tm blog

Homes being swallowed up by sinkholes is something most people would expect to see in a horror film, yet similar stories are making the headlines with alarming regularity and the problem is only getting worse. 

Sinkholes are opening up everywhere from Cheltenham to Liverpool and even London, bringing into question much of what conveyancers (and the general public) thought they knew about mining and the risks it poses to ground stability in the UK.

Are you making dangerous assumptions about local mining risks?

South Wales, Cornwall and the North East are well-known locations for historical mining activity, prompting local conveyancers to stay aware of the connected risks. Yet those working in central and eastern England and London are less concerned – and even assume there aren’t any risks that will affect their clients’ properties which couldn’t be further from the truth. 

Mining activity has taken place across the UK for 100’s of years with the availability of minerals shaping the growth of towns and cities the length and breadth of the country, as well as shaping their unique character (which is why the likes of Bath and Worcester look so different). The reality is that historical mining could affect almost any location in the UK so professional due diligence is essential when purchasing a property.

Forgotten shafts

Unlike the high-profile strikes surrounding the closure of the coal mines in the 1980’s, many other local mines across the country closed quietly during the turn of the 20th Century with the last large-scale mines closing in the 1960’s. With no legislation in existence or money to fill them in, 98% of these mines were abandoned and forgotten.

At the time, local communities remembered where the mineshafts had been located and therefore the land was used as open areas for parks rather than homes. As time has worn on much of this information has been lost and the open spaces unknowingly bought up and built upon by developers after which ground stability problems have emerged. Lack of data and expert professional interpretation, as well as NHBC regulations (which only require due diligence of the top 2m of the ground) have contributed to this risky oversight resulting in costly repair bills for developers and in extreme cases entire developments have been demolished such as the Bayfield, West Allotment Site in Tyneside. 

Cases in point

Recent sinkholes in Reading, St. Albans and Kent serve as a stark reminder as to the risk historical mining activity can have on ground stability. 

Houses, shops and schools that have, in most cases, unwittingly been built above these old mine shafts are suffering from a number of issues, such as subsidence and the appearance of collapses and mining sinkholes. 

Here are just some of the examples that have made the headlines in recent years: 

30 homes were evacuated in Reading when an old chalk mine collapsed 

In January 2000, a 19th Century chalk mine collapsed causing major subsidence of the overlying ground around the Field Road and Coley Road area in Reading.

30 homes were evacuated for residents’ safety and a further 2 homes later collapsed. It took 12 years to fill the underground chalk mines with 1,742 tonnes of grouting, costing approximately £4.3 million.

http://www.bbc.co.uk/news/uk-england-berkshire-13630363

A giant mining sinkhole in St. Albans cut off utilities to over 50 properties

On 1st October, 2015, a giant sinkhole opened up in Fontmell Close, St Albans. It was 66ft wide and 30ft deep, cutting off utilities to over 50 properties and forcing families to evacuate their homes. 

The hole was created by heavy rainfall causing a previously unknown chalk mine to collapse. The void required 48 lorry-loads of foamed concrete to fill.

http://www.bbc.co.uk/news/uk-england-beds-bucks-herts-38156508

Several shops were forced to close when a mining sinkhole appeared in Kent

In early 2015 at Lawrence Square, Northfleet, Gravesend, Kent, the appearance of a sinkhole forced several shops to close and 7 sets of council tenants to be evacuated for fears of more subsidence.

Continued subsidence forced the gas supply to be shut off and the area was declared unsuitable for permanent habitation. The area was heavily mined for chalk and clay during the 19th Century with many chalk mines and mining-related sinkholes already known in the immediate area around Lawrence Square. 

http://www.kentonline.co.uk/gravesend/news/tenants-rehomed-due-to-dangerous-32861/ 

Terrafirma are helping conveyancers and homeowners understand the full extent of mining risks 

Using their specialist knowledge, Terrafirma analyse coal mining risks alongside an additional 55 mining hazards to reveal a fuller picture of ground stability in our towns and cities.

To find out more about how Terrafirma can uncover the truth about mining in your local area, you can also read this blog post. 

We're testing conveyancers assumptions about mining risks in the UK by asking “What percentage of all mining-related ground stability risks does coal mining account for?”.

