Cyber Security for Conveyancing Firms
Protect completion money, client data and your firm’s standing.
On completion day you move six figure sums, to a deadline, over email. Criminals know all three. We help UK conveyancing firms close the gaps that let client money out, and evidence it to the lenders, insurers and clients who ask.
Half the Attacks on Law Firms Start in the Inbox
The SRA reviewed 40 law firms that had suffered a cyber attack over a three year period. More than 4 million pounds of client money was stolen from 23 of them, and 18 firms had to put in 400,000 pounds of their own money to cover what insurance did not. Only 5 of the 40 held Cyber Essentials Plus. That review was published in 2020.
In its 2021 Risk Outlook the SRA reported that over 80 per cent of the cybercrime reports it received that year involved email, and that conveyancing continues to be targeted because of the size of the sums being moved. Nothing since has made completion day less attractive to a criminal.
Where Conveyancing Firms Actually Get Hit
It is rarely sophisticated. It is usually a real email thread, a real matter, and a change of bank details at exactly the right moment.
What costs you client money
- Email modification fraud, where a criminal watches a live matter and sends the buyer new account details days before completion
- A mailbox quietly compromised weeks earlier, reading everything, while nobody notices
- Redirected completion funds, which are normally gone within hours of leaving the client account
- Ransomware timed for a Friday, when the firm is busiest and least able to stop and think
- Cloned firm and fake website scams that borrow your name to intercept somebody else’s money
What costs you standing
- A report to the SRA, and a conversation about whether client money was properly protected
- A breach you must report to the ICO within 72 hours of becoming aware of it
- A lender or panel asking a question you cannot answer with evidence
- An insurer treating your renewal differently after a claim
- A client who lost their deposit telling everyone who will listen
These are the same failure seen from two directions. The controls that stop the money leaving are the ones that answer the questions afterwards.
Who This Is For
UK conveyancing firms and residential property teams that move client money to a deadline, hold sensitive personal data, and answer to the SRA, their lender panels and their insurers. Typically 20 or more staff, and often between 50 and 250 users.
CQS Accredited Firms
You hold the Law Society’s Conveyancing Quality Scheme accreditation and you would like your security to stand up to the same scrutiny as the rest of your practice management. See what Lexcel, CQS and the SRA actually require.
Firms That Have Had a Near Miss
Something got through, or very nearly did, and the honest answer is that nobody is certain what stopped it or whether it would stop it next time.
Firms Being Asked for Evidence
A lender, a panel, an insurer or a corporate client wants proof rather than assurances, and you would rather answer it properly than guess.
Why Conveyancing Firms Work With Us
Francis West has given over 500 talks on cyber security in the last six years, many of them to rooms full of property and legal professionals. The conversation starts with how a completion day actually runs, not with a product list.
We Understand Completion Day:
The risk is not spread evenly across the month. We look at the days and the moments where client money is genuinely exposed, and put the controls there rather than everywhere.
We Start With What Is Already Exposed:
Before recommending anything, we check whether your domain can be spoofed, whether staff credentials are already circulating on the dark web, and what a fraudster could learn about your live matters.
We Evidence It, Not Just Fix It:
Closing a gap is only half the job. Cyber Essentials and Cyber Essentials Plus give you something you can hand to a lender, an insurer or a client.
We Stay With It After the Certificate:
Renewals, re-scoping as you grow or merge, and the questions that arrive when a new panel sends a new questionnaire.
If that fits the way you want to work, we would be glad to have a conversation.
Cyber Essentials or Cyber Essentials Plus for a Conveyancing Firm
Most firms start with Cyber Essentials. You move to Cyber Essentials Plus when a lender, a corporate client or a public sector contract asks for independent verification rather than your own assessment. Worth being clear about one thing: CQS sets standards for competence, risk management and client service, but it does not mandate a particular security certification. In practice the pressure to certify comes from lenders, insurers and clients.
Cyber Essentials
For most firms this is the right entry point. It covers the five technical controls set out by the National Cyber Security Centre: firewalls, secure configuration, security update management, user access control and malware protection.
Cyber Essentials Plus
CE Plus covers the same five controls, but a qualified assessor verifies them through hands-on testing. In the SRA’s own review of 40 firms that had been attacked, only 5 held it.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment type | Self-assessment questionnaire (SAQ) | Independent technical audit |
| Evidence | Your answers, reviewed by an assessor | Hands-on testing on a sample of user devices |
| External vulnerability scan | Not required | Included |
| Time once submitted | ~24 hours to certificate via CyberSmart | ~2 weeks if controls match the SAQ |
| Cost level | Lower | Higher |
| Best for | First-time certification, most SMEs | Government suppliers, regulated sectors, higher-assurance use cases |
Start With a Free Score, Not a Sales Call
The Conveyancing Cyber Resilience Scorecard is 20 questions and takes about three minutes. It covers payment controls, email defences, your people, certification, backups and AI-driven fraud. You get a personalised report with the priorities in order. No call required.
Read Next
Written for conveyancing and legal practices, not for a general audience.
- Guide: Lexcel, CQS and the SRA, what your cyber controls actually need to show
- Cyber Security for Conveyancing Solicitors: Why the Risks Are Different
- Case study: Conveyancing Cyber Fraud, a £43,000 Friday afternoon loss
- Case study: How a keylogger nearly cost a barrister his case
- Cyber Essentials certification support
FAQs
Does CQS require a cyber security certification?
No. The Conveyancing Quality Scheme sets standards for competence, risk management and client service for SRA-regulated residential conveyancing practices. It does not mandate a particular security certification. In practice the pressure to certify tends to come from lenders, insurers and corporate clients rather than from CQS itself.
What is Friday afternoon fraud?
It is the common name for email modification fraud timed around completion. A criminal gains sight of a live matter, usually through a compromised mailbox, then sends the buyer or the firm revised bank details at the point where everyone is under time pressure and least likely to stop and check. The money is normally moved on within hours.
How quickly do we have to report a data breach?
The ICO requires a notifiable personal data breach to be reported without undue delay, and not later than 72 hours after you become aware of it. Failing to notify when you should have can attract a penalty of up to 8.7 million pounds or 2 per cent of global turnover, whichever is higher. Reporting to the SRA is a separate obligation.
Will this stop completion funds being redirected?
No single control stops it, because the last step is a human one. What works is a combination: email authentication so your domain cannot be spoofed, multi-factor authentication so a mailbox cannot be read quietly, and a written rule that bank details are confirmed by phone on a number you already held, never on a number supplied in the email itself. The technology narrows the opportunity, the process closes it.
How long does Cyber Essentials take for a conveyancing firm?
It depends on how much has to be fixed before you submit. Once your answers are submitted through the CyberSmart platform, certification typically comes back within about 24 hours. Cyber Essentials Plus takes around two weeks once your controls match what you declared, because an assessor tests them directly.
What is the first thing you look at?
What is already exposed. Whether your domain can be spoofed by anyone, whether staff credentials are already circulating on the dark web, and how much a stranger could work out about your live matters from outside the firm. Those three answers usually show where the real risk sits before anyone talks about products.
Talk to Someone Who Knows Conveyancing
Whether a lender has just sent you a security questionnaire, you have had a near miss on a completion, or you simply want to know what is already exposed, we can help you take a practical next step. No pressure, and no jargon.
Contact Us
