An attorney who
takes reasonable computer security precautions has no ethical responsibility to
replace stolen client money if a hacker breaks into the network and steals
trust account funds using a scam, according to an ethics opinion by the North
Carolina State Bar.
The hacking hypothetical is one of seven scenarios
involving stolen client funds addressed in the Oct. 23 ethics opinion. A prior North Carolina
opinion addressed an attorney’s duties to maintain computer security. Attorneys
must educate themselves about the security risks of online banking, implement
safety practices such as strong password practices, use encryption and security
software, hire a technology consultant for advice, and ensure that staffers
assisting with trust-account management receive training and follow security
measures.
On the other hand, attorneys who don’t take reasonable
precautions may have an ethical responsibility to replace stolen client funds
if the failure is the proximate cause of trust account theft, the opinion says.
Attorneys may also have a responsibility to replace stolen
client funds in a different scenario involving a hacked email and a lack of
reasonable care. In that hypothetical, a hacker gains information about a real
estate transaction by hacking the email of the attorney or other parties such
as the realtor or the seller. The hacker then crates a “spoof” email address
that is similar to that of the realtor or seller. The scam email instructs the attorney
to wire funds to an identified account, despite previous instructions to mail
the check. The attorney wires the money without first contacting the seller by
telephone. The has an ethical
responsibility to replace the funds, the opinion says, because the attorney
failed to take reasonable security measures such as contacting the seller or
confirming the seller’s email address. The attorney could be reimbursed if the
bank is found to be legally responsible or insurance covers the stolen funds.
Nevertheless, under all circumstances involving third-party
theft of client funds, the attorney owes duties to clients whose money was
stolen, including notifying the clients of the theft and helping them identify
ways to cover the losses.