The results are still coming in. However, it is expected that the poll findings will support the long-standing assumption that coal mining is the prime ground stability risk that conveyancers need to be concerned about.

Beyond this, it is typically considered that properties across Wales and the North East are the most likely to be affected. Yet such assumptions are causing some conveyancers to ignore the mining alerts triggered when ordering searches against their client’s properties; assuming that they are safe. 

Rather worryingly, examples of sinkholes opening up miles away from these traditional coal mining sites are beginning to suggest that this is far from the truth, as recently seen in Cheltenham, Liverpool, Sudbury and London.

There are over 60 mining hazards impacting ground stability in our towns and cities

The latest TerraSearch products from Terrafirma are challenging this perception too. Drawing on Terrafirma’s specialist knowledge in the innovation and provision of mining-instability risk assessment, the TerraSearch product suite analyses coal mining risks alongside an additional 55 mining hazards to reveal a fuller picture of ground stability in our towns and cities.

The following TerraSearch® products are now available on tmconvey to order against residential properties :

• TerraSearch® Coal Extra is a regulated ‘Con29M-Compliant’ coal mining search offering an equivalent to the Coal Authority report, including a professional opinion of all coal mining risks and CON29M questions and additionally alerting to 55 further mining hazards. 

• TerraSearch® Assess is a single search that comprehensively assesses the risk to a site (property and land) from all 60 mining hazards, including past, present and planned extraction.

Both TerraSearch® Coal Extra and TerraSearch® Assess include additional professional interpretations, as well as a TerraSearch® Coal & Brine Report Indemnity Policy up to £50,000 loss in market value of the property (in the event that a conclusion changes based on the addition of new data), and £10 million liability per report in the event of wrong or missing information.  

TerraSearch® Coal Extra and TerraSearch® Assess are also supported by a TerraSearch® Alert, which is now available on tmconvey and can be switched on by your Account Manager. 

Get in touch with your Account Manager for more information.

Don’t forget… 

Find out if you are making dangerous assumptions about local mining risks

Take part in our quick poll “What percentage of all mining-related ground stability risks does coal mining account for?” and find out if you too are making dangerous assumptions about local mining risks. 

With stories of sinkholes appearing routinely in the headlines (including this recent example which closed a road in Liverpool), it is becoming increasingly clear that more needs to be done to alert homebuyers to the wider risks of ground stability in the UK. 

Part of the issue is that conveyancers sometimes only order ground stability searches against coal-mining risks and overlook the potential risks posed by non-coal mining. However, there are over 405,000 recorded non-coal mine-shafts in the UK and many of these are present in major towns and cities. 

Here are just some of the non-coal mine-shafts that have been recorded in London : 

• 490 Chalk Mines/Pits

• 94 Sandstone Mines

• 31 Fuller’s Earth Mines

• 16 Sand and Gravel Mines

• 642 Clay Pits

Terrafirma analyse an additional 55 mining hazards 

Terrafirma are challenging this perception with their TerraSearch products by analysing coal mining risks alongside an additional 55 mining hazards to reveal a fuller picture of ground stability in our towns and cities. 

The following TerraSearch products are now available on tmconvey to order against residential and commercial properties :

TerraSearch^® Coal Extra :

TerraSearch^® Coal Extra offers the equivalent of a regulated Coal & Brine search and is "Con29M-compliant", whilst also alerting against an additional 55 mining hazards.

TerraSearch^® Assess :

TerraSearch^® Assess is a single search that comprehensively assesses the risk to a site (property and land) from all 60 mining hazards, including past, present and planned extraction.

TerraSearch^® Alert : 

TerraSearch^® Coal Extra and TerraSearch^® Assess are also supported by a TerraSearch^® Alert.

Both TerraSearch^® Coal Extra and TerraSearch^® Assess include additional professional interpretations, as well as a TerraSearch^® Coal & Brine Report Indemnity Policy up to £50,000 loss in market value of the property, and £10 million liability per report. 

TerraSearch^® Coal Extra, TerraSearch^® Assess and TerraSearch^® Alert are all now available on tmconvey to switch on by request.

Please get in touch with your Account Manager for more information.

You can also take part in this poll question to test your knowledge on coal mining risks in the UK. 

