Property transactions move large sums of money between multiple parties under time pressure, with most communication happening by email. Solicitors, clients, lenders, and estate agents each work from their own systems and apply their own security standards. That combination has made conveyancing one of the most targeted areas of work in the legal profession.
The firms that have suffered the most serious incidents in recent years were not necessarily careless. Many had reasonable controls in place. What caught them out was the specific way that conveyancing creates opportunities for attackers, and an incomplete picture of where those opportunities actually sit.
This article Cyber Security for Conveyancing Solicitors sets out the main threats, how each one works in practice, and where firms should focus their attention.
What Is Friday Fraud and Why Are Conveyancing Firms the Primary Target?
Friday Fraud, also known as payment diversion fraud or conveyancing fraud, is the most financially damaging cyber threat in this sector. Completion typically falls on a Friday, when the largest sums are moving and pressure to act without delay is at its highest — and attackers build their approach around that timing.
An attacker gains access to an email account somewhere in the transaction chain. It might be the client’s personal email, the estate agent’s, or an account at the firm on the other side. Once in, the attacker reads correspondence over days or weeks, building a picture of the transaction: the parties involved, the stage it has reached, and when funds are expected to move.
When the timing is right, a message is sent that appears to come from a party the recipient trusts, asking for funds to be directed to new bank details. It arrives at the expected point in the transaction, references the right details, and gives no obvious reason for suspicion. By the time the legitimate recipient queries the missing payment, the funds are already gone.
Action Fraud recorded 143 cases of conveyancing fraud between April 2024 and March 2025, with total losses of £11.7 million. The average loss per residential case was £78,393. (City of London Police, October 2025)
The access method is known as Business Email Compromise. An email account has been taken over and is being used by an attacker without the account holder knowing. Unlike a phishing email that arrives as something suspicious, this involves the attacker operating from within a legitimate account — reading genuine correspondence and sending messages that pass as coming from the real account holder.
What makes this hard to guard against is that the compromised account often belongs to someone outside the practice. A client whose personal email has been accessed, or an estate agent with weaker security, gives an attacker enough visibility to run the fraud. The conveyancing firm may have done everything right on its own systems and still been exposed.
Before any funds are transferred, bank details should be verified by telephone using a number the firm already holds on file, obtained independently of the current transaction correspondence. No instruction to change payment details should be acted on without that call, regardless of how convincing the request appears or how close to completion the parties are.
How Are Deepfakes Being Used to Commit Fraud in Property Transactions?
A related but distinct threat has grown significantly since 2022, targeting identity verification rather than payment instructions. Vendor fraud involves an attacker impersonating the seller of a property, with the aim of diverting the sale proceeds or using the transaction to move stolen money through client accounts.
Conveyancing has always required firms to verify the identity of the people they are acting for. Face-to-face meetings made this straightforward. As remote working became standard practice, video calls became a widely accepted alternative. The difficulty is that artificial intelligence tools can now generate convincing real-time video of a person who does not exist, or replicate the appearance and voice of a real individual during a call — meaning a video identity check no longer provides the assurance it once did.
In March 2024, the SRA updated its anti-money laundering risk assessment to flag the rising incidence of vendor fraud and specifically warned firms about the risks of relying on video calls for client identification. The SRA noted that the conveyancing process provides both the method of committing the fraud and the means of laundering the proceeds.
The SRA’s warning was not precautionary. It followed documented cases of firms being used, without their knowledge, to process fraudulent transactions. A 2025 survey found that 24% of legal professionals ranked AI-generated threats including deepfakes as their second biggest concern after phishing. Deepfake fraud attempts in the financial and legal sectors increased by over 2,000% between 2021 and 2024.
Firms handling high-value transactions, or acting for sellers they have not met in person, should consider whether video verification alone is sufficient. Certified digital identity verification services, cross-referencing of documents, and particular caution when a client is applying urgency without being present in person all make it harder for a fraudulent identity to go undetected.
