On September 23, the Iowa State Bar Association shared an attempted trust-account scam reported by one of its members.

A supposed client contacted the attorney through Justia’s lawyer directory and asked for help preparing an agreement to sell a tractor to an Iowa construction company. The firm received a $270,500 cashier’s check as the down payment. The client then pushed the attorney to wire $230,500 back out for “final inspection, service, and insurance.”

The check came from a real account at the bank named on it. It had also been canceled after it was mailed.

The attorney called the issuing bank before sending the wire. The attorney also called the supposed buyer, which said it knew nothing about the transaction and was not buying a tractor.

Those two calls kept a convincing new matter from becoming a six-figure loss.

Why the check looked legitimate

This scam had more supporting detail than a random email asking for money. The prospective client came through a real lawyer directory. The proposed buyer was an active Iowa corporation. A broker supposedly represented the buyer. The cashier’s check came from an actual bank account.

Each detail made the matter easier to accept at face value. None proved that the person contacting the firm had authority to act for the companies named in the transaction.

The request to return most of the deposit was the dangerous step. Once the firm sent $230,500 by wire, the money could leave before the original deposit failed. The canceled check would then be removed from the account, leaving the firm responsible for the outgoing wire.

This reaches the same result as business email compromise without requiring a compromised account. The criminal manufactures a transaction and tries to place the law firm between a bad deposit and an irreversible payment.

Available does not mean valid

Banks often make deposited funds available before they can fully determine whether a check is good. The Federal Trade Commission warns that seeing the money in an account does not prove the check is valid. A fraudulent check can take weeks to uncover.

That distinction can be hard to see in online banking. The deposit appears and the available balance increases, but availability is a banking timeline. It is not verification of the transaction, the client, or the check.

A firm’s policy should not treat the available balance as permission to disburse. Staff need to know what confirmation the bank can provide, which deposits remain subject to return, and who has authority to release trust funds. The exact accounting and legal requirements belong with the firm’s bank, accountant, and legal-ethics advisers. The operational rule is simpler: do not wire money merely because the deposit appears in the account.

The verification calls mattered

The attorney did not call a number supplied by the prospective client. The firm contacted the bank that issued the check and the company supposedly buying the equipment.

That separation is important. A scammer can provide a phone number answered by an accomplice, build a convincing website, or use an email address that resembles the real company’s domain. Verification works when the firm obtains contact information through an independent source and reaches a person who is already known or can be confirmed.

For the bank, use the institution’s official website, an established banking contact, or another trusted record. Do not rely only on a phone number printed on a questionable check.

For the parties, call a known contact or the organization’s publicly listed main number. Ask to be transferred to the person responsible for the transaction. An active corporate registration proves that a company exists. It does not prove that the person in the firm’s inbox represents it.

We recommend the same approach when wire instructions change by email: stop and confirm through a channel that did not come from the message requesting the payment.

Build friction into outgoing wires

Payment procedures are supposed to slow down unusual transactions. That can feel inefficient when a new client insists that timing is critical. In this case, the urgency was part of the pressure.

A written wire process should address:

Whether funds must be verified before any related disbursement
Who independently confirms the client, counterparty, and purpose
Which trusted number is used for callback verification
When a second employee or attorney must approve the wire
How the firm handles requests to return part of a recent deposit
What evidence is retained with the matter and accounting record

The approval should include the destination account, amount, and reason for payment. A second approver who only clicks “approve” without seeing those details adds little protection.

The firm should also decide what happens when the requester objects to the delay. A legitimate client may be frustrated. That does not justify skipping the process. Staff should know that management will support them when they pause a transaction that does not fit the firm’s controls.

Technology can support the process

This fraud was stopped by judgment and verification, not malware detection.

Online banking should use multifactor authentication and separate user accounts rather than shared credentials. Wire permissions should be limited to the people who need them. If the bank supports dual approval, dollar limits, new-payee holds, or alerts for outgoing transfers, the firm should configure those controls deliberately.

The matter-management or accounting system should retain the approval record. Document who confirmed the bank, who called the counterparty, which number was used, and who released the payment.

Security awareness training should include this scenario too. The warning sign was not a suspicious attachment. It was a new client who deposited more than the immediate expense and wanted most of it wired back quickly.

Test the policy before the next request

Ask the people who open matters, deposit checks, and release wires to walk through this exact scenario.

Who calls the bank? Where does that person find the correct number? Who contacts the buyer? What does the firm require before disbursing recently deposited funds? Who can stop the wire? Where is the approval saved?

If the answers depend on whoever happens to be working that day, the firm has a habit, not a control.

The ISBA member avoided the loss because the firm checked the payment and the transaction before moving the money. That is the procedure worth copying.

If your firm’s payment controls depend on email and memory, Artech can help document the workflow and configure the identity, approval, and audit controls that support it.