Cyber fraud, AI-enabled impersonation, conveyancing scams and the convergence of cyber, financial crime and professional liability risks for law firms, and their brokers and insurers.
Introduction: the rise of "Friday afternoon fraud"
In August 2026, the Guardian highlighted the continuing incidents of so-called "Friday afternoon fraud", a form of conveyancing fraud in which criminals intercept or spoof communications between solicitors, clients, and estate agents in order to divert funds to fraudulent bank accounts. The article reported that Report Fraud recorded 3,657 authorised payment diversion scams during the 2025-26 financial year, resulting in losses of £101 million. This included 140 property-related frauds, with an average loss of £78,393.
At first glance, these incidents appear to be straightforward cyber-crimes. One of the most difficult questions arising from these incidents, however, is not whether a fraud has occurred, but what type of insurance claim it is. One may instinctively regard payment diversion frauds, email compromises and client impersonation scams as cyber claims. However, some of the most significant losses ultimately become professional indemnity (PII) claims.
The distinction matters. It affects notification obligations, coverage positions, and, potentially, whether there is insurance available at all. For law firms, brokers, and insurers alike, understanding when a cyber fraud becomes a PII claim is, therefore, critical.
Why law firms remain attractive targets
The legal sector has become an increasingly attractive target for cyber criminals. Law firms hold confidential information, conduct high-value transactions, manage client money, and frequently operate under significant transactional pressure.
The position is reflected in the updated Solicitors Regulation Authority Sectoral Risk Assessment, published on 4 September 2026, which continues to assess money laundering risk within the legal sector as high. The SRA notes that the profession's involvement in high-value transactions, handling of client funds and creation of legal structures creates significant opportunities for criminal exploitation, if appropriate controls are not maintained.
Recent analysis of ICO data has suggested that data breaches in the UK legal sector increased by 39%, while phishing attacks remain one of the most common external threats facing legal practices.
The SRA's 2026 AML risk assessment: an important development
The SRA's latest risk assessment provides a useful framework for understanding how cyber fraud and professional liability may overlap. The assessment highlights concerns around:
- Conveyancing transactions
- Client account misuse
- Source-of-funds verification
- Supply-chain vulnerabilities
- Client due diligence
- Remote verification and digital onboarding
- Identity fraud and impersonation
Most notably, the assessment addresses emerging risks arising from AI-assisted impersonation and deepfake technology capable of undermining traditional verification processes. The SRA warns that firms should not assume that a person appearing on a video call is necessarily who they claim to be. Historically, law firms worried about forged passports and stolen documents. Today, firms may face:
- Compromised email accounts
- Synthetic identities
- Deepfake videos
- AI-generated voice impersonations
- Fraudulent payment instructions delivered through apparently genuine channels
Looking beyond the cyber attack
The starting point is to recognise that a cyber incident and a professional negligence claim are not mutually exclusive. A cyber-attack explains how the fraud occurred. A professional indemnity claim focuses on whether the solicitor's conduct contributed to the loss. The key question is often: Is the claimant saying "I lost money because a criminal deceived us", or are they saying "I lost money because my solicitor failed to act with reasonable skill and care"?
When blame shifts from the fraudster to the solicitor, the matter begins to enter PII territory.
Cyber fraud frequently gives rise to allegations that the solicitor failed to exercise reasonable skill and care in protecting client money or verifying instructions. In payment diversion cases, the complaint is often that the solicitor failed to verify bank details, failed to follow payment procedures or failed to safeguard client funds. In client impersonation cases, the allegation is typically that the solicitor failed to verify the client's identity adequately, failed to recognise warning signs or failed to make further enquiries before acting.
Claims typically involve allegations of negligence, breach of trust and the failure to comply with undertakings.
The common thread running through these claims is that the cyber incident merely provides the opportunity for the fraud. The claim itself focuses on the solicitor's conduct. The question is not what the fraudster did, but whether the solicitor failed to verify, investigate, question or protect. Once the focus shifts to those issues, a cyber incident has often become a professional indemnity claim.
The coverage challenge
One reason these claims are difficult is that they sit at the intersection of several insurance products. Potentially relevant policies may include:
- Professional indemnity insurance
- Cyber insurance
- Crime insurance
- Fidelity guarantee cover
- Directors' and officers' insurance, in certain circumstances
Different insurers may reach different conclusions regarding the true cause of the loss. Cyber insurers may argue that the claim arises from professional services. PII insurers may focus on the role played by criminal conduct. Crime insurers may contend that the circumstances fall outside their theft wording. As a result, some of the most complex coverage disputes arise not from uncertainty over what happened, but from disagreement about which policy should respond.
One of the challenges presented by cyber-enabled fraud is that the nature of the claim can change over time. A matter first reported as a cyber incident may subsequently develop into a professional negligence claim. Given that uncertainty, brokers should be cautious about viewing the loss through the prism of a single insurance product. Early notification to all potentially responsive insurers is often the best way to protect the insured's position and avoid unnecessary coverage disputes.
It is also important to recognise that not every cyber-related loss will fall within the scope of a law firm's professional indemnity cover. In particular, the Solicitors' Minimum Terms and Conditions are designed to respond to civil liability arising from the firm's professional services and are not intended to indemnify the firm for every loss flowing from a cyber incident. If a firm is defrauded out of its own money, rather than client money, or suffers business interruption, system outages, data restoration costs, incident response expenses, ransom demands, or loss of income following a cyber-attack, there may be no response under the firm's PII policy. Those exposures are more commonly addressed through standalone cyber insurance. For that reason, cyber and PII insurance should not be viewed as alternative products. They address different risks and, increasingly, need to be considered as complementary parts of a firm's overall risk transfer programme.
Practical lessons for law firms
Law firms should view cyber fraud prevention as both a cyber-security issue and a professional risk management issue. Particular attention should be paid to:
- Verification of bank details through independent channels
- Mandatory call-back procedures
- Dual authorisation for significant payments
- Escalation procedures for unusual instructions
- Staff training on social engineering attacks
- Clear documentation of verification steps
- Regular review and testing of risk assessments and controls
Importantly, firms should ensure that brokers and insurers are involved at an early stage whenever a noteworthy cyber incident occurs.
Conclusion
Not every cyber fraud is a professional indemnity claim. Equally, not every cyber fraud remains merely a cyber claim. The dividing line is often surprisingly simple. A cyber fraud becomes a PII claim when the focus of the loss shifts from the actions of the fraudster to the conduct of the solicitor.
Once allegations emerge that a law firm failed to exercise reasonable skill and care, failed to protect client funds, failed to verify instructions or failed to follow proper procedures, professional indemnity considerations move to the forefront. For law firms, that means robust controls and early notification. For insurers, it requires careful causation analysis. For brokers, it means ensuring that cyber, crime and PII programmes are placed and reviewed as a single, coordinated risk solution, rather than a collection of disconnected policies.
In an era where cyber criminals increasingly exploit weakness in verification processes and payment controls, the most difficult question is often not whether there has been a fraud, but whether the law firm's response to it will itself become the claim.
