Tuesday, November 24, 2015

Attorney Responsibility for Trust Account Hacking

An attorney who takes reasonable computer security precautions has no ethical responsibility to replace stolen client money if a hacker breaks into the network and steals trust account funds using a scam, according to an ethics opinion by the North Carolina State Bar.
The hacking hypothetical is one of seven scenarios involving stolen client funds addressed in the Oct. 23 ethics opinion. A prior North Carolina opinion addressed an attorney’s duties to maintain computer security. Attorneys must educate themselves about the security risks of online banking, implement safety practices such as strong password practices, use encryption and security software, hire a technology consultant for advice, and ensure that staffers assisting with trust-account management receive training and follow security measures.
On the other hand, attorneys who don’t take reasonable precautions may have an ethical responsibility to replace stolen client funds if the failure is the proximate cause of trust account theft, the opinion says.
Attorneys may also have a responsibility to replace stolen client funds in a different scenario involving a hacked email and a lack of reasonable care. In that hypothetical, a hacker gains information about a real estate transaction by hacking the email of the attorney or other parties such as the realtor or the seller. The hacker then crates a “spoof” email address that is similar to that of the realtor or seller. The scam email instructs the attorney to wire funds to an identified account, despite previous instructions to mail the check. The attorney wires the money without first contacting the seller by telephone. The  has an ethical responsibility to replace the funds, the opinion says, because the attorney failed to take reasonable security measures such as contacting the seller or confirming the seller’s email address. The attorney could be reimbursed if the bank is found to be legally responsible or insurance covers the stolen funds.

Nevertheless, under all circumstances involving third-party theft of client funds, the attorney owes duties to clients whose money was stolen, including notifying the clients of the theft and helping them identify ways to cover the losses.