Fraud warning after ‘sophisticated’ attempted cyberattack on Irish law firm

Law firms have been warned to stay vigilant following an attempted cyberattack on a solicitor’s firm which used a “sophisticated approach”.
The Law Society of Ireland said today that it had been notified of an attempted attack similar to three previous attacks in August and October 2024.
The fraudster purported to be calling from the practice’s bank, AIB, and claimed that there was an attempted fraudulent payment on the client account.
The caller, who was said to speak with an Irish accent and followed the bank’s normal procedure, requested that the solicitor follow a URL to allow him to help resolve the issue.
At this point, the solicitor said they wished to contact the bank to verify the call and requested the caller’s name and direct dial.
The fraudster said that bank practices prevented him from disclosing his direct dial number but that he would hang up and phone again from the bank’s main fraud phone number, and that the solicitor could check the phone number to verify.
The fraudster did so and the phone number displayed was that of the bank’s fraud number.
The solicitor separately contacted the bank, who confirmed that this was an attempted fraud and that fraudsters are able to mirror bank phone numbers. The solicitor ended all communications with the fraudster.
The bank confirmed to the solicitor that, if they had followed the URL, they would have allowed the fraudster access to their system.
The Law Society said: “Solicitors are urged to remain vigilant and to end any suspicious call and contact their bank through a known phone number to verify the bona fides of the caller. Solicitors should never go to a website or click on a link that is sent to them, nor should they allow anyone to take remote access of their computer.
“In addition, they should never give anyone a one-time code from the online banking app, no matter who they say they are or why they say they need the code.”