If you’ve ever heard the saying ‘sitting ducks’, you’ll know we’re referring to easy targets. Unfortunately, this rings true for the majority of home movers, as findings show that a staggering 83% are ‘cyber blind’ to the risks posed by Friday afternoon fraudsters. 

According to the latest Home Moving Trends report, published by tmgroup in partnership with the Property Academy, only 17% of clients consider transferring funds to their conveyancer to be a high-risk phase of the property transaction. 

Capturing the opinions of over 14,000 home movers, the bottom line is that a vast number of property transactions are at risk of ‘Friday afternoon fraud’ every week;  a stark warning to all conveyancers. For an industry that has already witnessed a number of high-profile incidents this year, including the Howard Mollett case, it’s not good news.   

With fresh reports of fraudsters impersonating law firms continuing to appear in the Bold Legal Group (BLG) bulletin, it’s also clear that the problem isn’t going away any time soon.

It seems it’s no longer enough for conveyancers to simply include fraud and cyber crime messages in their welcome packs and assume that their clients are reading them. As the latest Home Moving Trends findings reveal, only 54% of clients claim to have read every word of their paperwork. 

As Paul Albone, Managing Director at tmgroup, comments:

“With ever-savvier cyber criminals targeting the conveyancing world, assuming that every client is aware of every risk is no longer an option.”

With so much at stake, conveyancers need to be building checks into their processes to make sure their clients are fully aware of cyber crime threats and that they understand them.  In many cases, this could be as simple as reiterating key messages in follow up calls and appointments, alongside awareness messages into email signatures.  

Paul Albone, Managing Director at tmgroup, continues:

“As these statistics reveal, conveyancers need to be mindful of the fact that it is their responsibility to convey these risks to their clients – not merely as a conveyancing exercise, but in an attempt to eradicate this kind of fraud from the market, and reduce the level of risk to their firm, their reputation and their bank balance.” 

Download the latest Home Moving Trends report to find out more

These findings were taken from the latest Home Moving Trends report, based on a survey of 14,389 home movers conducted by the Property Academy in partnership with tmgroup.  

Download the latest Home Moving Trends report for more information and guidance on tackling cyber crime in the conveyancing sector. 

‘All in one’ environmental reports are making it quicker and easier for conveyancers to report next steps back to their clients – without compromising on quality. 

By combining several key data sources and presenting necessary actions clearly, ‘all in one’ environmental reports such as Groundsure Avista and Landmark RiskView Residential are making time-consuming interpretation a thing of the past.

This is mostly due to the sheer breadth of information included, which enables conveyancers to order just one environmental report whilst still performing due diligence for their clients.

For example, Avista combines 7 key environmental risks including includes Flood risk, Planning applications, Contaminated Land, Ground stability, Radon, Transportation, and Energy. 

Similarly, RiskView Residential presents 6 environmental risks as previously provided in 4 separate reports: Flood Risk, Contaminated Land, Ground Hazards, and Energy & Infrastructure – with ‘Plansearch Plus’ available as an ‘add on’ at the time of ordering.

A clear snapshot view helps conveyancers prioritise their work

A further benefit of these ‘all in one’ environmental reports is that all of this information is presented with a snapshot summary of actions, which makes it easier for conveyancers to know what to do next.

For example, Avista Action Alert presents conveyancers with a clear 1-5 rating. This acts as a useful visual image providing immediate understanding of the outcomes of the report.

This also helps conveyancers to prioritise their work, as they frequently receive several reports on the same day, which can make it challenging to decide which one to read first. 

The clear risk rating enables conveyancers to prioritise their work at a quick glance and feel confident that all of their property transactions are progressing.

Simple summary pages make it easier for conveyancers to feedback to clients 

The clear presentation of each summary page also makes it far easier for conveyancers to digest next steps and pass key findings onto their clients.

RiskView Residential further supports this by providing an online viewer for conveyancers to share with their clients.

These features help to remove some of the delays typically associated with interpreting lengthy reports, and further streamlines the conveyancing process. 

A wealth of data available at a reasonable price

Despite the wealth of benefits available in these ‘all in one’ reports, the ordering costs are surprisingly reasonable; Groundsure Avista comes in at an RRP of just £79+VAT, and Landmark RVR has an RRP of £83.00+VAT. 

