Background
It started the way most of these stories do: an ordinary residential property purchase, well underway, moving through its final stages. A couple were partway through buying their home, working with a conveyancing solicitor to complete the transaction — the same routine process thousands of home buyers go through every week.
Then, on a Friday afternoon, everything changed.
The Risk
Friday afternoon fraud — also known as payment diversion fraud — cost UK home buyers over £11.7 million last year, according to industry reporting. It’s one of the most consistently flagged risks for the conveyancing sector, and regulators including the SRA and CLC have repeatedly warned practices about it.
In this case, criminals had compromised an email account somewhere within the transaction chain. They watched silently, waiting for the right moment, then sent a fake email with “updated” bank details, impersonating the couple’s conveyancing solicitor. The buyer transferred £43,000 to the fraudulent account. The fraud wasn’t discovered until the following Monday — by which point the funds were already gone.
Here’s the part that matters most for conveyancing firms: when the compromised email traffic was investigated, the original point of entry traced back not to the conveyancing firm, but to the estate agency involved in the transaction.
That’s the lesson at the heart of this case. Fraud that appears to target a conveyancer can originate anywhere in the supply chain — estate agent, buyer, seller, solicitor, accountant, bank, IFA, or mortgage broker. A firm’s own security is only as strong as the weakest connected party in that chain. You can do everything right internally and still be exposed by a partner three steps removed from your own systems.
For a firm handling client money and sensitive transaction data, that’s not just an IT problem — it’s a professional risk, a reputational risk, and increasingly a regulatory one.
What We Did
Both the estate agency and its conveyancing law firm partner engaged Security Everywhere to close the gaps that had made the attack possible and to prevent it happening again. The same Enterprise protection stack was implemented across both organisations:
- Immediate Lockdown — MFA enforced, malicious inbox rules removed, passwords reset
- Email Security + DMARC — Avanan filtering inbound email, Sendmarc enforcing DMARC to stop domain spoofing
- Mobile Security — Lookout defending every mobile device
- Endpoint + SOC — SentinelOne monitoring every endpoint, 24/7
- Backup and Recovery — Cove backing up and recovering both firms’ data
- Password Manager — Keeper managing unique, 20-character passwords across both organisations
Rather than patching the single vulnerability that had been exploited, the approach covered the full attack surface — email, endpoint, mobile, backup, and credentials — for both businesses on either side of the transaction chain.
The Result
Both the estate agency and the conveyancing firm are now long-term Security Everywhere clients, with layered protection in place rather than a single point solution. What began as a response to one fraud incident became a full security partnership across two firms who depend on each other’s security to protect their shared clients.
Why This Matters for Conveyancing
A conveyancing firm’s exposure isn’t limited to its own systems. It includes every party in the supply chain — estate agents, buyers, sellers, accountants, banks, IFAs, and mortgage brokers. A single successful attack anywhere in that chain can mean significant financial loss for clients, reputational damage for the firm, and regulatory scrutiny.
If your firm is relying on strong internal security alone, this case is worth sitting with. The breach that cost this couple £43,000 didn’t start inside the conveyancing firm at all.
If you hold Lexcel or CQS accreditation, payment diversion controls are part of what your assessor expects to see. Our guide sets out what Lexcel, CQS and the SRA actually require, with every source linked.
Worried This Could Happen to Your Firm or Your Clients?
We offer conveyancing and property law firms a free, no-obligation cyber exposure check — covering email security (DMARC), exposed subdomains, and dark web credential exposure. If this sounds familiar, book your free Security Check and let’s find out where your firm’s real exposure lies before someone else does.
Note: details in this case study have been anonymised to protect client confidentiality. Loss and industry fraud figures are drawn from public reporting, referenced in our companion training video, “Friday Afternoon Fraud: How Home Buyers Lost £43,000 to a Cyber Scam.”
Worried this could be your firm? Our cyber security for conveyancing firms page sets out where conveyancers actually get hit, and what to put in place first.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
