack is a breach. The opinion saves the word for an event that compromises material client information or significantly impairs the lawyer’s ability to do the work. Many cyber events in a law office, it says, never rise to that. A phishing email that no one answered is one of those. A mailbox someone opened with a stolen code may not be.

After a breach, the opinion expects the lawyer to act promptly to stop it and to make reasonable efforts to learn what was accessed. Then the lawyer tells current clients, at a minimum, that their information was or may have been reached, and how far. The opinion draws that duty from the Model Rules’ duty to keep clients informed, which in Florida is Rule 4-1.4.

The statutory answer is Florida’s section 501.171 (opens in a new tab). Its personal information includes a name joined to a Social Security or driver license number, and it also includes an email address joined to the password that opens the account. So the question after a mailbox is opened is what the mailbox held, and whose. Once the firm determines, or has reason to believe, that personal information was accessed, it has 30 days to notify each person in Florida whose information was or may have been reached.

Law enforcement can ask for a delay. The firm can skip notice only if, after investigating and consulting law enforcement, it decides in writing that no identity theft or financial harm is likely. It must keep that decision for five years and send it to the Department of Legal Affairs within 30 days. The Department enforces the statute, with penalties that can reach $500,000, and the statute gives no one else a right to sue under it.

The two sets of rules do not stand in for each other. Opinion 483 says so directly: complying with a state notice law does not necessarily satisfy the ethics rules, and complying with the ethics rules does not by itself satisfy the notice law.

Both depend on facts someone wrote down at the time. Incident response starts with the calls that cannot wait. For a wire, the FBI tells the victim to ask its own bank for a recall at once and to file a complaint at ic3.gov. In Shapiro’s case the recall came almost a month late. For a login, the password changes and IT looks at what was reached. Then an incident report records each contact in order, with its time, its address or number, what it asked for, and what was given. The decisions about whom to tell belong to the lawyer, and the facts they rest on usually belong to whoever was at the desk.

Back to the closing desk

In the activity, you spend the afternoon of October 30 at Temko Eden’s closing desk. You have $148,612.40 of the Vellacotts’ money to send and a file that already holds a verified set of instructions. Each answer this reading tested will come to you as a message or a call, usually with someone waiting. Read the file first, including the number Marcy used on October 20, then paste the Simulator into a fresh chat. Keep track of the number every call came from and every number you dialed, because your incident report will need both.