Compared to the price of ordering all of this information in multiple reports, and the time spent reading through them all, these latest offerings provide significant time and cost savings for the conveyancing sector. The shorter length of the reports also mean that it is quicker and cheaper to print when needed.

Simon Wood, Sales Director at tmgroup, comments: 

“The availability of these ‘all in one’ environmental reports have marked an innovative step forward for conveyancing efficiency, making it quicker and easier for conveyancers to review key findings quickly” without compromising on quality.”

“It is clear that conveyancers’ needs are at the heart of these latest reports too, with features such as the clear 1-5 rating responding specifically to the on-going challenges faced by conveyancers in prioritising their clients competing interests.” 

Try an ‘all in one’ environmental report today 

Groundsure Avista and Landmark RiskView Residential are available to order now through the new tmconvey platform. 

Visit www.tmgroup.co.uk for more information.

Simon Wood

Simon is Sales Director for tmconvey. He leads teams in helping customers grow their business, drive internal efficiencies and manage risk around property searches.

 

Since our National Conference back in February, cyber crime incidents have continued to make the headlines; from the WannaCry ransomware attack to the recent attack on DLA Piper. 

To help support your on-going efforts to protect your law firm from cyber criminals, we have launched a new series of webinars, featuring expert advice on the current risks all law firms need to be aware of. 

These pre-recorded webinars are available now on the tmgroup Webinar Hub for you to watch and share with your team at your own convenience. 

The full series includes; 

The current cyber security risks you need to be aware of

Graeme McGowan from BeCyberSure Ltd explores:

• The current cyber security risks law firms need to be aware of. 

• The forthcoming General Data Protection Regulations (GDPR).

Click here to watch the ‘Cyber Security – 2017 and beyond’ webinar.

Find out : How your PR company could act as a bridge for hackers

Jeremy Swinfen Green from Teiss discusses:

• The risks posed by business partners, contractors and customers.

• How to reduce the risk of a third party who has access to your IT systems acting as a bridge for hackers.

Click here to watch the ‘Cyber Security: Managing 3rd Party Supplier Risks’ webinar.

Find out : Why increased IT complexity is ACTUALLY good for cyber criminals 

Matt Newton from Oosha Ltd explains:

• Why increased IT complexity is good for cyber criminals. 

• The latest considerations relating to professional indemnity insurance and cloud technologies.

Click here to watch the ‘Dealing with the undeniable threat’ webinar.

Find out : How to respond if the worst happens

The National Police Chiefs’ Council’s National Cyber PROTECT Coordinator looks at:

• The risks all law firms should be making their teams aware of. 

• Incident handling guidance and information sharing.

• How to respond to a cyber-incident.

Click here to watch the ‘Cyber Crime and the Law Enforcement Response’ webinar.

Stay updated on the latest cyber crime advice with tmgroup by following @TM_Property for our latest webinars, events and articles around cyber crime.

The European Union’s Fourth Anti-Money Laundering Directive (EU4MLD) has been implemented into UK law as of 26th June 2017. Relevant legislation includes the Money Laundering Regulations, Policing and Crime Act and the Proceeds of Crime Act. The directive includes fundamental changes to AML procedures at law firms, including changes to Customer Due Diligence (CDD) and a strong focus on risk assessments.

What is changing?

Under EU3MLD and the current Money Laundering Regulations, firms could automatically apply simplified CDD under certain circumstances. Under the new regulations, firms will be able to use these circumstances as a partial justification for simplified CDD only after conducting a documented risk assessment.

Exemption from enhanced CDD is no longer automatic, a decision to apply simplified CDD will need to be evidenced by a documented risk assessment and include PEP and Financial Sanctions screening. Local politically-exposed persons (PEPs) must now be identified and will be subject to the same scrutiny as foreign PEPs. The regulations direct firms to develop risk-based policies, and practitioners to conduct client risk assessments as a part of their CDD.

UK regulations already incorporate a risk-based approach, but the new directive goes considerably further requiring documented client risk assessments.

For law firms this will mean:

• Demonstrating that risk assessments are conducted and kept up-to date, including; clients, countries or geographic areas, products, services, relationships, transactions or delivery channels.