What Happens to a Conveyancing Firm When Ransomware Hits?
Ransomware encrypts a firm’s files and systems, making them inaccessible until either a ransom is paid or systems are rebuilt from backup. Conveyancing firms face consequences that go beyond those most businesses would experience, because so much of the work depends on being able to access case files and exchange correspondence at specific points in a transaction.
- Active transactions cannot progress without access to case files, correspondence, and case management systems. Exchange and completion stall.
- A property chain does not pause when one firm goes offline. Other parties face their own deadlines, and if those are missed the chain can collapse.
- Mortgage offers carry expiry dates. A delay that runs long enough may invalidate a buyer’s offer, requiring a fresh application and leaving the purchase in doubt.
- Lenders operate approved panel schemes. A firm that suffers a significant cyber incident may find itself suspended from one or more lender panels while the lender reviews the situation, preventing the firm from acting on any transaction involving that lender’s mortgages.
In November 2021, Simplify Group, at the time the UK’s largest conveyancing business handling around 250,000 instructions a year, was hit by a ransomware attack. New instructions were suspended for over ten weeks, hundreds of live transactions stalled, and a class action was launched by affected clients. The financial cost reached £7.3 million, most of which was eventually recovered through insurance, though the operational disruption and loss of business during the period of reduced capacity were substantial.
In November 2023, a cyber attack on CTS, an IT provider serving a large number of law firms, brought approximately 80 conveyancing firms to a standstill simultaneously. Firms lost access to email, phones, and their case management systems. Clients with moving vans booked and mortgage offers expiring took to social media as the days passed without resolution. No individual firm had been attacked directly; all were affected because their shared IT provider had been compromised.
The CTS incident is a clear illustration of supply chain risk in practice. The 80 affected firms had done nothing wrong. Their exposure came entirely from a third party they depended on, over whose security they had no direct control.
Having current, tested backups stored in a way that a ransomware attack on the main systems cannot reach is what separates a manageable disruption from one that threatens the practice. A backup that has never been tested is not a reliable one.
What Other Cyber Threats Do Conveyancing Solicitors Face?
Payment fraud, vendor fraud, and ransomware carry the highest financial risk in this sector. Two further threats are worth understanding alongside them.
Phishing and Social Engineering
Conveyancing firms receive phishing messages that bear little resemblance to the obvious scam emails most people have learned to recognise. Attackers research their targets before making contact, learning enough about staff, clients, and regular counterparties to write messages that fit naturally into a firm’s normal correspondence. A message might reference a live transaction, appear to come from a lender the firm works with regularly, or arrive at exactly the point in a matter when its content would be expected.
The goal is usually to obtain login credentials, giving the attacker access to email accounts or case management systems. The SRA has warned specifically that criminals are also using voice-modification software to impersonate solicitors in telephone calls, which means the same scepticism that applies to unexpected emails needs to extend to unexpected phone-based requests as well.
Data Breaches and Property Title Fraud
Conveyancing files hold passport copies, bank statements, mortgage documents, proof of address, and property records. A breach involving this material creates reporting obligations under UK GDPR: qualifying breaches must be reported to the ICO within 72 hours, including at weekends. Where the breach also raises conduct concerns, the SRA must be notified under Rule 3.9 of the Code of Conduct.
The ICO has fined firms where inadequate controls contributed to a breach. DPP Law Ltd was fined £60,000 in 2025 after 32 gigabytes of legal files were accessed and published online; Levales LLP was fined in 2024 following a breach affecting over 8,000 individuals, with the ICO finding that multi-factor authentication had not been enabled on the firm’s systems.
Property title fraud operates differently but sits in the same risk landscape. A fraudster manipulates Land Registry records to impersonate a property owner, then attempts to sell the property or borrow against it without the owner’s knowledge. Client due diligence — particularly for high-value properties or transactions where the registered owner is not present — is where this gets caught, and the Land Registry publishes guidance specifically for solicitors on the verification steps involved.
