Posted January 23, 2018 by Dan Pinnington

---

---

[The following is the text of a Fraud Alert LAWPRO sent to all its insured lawyers on June 30, 2017, updated with email addresses used by fraudsters from further reports we have received. Updated July 5, 2017 and January 23, 2018 with new emails and bank account details]

LAWPRO has received multiple reports of an email funds transfer fraud targeting Ontario lawyers. Given the similarity of the conversations and the email addresses that are being used, we believe it is the same individual(s) behind this fraud and that there are other firms that have been targeted today, and over the last few weeks.

This fraud is remarkably simple. A lawyer or staff person at the firm will receive an email requesting assistance with making a payment. This request will appear to come from a firm lawyer who is out of the office. While the name of that lawyer will appear in the “From:” line of the email, the email address it was sent from will not be a firm email address (the real address will be hidden behind the name that is displayed). This leads the person in the office to believe they are communicating with their colleague, when in fact they are communicating with the fraudster.

The email addresses we are seeing used in these frauds to date are: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected] and [email protected], [email protected] and [email protected]. We have also seen a variations of the scam with the same wording but using a plain gmail or Hotmail address: [email protected], [email protected], [email protected], [email protected], [email protected].

Please advise lawyers and staff at your firm to be highly suspicious of any email requests to transfer funds. Please consider implementing a policy that any such requests are carefully scrutinized and verified directly with the individual making the request. Do not rely on the sender’s displayed name (to deceive you the fraudster will spoof (fake) it so it appears as the name of a person at your firm) – look behind the displayed name to see the email address the message was actually send from.

If you are an Ontario lawyer and have been targeted by one of these frauds, please forward the emails you received to [email protected]. This will help us understand the scope of the fraud and to collect information that may help us prevent other lawyers from being duped.

The following is the conversation that occurred on one of these frauds between the lawyer in the office (the Office Partner) and the fraudster (Vacation Partner). In this case, the lawyer the fraudster was impersonating was out of the office preparing for a vacation.

From: Vacation Partner (fraudster) [[email protected]
Sent: June 9, 2017 12:00 PM
To: Office Partner
Subject: Re: Request
—————————————–
Are you in the office?

From: Office Partner
Sent: June 9, 2017 12:00 PM
To: Vacation Partner (fraudster)
Subject: Re: Request
—————————————–
yes

From: Vacation Partner (fraudster)
Sent: June 9, 2017 12:03 PM
To: Office Partner
Subject: Re: Request
—————————————–
I am tied up in a meeting and I want you to handle a payment for me today, let me know how soon you can get it done and I will forward you the details.

From: Office Partner
Sent: June 9, 2017 12:05 PM
To: Vacation Partner (fraudster)
Subject: Re: Request
—————————————–
You’ll have to give me details

From: Vacation Partner (fraudster)
Sent: June 9, 2017 12:21 PM
To: Office Partner
Subject: Re: Request
—————————————–
Wire transfer amount is $17,860.00 to this beneficiary:

Bank name: Key Bank
Address: 200 Washington St, Watertown, NY 13601
Account name: Otto Glickman
Account number: 322017020841
Key bank routing number: 021300077
Address: 425 Bugbee Dr, Watertown, NY 13601

Let me know once you are done, I will discuss more details with you later.

From: Office Partner
Sent: June 9, 2017 12:44 PM
To: Vacation Partner (fraudster)
Subject: Re: Request
—————————————–
This money is sitting in trust? What file?

From: Vacation Partner (fraudster)
Sent: June 9, 2017 12:48 PM
To: Office Partner
Subject: Re: Request
—————————————–
Operations

From: Office Partner
Sent: June 9, 2017 12:49 PM
To: Vacation Partner (fraudster)
Subject: Re: Request
—————————————–
I am confused. Are you able to talk?

From: Vacation Partner (fraudster)
Sent: June 9, 2017 12:52 PM
To: Office Partner
Subject: Re: Request
—————————————–
Yes

From: Office Partner
Sent: June 9, 2017 12:54 PM
To: Vacation Partner (fraudster)
Subject: Re: Request
—————————————–
Ok. Just want to confirm – you are saying we are advancing this from general?

From: Vacation Partner (fraudster)
Sent: June 9, 2017 12:58 PM
To: Office Partner
Subject: Re: Request
—————————————–
Yes

From: Office Partner
Sent: June 9, 2017 1:00 PM
To: Law firm bank
Subject: FWD Re: Request
—————————————–
Please prepare the following wire transfer. I will come by to review and sign the authorization.

Wire transfer amount is $17,860.00 to this beneficiary:

Bank name: Key Bank
Address: 200 Washington St, Watertown, NY 13601
Account name: Otto Glickman
Account number: 322017020841
key bank routing number: 021300077
Address: 425 Bugbee Dr, Watertown, NY 13601

From: Vacation Partner (fraudster)
Sent: June 9, 2017 1:52 PM
To: Office Partner
Subject: RE: Request
—————————————–
What is the status of payment?

In this case, the Office Partner figured out it was a fraud while standing in line to speak to a teller at the bank. A near miss!