• Policies and procedures that take the firm’s risk assessment into consideration.

• Testing of the internal policies, controls and procedures.

• Training staff in conducting Risk Assessments, CDD and ongoing due-diligence.

• Compliance reporting, electronic and hard copy records management.

Law firms with majority-owned subsidiaries in other countries where the minimum AML requirements are not as stringent, must also implement the same procedures with the subsidiaries. 

Additionally, for all businesses, CDD will be required when trading goods in cash with a value over €10,000 (rather than €15,000).

What can law firms do to prepare?

• Review existing providers of CDD services for compliance with the new regulations.

• Review integrating AML risk assessment and compliance systems to reduce costs, streamline and unify your procedures firm wide.

• Implement staff training.

• Money laundering reporting officers (MLROs) should;

• Perform and document an internal risk assessment.
• Update policies to incorporate Client Risk Assessments, on-going due diligence, documentary evidence and compliance reporting, to reflect the directive.
• Audit and test procedures.

• Policies should be reviewed and approved by senior management.

With thanks to Greg Roach, Director of Searches Group Limited

In line with the changes in UK law in relation to the European Union’s Fourth Anti-Money Laundering Directive (EU4MLD), AML Search v4 will be released soon.

AML Search v4 builds upon AML Search v2's data analytics to include fully automated Risk Assessments, Compliance Reporting, conflict checking, documentary evidence management, on-going monitoring and automated record keeping.

Here, we’ve answered some frequently asked questions to help you understand exactly what these changes and implications mean for your firm:

What do the regulations mean? 

• There is no longer an automatic exemption from undertaking Enhanced Due Diligence

If, like many firms, you simply take a copy of a Client's identity documents, your procedures and processes are likely to have to change significantly to be able demonstrate your compliance with the new regulations and laws. 

The regulations are clear – there is no longer an automatic exemption from undertaking Enhanced Due Diligence, as opposed to Simplified Due Diligence, which has often been carried out by simply obtaining a copy of a Client's Identity documents, for example a Passport and Driving License. 

• Firms will be required to evidence they have identified the Client and screened them against alert sources

After 26th June, you will need to demonstrate compliance by being able to evidence that you have risk assessed clients in accordance with the regulatory requirements. Therefore, clients who would have previously been on-boarded using Simplified Due Diligence must be Risk Assessed, with a minimum requirement of documenting and confirming the Clients Identity and electronically screening them for Financial Sanctions and Politically Exposed Persons (PEP) – including UK nationals.

• Additional requirements for on-going due diligence monitoring

There are additional requirements for the period of time that your firm will have to be able to demonstrate and deliver up to regulators your compliance records in relation to specific clients, on-going due diligence monitoring and how long records may be kept. 

What are the penalties for failing to comply?

The penalties for failing to comply with obligations under the new regulations have been increased. 

In addition to penalties that can be imposed by regulators and other legislation, the Policing and Crime Act 2017 has increased fines up to £1,000,000 and prison sentences from 2 to 7 years; where 'the person has breached a prohibition, or failed to comply with an obligation, that is imposed by or under financial sanctions legislation'. 

Click here for more information about the European Union’s Fourth Anti-Money Laundering Directive (EU4MLD)

How does AML Search v4 support compliance?

• Regulatory Compliance

AML Search v4 has been designed to meet and exceed Anti-Money Laundering compliance requirements including but not limited to;

• Fourth European Money Laundering Directive (EU 4MLD)

• United Kingdom Money Laundering Regulations/Laws

• Joint Money Laundering Steering Group (JMLSG)

• The Law Society

• The Solicitors Regulatory Authority (SRA)

• Financial Conduct Authority (FCA)

• International Bar Association (IBA)

• Financial Action Task Force (FATF)

• Council of Mortgage Lenders (CML)

• Sarbanes–Oxley

• Risk Assessments

Regulations make it mandatory for firms to carry out Risk Assessments on their Clients as a part of their Client Due Diligence (CDD).

AML Search v4 automates Customer Due Diligence Risk Assessments to enable your users to simply and quickly enter Client data, include documentary evidence and carry out a Risk Assessment and Simplified or Enhanced Due Diligence in a few minutes.