Why Is the Wider Transaction Chain a Cyber Security Risk for Conveyancing Firms?
A firm’s own security measures cover only the firm’s own systems. Every conveyancing transaction involves other parties whose security standards may be quite different, and a compromise at any point in the chain can be enough to enable a fraud.
The chain includes the client, who may be using a personal email account with a reused password and no additional verification; the estate agent, often a small business with limited IT resource; the mortgage broker, whose work involves handling sensitive financial data over email; the lender and any search providers; and the firm’s IT provider, which may be serving dozens of other firms at the same time. Each represents a potential entry point.
The CTS attack in 2023 illustrated what this means at the infrastructure level: one provider being compromised shut down 80 law firms at once. At transaction level the same principle operates continuously, the client whose email has been accessed, the estate agent whose account is being used to send instructions, the counterparty with a vulnerability that has not been addressed. Any one of these creates an opening a firm’s own security cannot close.
Since firms cannot audit the security practices of every client and counterparty they work with, the practical response is to build processes that do not depend on email alone for critical decisions. Telephone verification using numbers already held, before acting on any instruction involving money moving, addresses this gap regardless of where in the chain an attacker has gained access.
How Can a Conveyancing Firm Reduce Its Cyber Security Risk?
The attacks described in this article largely succeeded because of how conveyancing firms operate: instructions passed over email, time pressure around key dates, and parties in the chain with varying levels of security awareness. Addressing those factors matters more than any individual piece of technology.
On the process side, a firm should be able to answer the following questions. Uncertainty about any of them points to something worth addressing.
- How are bank details issued to clients, and is there an independent check that the correct details were received?
- What happens when a request to change payment details arrives close to completion? Is there a defined procedure requiring telephone verification using a number already on file, applied consistently regardless of time pressure?
- How are identity documents and sensitive client files shared during a transaction, and what happens to them once the matter closes?
- If one of the firm’s email accounts had been accessed by an unauthorised person, how long would it take to find out?
- If systems went offline today, could the firm identify which transactions are active and what stage each one is at, and are there tested backups that would allow work to continue?
- What is known about the security arrangements of the firm’s IT provider, and when was this last reviewed?
For firms that want a structured baseline, the National Cyber Security Centre (NCSC) runs the Cyber Essentials scheme, which covers five foundational controls: firewalls, secure configuration, user access controls, malware protection, and software patching. Achieving certification does not prevent every attack, but it closes the most commonly exploited gaps and is recognised by insurers, lenders, and regulators as evidence of a minimum standard of practice. The Conveyancing Association’s Cyberfraud and Fraud Protocol, now in its sixth edition and developed in collaboration with the NCSC, goes further into the specific fraud methods used in property transactions and the controls that reduce the risk at each stage. It is publicly available and worth reading by any conveyancing firm.
On the technology side, every account used to access email or case management systems should have a strong, unique password and multi-factor authentication enabled. Multi-factor authentication requires a second verification step, usually a code sent to a separate device — before a login succeeds, making a stolen password insufficient on its own. The ICO’s findings against Levales LLP are a reminder of how basic this expectation has become.
Multi-factor authentication covers the login process, not the session that follows it. Once someone has signed in, their device holds a record confirming they have authenticated. Malicious software running on that device could use that record to access the account without going through the login again. Security software on every device staff use to access firm systems addresses this, it is a different layer of protection to login controls, and works alongside them rather than doing the same job.
Backup systems that are current, tested, and stored separately from the main environment determine how quickly a firm can recover if access to systems is lost.
Want to Talk Through Your Firm’s Exposure?
We work with businesses on the security risks that are most relevant to how they operate. Conveyancing creates a specific set of conditions: high-value transactions, time pressure, and a chain of parties communicating over email. We understand how that translates into practical risk, and we have been speaking to conveyancing firms to understand where the real pressure points are.
We are not approaching this with a packaged solution already built. We want to understand what firms in this sector actually need before drawing any conclusions about how we can help. If a conversation about the risks in your firm and your transactions would be useful, we are happy to have one.