The banking details used in the apparently related fraud attempts we have seen are as follows:

Wire transfer for the amount of $17,860.00
Bank name: First National Bank of Texas
Address: 782 Interstate 30 Rockwall Texas 75185
Account number: 458361532
Router number: 11906271
Account name: Rita Elser
City: Royce
ZIP code: 75189
State Texas

Bank name: Bank Of America
Bank address :‎ 8001 Villa Park Drive Henrico, VA 23228
Account Name: Brenda Bradley
Checking account number :325093199645
Routing number : 121000358
Consultant address: 805 Diablo Ave. Apt. 8 Novato CA. 94947

Bank Name: Bank of America
Account Name: Jaime Rodriguez
Routing Number: 063100277
Account Number: 898089176028
Bank Address: 460 E Altamonte Dr, Altamonte Springs, FL 32701
Beneficiary Address: 1514 Canary St, Longwood, FL 32750

Bank Name: Farmers State Bank
Bank’s Address: 201 main st. Yale, IA 50277
Bank Account Name: Don Fagen
Account Routing Number: 6304
Bank Account Number: 155176
Home Address: 320 4th st Bagley IA 50026

Bank name: Chase Bank
Consultant Name: Robert foster
Checking Account Number: 760539077
Routing Number: 322271627
Bank Address: 20573 Stevens Creek Blvd., Cupertino, CA. 95014
Consultant Address: 3074 story road RD San Jose California zip code 95127

US Alliance Financial
Bank Address: 25 Sullivan Ave. Liberty NY 12754
Name on Account: Paulett D. Collins
Account Number: 1915802080
Routing number: 221981063
Beneficiary address: 5 Liberty Commons Apt. 7 Liberty NY 12754

Bank Of America.
Vital Consult
Account Name: Annie L Vital
Account No: 446038988059
Routing No: 026009583
Swift – BOFAUS3N
Bank Address: 344 Montrose Ave Laurel, MD 20707 US
Office Address: 15407 Calshot Ct, Laurel, MD 20707

Account name: G. Patrick Reese
Bank: BOA
Bank Address: 4851 Lower Roswell RD Marietta GA 30068
Home address: 640 Serramonte Dr Marietta GA 30068
Routing number: 061000052
Account number: 334053654612

Bank name: Wells Fargo Bank
Bank address: 854 Howard ave, Biloxi MS 39530
Consultant name: Amy Curtis
Checking Account number: 546492295
Routing number: 062203751
Consultant address: 229 Bohn St Biloxi MS 39530

Bank Name: PNC Bank
Bank Address : 8 e main st, Emmitsburg MD 21727
Account name: Michelle cannon
Account no 255004131146
Routing no 031902766
House Address: 10427 Welty Rd Emmitsburg MD 21727

Bank name: Chase bank
Bank address: 4406 Centennial Blvd Colorado Springs, CO 80907
Consultant name: Karen Laduke
Account number: 921685132
Routing number: 102001017.
Consultant address: 600 Raintree Blvd lot 116 Canon City CO 81212.

————————————————————————————–
Its a wire transfer in the amount of $8,870

Business Name : Global Investment Company,LLC
Business Address: 2023 S. Elkhart Street
Aurora,CO 80014
Account # 4000755321
Routing # 102000966
Bank Name: GUARANTY BANK AND TRUST COMPANY

How to Handle a Real or Suspected Fraud

If you have been targeted by any of these frauds, please forward any of the emails and supporting documents that you have received to [email protected]. We use this information for the warnings we post on AvoidAClaim. We do not disclose the names of firms that have provided us with information.

Ontario Lawyers – Call LAWPRO

If you are an Ontario lawyer acting on a matter that you suspect might be a fraud, call LAWPRO at 1-800-410-1013 (416-598-5899). One of our Fraud Team members will talk you through the common fraud scenarios we are seeing and help you spot red flags that may indicate you are being duped. This will help you ask appropriate questions of your client to determine if the matter is legitimate or not. If the matter you are acting on turns out to be a fraud, we will work with you to prevent the fraud and minimize potential claims costs.

---

What can you do to help put a stop to the fraud attempt?

You can simply stop replying to the fraudster’s emails or inform them that you suspect fraud and will not act on the matter. You can report the fraudsters’ email addresses to the email hosting company. If you have a fraudulent cheque you can destroy it or send it to the fraud department of the financial institution it is drawn upon. In Canada, you can report the fraud to the Canadian Anti-Fraud Centre.

We are often asked if it is worthwhile to report the fraud attempt to the police in the hopes of helping catch the fraudsters. You can certainly report the fraud to your local or federal law enforcement agencies, but unfortunately it is often difficult, expensive and time consuming for them to attempt to shut down these online fraud perpetrators (though there are some successes).

What if the fraud has been successful?

If you have been successfully duped, please immediately notify LAWPRO as there may be a claim against you. See the LAWPRO website for instructions on how to report a claim.

For more immediate updates on fraud and claims prevention, subscribe to the email or RSS feed updates from LAWPRO’s AvoidAClaim blog.

Fraud Fact Sheet

More fraud prevention information and resources are available on the practicePRO Fraud page, including the Fraud Fact Sheet, a handy reference for lawyers and law firm staff that describes the common frauds and the red flags that can help identify them. To proactively prevent trust account shortfalls and malpractice claims, LAWPRO encourages firms to teach their lawyers and staff about fraud and how to recognize fraud attempts.