• The CDD Record

AML Search v4 introduces a unified view of your Client Due Diligence (CDD). Both Individual (Personal) and Organisations (Non-Personal) CDD records are contained in one fully searchable view.

The CDD record for a Client contains your Risk Assessments, Client Data, Documentary Evidence, and Client Relationships – which aids in your conflict checking and provides a complete audit trail, making it easy to evidence your regulatory compliance.

Click here for more information about AML Search v4 

Are existing AML v2 Searches compliant?

Yes. 

AML Search v2 provides Enhanced Customer Due Diligence Searches which are fully compliant with the new regulations. There are however other changes that you need to consider including how you will carry out Risk Assessments, On-Going CDD, record keeping and reporting in order to demonstrate your firm’s compliance.

Can I continue to use AML Search v2?

Yes. 

It is recommended that you review your Risk Assessment procedures in line with the new regulations. The regulations stipulate that there is no longer an exemption from Enhanced Due Diligence. Therefore, clients who would have previously been on-boarded using Simplified Due Diligence must be Risk Assessed, with a minimum requirement of documenting and confirming the Clients Identity and electronically screening them for Financial Sanctions and Politically Exposed Persons (PEP) – including UK nationals. 

AML Search v2 already provides all of the features for enhanced CDD with the exception of documented Client Risk Assessments which must be carried out manually by firms if using AML Search v2 – AML Search v4 provides fully automated Risk Assessments.

Should I review our Risk Assessment Criteria and Procedures?

Yes. 

There are significant changes in the regulations as to how you are required to Risk Assess your Clients, carry out On-going Due Diligence, how quickly firms must demonstrate their compliant procedures and how long records can be kept.

Why should I upgrade from AML Search v2 to AML Search v4?

AML Search v4 extends the features of AML Search v2 adding robust compliance tools to reduce the time and cost to firms of implementing, maintaining and running compliant AML procedures. 

These include automated Client Risk Assessments, Simplified and Enhanced Due Diligence for individuals and organisations (UK and International). 

This means that you can complete the process of carrying out a Risk Assessment and Customer Due Diligence by running an AML v4 Risk Assessment, ensuring you can demonstrate compliant procedures across all users. 

AML Search v4 also includes your real-time compliance status and reporting, on-going due diligence monitoring, which ensures your client due diligence is always up-to-date, document, file and archive management to ensure you meet the new record keeping criteria.

With thanks to Greg Roach, Director of Searches Group Limited

Following our National Conference and in support of our ongoing cyber awareness campaign, we’ve compiled a list of cyber security key terms and jargon for reference.

Bogus Law Firm

The term ‘bogus law firm’ refers to an individual or small group of people posing as a genuine law firm to form part of a legitimate property chain.

However, once the money changes hands, they do not fulfil their commitment to close the deal and instead disappear with the funds that have just arrived in their bank account.

Risk Management Services such as Lawyer Checker are available to assure conveyancing solicitors that they are dealing with genuine law firms before progressing a transaction.

Chief Executive Fraud (or President Fraud)

‘Chief Executive Fraud’ (also referred to as ‘President Fraud’) is a targeted phishing attack, where an individual in the firm is sent a fake email which looks as though it has come from a Managing Partner.

For example: “Did you send £20,000 to Michael J Hart? I thought I asked you to do this last week, but Michael has just phoned to say he hasn’t received the money?”

The success of this type of fraud relies heavily on social engineering to create a stressful situation where the target feels under pressure to respond quickly to an email from one of their superiors – without questioning the validity of the message.

More information : Click here for more information on Chief Executive Fraud (or President Fraud)

Cyber Incident Response Plan

A ‘cyber incident response plan’ is a dedicated (printed) document containing all of the information your team might need in the event of a cyber-attack.

This will include agreed responses to “worst case scenarios”, alongside named individuals responsible for executing them. It will also feature a detailed list of contact details for the people whose advice, support and technical services will be required to get your operation back up and running.

More information : Click here for more information on How to Prepare to Defend Your Law Firm's Reputation in the Event of a Cyber-Attack

Friday Afternoon Fraud

‘Friday Afternoon Fraud’ is a term used in the media to describe a cyber-attack where clients are targeted with phishing emails imitating their solicitor and asking them to transfer their deposit to an alternative bank account.