FAQs
Is conveyancing fraud the same as Friday Fraud?
Friday Fraud is one specific type within the broader category. Conveyancing fraud covers any fraudulent activity connected to a property transaction, including vendor fraud, where an attacker impersonates the seller rather than intercepting a payment, and mortgage fraud, where false information is used to obtain lending. Friday Fraud refers specifically to payment redirection timed around completion, exploiting the combination of large fund movements and time pressure. It accounts for the majority of financial losses in the sector and is the variant firms encounter most often.
How do attackers get access to email accounts in the first place?
The two most common methods are phishing, where a convincing message leads the account holder to enter their login details on a fake page, and credential stuffing, where login details leaked in a previous data breach are tested against other accounts. Password reuse is what makes the second method effective: a breach at an entirely unrelated company can yield working credentials for a professional email account if the same password was used for both.
Multi-factor authentication addresses this by requiring a second verification step, making a stolen password insufficient on its own. What it does not cover is the session after login. Once someone has signed in, their device holds a record of that authenticated session, and malicious software running on the device could use that record to access the account without the login being repeated. Security software on staff devices and strong authentication controls work together; relying on either one without the other leaves a gap.
What is the SRA’s position on cyber security for conveyancing firms?
The SRA requires solicitors to take reasonable steps to protect client data and client money. Where a cyber security failure leads to client loss or data exposure, this can amount to a breach of the Code of Conduct. Under Rule 3.9, a firm that suffers a significant incident involving client funds or data must consider whether it has a reporting obligation to the SRA.
The SRA has published specific guidance on cyber threats facing the legal sector, including vendor fraud and the risks associated with deepfake technology, and updates this guidance as the threat landscape changes. The SRA website at sra.org.uk is the most reliable source for current requirements.
Does cyber insurance cover conveyancing fraud losses?
Coverage depends on the specific policy. Cyber insurance is generally designed to cover the costs of responding to an incident: forensic investigation, system restoration, business interruption, and regulatory defence. Some policies extend to financial losses from payment diversion fraud, but the terms vary considerably between insurers and products, and this coverage is not automatic.
Professional indemnity insurance provides a degree of protection for client money losses but is not structured to deliver the immediate specialist response a cyber incident typically demands. Simplify Group recovered the majority of its £7.3 million loss through insurance following its 2021 attack, which illustrates both the scale of potential loss and the value of having appropriate cover in place. Firms should review their policies with their broker and ask specifically about coverage for payment diversion and data breach scenarios.
How quickly could a conveyancing firm realistically recover from a ransomware attack?
Recovery time is determined almost entirely by the quality of the firm’s backup arrangements. A firm with recent, tested backups stored separately from its main systems can potentially restore within days. One without adequate backups may face weeks of rebuilding, during which no transactions can progress and clients are left waiting.
Simplify Group took over ten weeks to restore full operations following its 2021 attack. The CTS incident in 2023 disrupted affected firms for between several days and several weeks, depending on how heavily each relied on CTS systems. Firms with a documented recovery plan and tested backups are in a materially better position than those working through the problem for the first time while completions are pending.
Are there specific steps clients can take to protect themselves during a conveyancing transaction?
Firms can reduce their own exposure by briefing clients at the outset on what to expect. Clients who understand that bank details will be confirmed early and are unlikely to change, and who know to call the firm directly using a number from its official website rather than one received by message, are harder to deceive through a payment redirection attempt. A client who transfers funds in response to a fraudulent instruction may have grounds for a claim against the firm, so reducing that risk benefits both parties.
Clients who use strong, unique passwords and multi-factor authentication on their personal email accounts are also more difficult to compromise, which matters because client email accounts are among the most common entry points for Friday Fraud.
Run a conveyancing practice? See how we help UK conveyancing firms protect completion money and evidence it to lenders and insurers on our cyber security for conveyancing firms page.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