When successful, victims are left with no funds to finalise their property transaction, and a dilemma as to how to proceed with their purchase. 

High profile example : Howard Mollett incident

General Data Protection Regulations (GDPR)

A new, more consistent global legal framework for all organisations that deal with EU citizens’ data, set to replace the existing Data Protection Directive (DPD) in May 2018.

To avoid fines of up to €20 million, or 4% of annual turnover (whichever is higher), law firms will need to review their data usage, storing and cleaning methods to ensure they are compliant with the new regulations.

Good to know : Despite Article 50 being triggered in March 2017, the UK will still be part of the EU until at least 2019; and will need to comply with the General Data Protection Regulations (GDPR) when they are introduced in May 2018.

More information : Click here to find out more information about the forthcoming General Data Protection Regulations (GDPR).

Phishing email

A phishing email is an email which impersonates a legitimate organisation.

Such emails are typically ‘blanket emails’ sent to multiple recipients pretending to be from a bank or building society, in attempt to obtain sensitive information such as usernames, passwords, and credit card details.

However, these can very quickly be identified as spam by the receiver, especially if they are pretending to be from Halifax, and the receiver only banks with Lloyds Bank (for example).

People Risk

People Risk refers to the risks posed to a law firm by human error or naivety.

Clients and colleagues can impact this in equal measure, and criminals are highly aware of this.

A successful attack or accidental data leak can bypass any technology-based security measures in place and make them redundant.

More information : Click here to read more about the people risks in your law firm and how your colleagues could pose an even greater risk than your clients.

President Fraud

See : Chief Executive Fraud

Ransomware attack

A ransomware attack is when a cyber-criminal infects a computer system with a piece of malware, which places a digital blocker on the system so that the victim firm can’t raise an invoice or continue business as usual.

This can happen as a result of just one member of staff clicking a link in a rogue email, or plugging in an infected USB stick.

The cyber-criminal will then hold the firm to ransom, with a message appearing on their computer screen asking them to pay them money for the digital release key.

More information : Click here for more information about ransomware attacks

Secure online portal

A secure online portal provides a safer and more efficient alternative to email communication, enabling law firms and their clients to exchange sensitive information online.

As all the information is encrypted, law firms can be confident that bank details and contracts are being delivered securely to their clients, removing any concerns about post or emails being lost or intercepted by criminals.

More information : Click here for more information about secure online portals and how they can improve security and business efficiency in your law firm.

Shadow IT

The term ‘Shadow IT’ refers to IT activity that goes on around a law firm under the radar of the official IT department.

For example, employees plugging in USB sticks they’ve picked up at events, or sharing files across popular file-sharing websites; both of which can act as a gateway for cyber criminals.

HR and IT departments need to work together to help promote positive messages across their law firm to raise awareness of these risks, and curb ‘Shadow IT’ behaviours.

Spear-phishing email

Spear-phishing is similar to phishing [see: phishing email], but operates under a more targeted approach.

Instead of sending a ‘blanket email’ to multiple recipients, spear-phishing emails will be based on information the sender has already obtained about the recipient.

For example, their name, email address, and whether they are a Lloyds Bank customer (for example). This can contribute to the confusion, and the success of the attack.

Take Five

Take Five is the name of a cyber-security awareness campaign led by FFA UK and its members, with partners Cifas and City of London Police.

It advises people to question the validity of any communications they receive, and contains useful advice and resources which can be shared with clients and colleagues alike to help to better protect a law firm from the risks of cyber crime.

More information : Click here to find out more information about Take Five and how it can help to keep your colleagues and clients safe from cyber criminals.

Technology Risk

Technology Risk refers to all the risks associated with IT and technology that can be mitigated through best practice and innovation.

There are a broad range of technology risks IT departments need to stay abreast of to maintain the security of their law firm, from password management and email security, through to continuous user activity monitoring and ensuring all employees are running the latest versions of anti-virus software. 

Third Party Risk

The term ‘third party risk’ refers to any business partner, PR agency, contractor or customer who has access to a law firm’s IT systems, and could (intentionally or unintentionally) act as a bridge for hackers.

Understanding and limiting the information these third parties have access to can help law firms to avoid cyber security incidents.

Two Factor Authentication

Two Factor Authentication is an additional layer of security that requires someone to have more than just a username and password to log into an account.
 
For example, inserting a physical bank card into a card holder when accessing online banking, or generating a unique code to be texted to a mobile phone to add in as part of a computer log in process.

Vishing

Vishing refers to a phishing-style attack over the phone in which a criminal claims to be from the victim’s bank and tells them their account has been compromised. They then ask the victim to transfer their money to a “safe” account to address the problem.

This approach can be used to target both individuals, and employees in the Finance Department with access to company accounts.

Similar to spear-fishing [see : spear-fishing email], the fraudster may have already gained access to some of the victim’s banking details, and may quote genuine transactions to back up their story. 

‘Zero Day’ Vulnerabilities

‘Zero Day’ vulnerabilities are vulnerabilities in IT systems and processes that nobody knows are there – apart from hackers.

They have been given this name because a law firm will have ‘zero days’ to respond and fix them when (and if) they are found.

More information : You can find out more about ‘Zero Day’ vulnerabilities and how you can prepare for them by watching this video from BeCyberSure

If there are any words you feel are missing from our Cyber Security : Key Terms and Jargon reference guide, please email our Marketing Communications Executive on megan.jones@tmgroup.co.uk

With a number of cyber threats challenging the legal sector, it is increasingly important that everyone from clients, to partners, to receptionists and admin staff understand how to protect themselves and the firms' interests from cyber criminals.

Fortunately, in a lot of cases, it can be enough for everyone faced with a fraudulent situation to just #takefive and think about whether the communication is genuine. 

This is the key message of Take Five, a new awareness campaign led by FFA UK and its members with partners Cifas and City of London Police.

In support of their latest awareness campaign #takefiveday, we've republished their 5 key messages to help better protect everyone: 

• Never disclose security details, such as your PIN or full banking password

• Don't assume an email request, text or phone call is genuine 

• Don't be rushed - a genuine organisation won't mind waiting 

• Listen to your instincts - you know if something doesn't feel right 

• Stay in control - don't panic and make a decision you'll regret 

You can also share these key messages with your clients to help proactively inform them of how they can be more alert to criminal activity.

‘Take Five’ messages can help law firms better tackle the current threats

While these 5 things may seem like common sense, they can help to protect against key industry threats including: 

Chief Executive Fraud (or President Fraud)

The term ‘Chief Executive Fraud’ (or President Fraud) refers to a targeted phishing attack, where an individual in the firm is sent a fake email which looks as though it has come from a Managing Partner: “I thought I asked you to do this last week, but Michael has just phoned to say he hasn’t received the money? Please take care of this.”

#takefive : Stay in control - don't panic and make a decision you'll regret 

Ransomware Attacks

A “ransomware attack” is when a cyber-criminal infects a computer system with a piece of malware, which places a digital blocker on the system so that the victim firm can’t raise an invoice or continue business as usual. This can happen as a result of just one member of staff clicking a link in a rogue email.

#takefive : Don't assume an email request, text or phone call is genuine 

Friday Afternoon Fraud 

‘Friday Afternoon’ fraud describes a cyber attack where clients are targeted with phishing emails imitating their solicitor and asking them to transfer their deposit to an alternative bank account. When successful, victim clients are left with no funds to finalise their property transaction. 

#takefive : Listen to your instincts - you know if something doesn't feel right 

Top Tip : To help further reduce the risk, you should also make sure your clients are informed of the type of communications and requests you will and won’t make, so they are better positioned to recognise a rogue or unusual request.

Additional Resources

For more information on how to protect your law firm from cyber crime and fraud, visit the Take Five website

You can also read some of our recent blog posts for more on cyber crime:

• http://blog.tmgroup.co.uk/post/2-Lesser-Known-Cyber-Threats-Every-Conveyancing-Firm-Needs-to-Hear-About 

• http://blog.tmgroup.co.uk/post/How-to-Prepare-to-Defend-Your-Law-Firms-Reputation-in-the-Event-of-a-Cyber-Attack

• http://blog.tmgroup.co.uk/post/5-Reasons-Why-Your-Colleagues-Are-a-Bigger-Cyber-Risk-Than-Your-Clients

Have you told 5 people about #takefiveday?