Why solicitors say bank details never change by email

UK Finance's Annual Fraud Report 2026 puts losses to invoice and mandate scams at £41.3 million in 2025, across 2,305 cases. That's the category where someone means to pay a real payee, a builder, a supplier or a conveyancing solicitor, and a criminal persuades them that the bank details have changed. The total was the lowest UK Finance has recorded. The part that matters for law firms is underneath it: losses on personal accounts went up 24%, to £13.3 million, and UK Finance's own description of the scam names "criminals targeting consumers posing as conveyancing solicitors".

That's why law firms tell clients, at the start of a matter and again before every payment, that their bank details will never change by email. A text is a useful place to repeat it, provided the text itself doesn't become the next thing a fraudster copies.

What the fraud figures show

UK Finance collects fraud data from its members, the banks and payment firms. Its 2026 report covers 2025. Authorised push payment fraud, where the victim is tricked into sending the money themselves, rose 19% to £576.4 million. Inside that total, UK Finance groups four scam types as "malicious redirection", where "an individual intends to make a payment to a legitimate payee, but the funds are redirected to a third party". Its own example is "an individual intending to send funds for a house purchase deposit to their solicitor but instead receiving instructions from a criminal third party with new account details".

Invoice and mandate fraud is the second largest of the four. UK Finance says it "often involves the criminal either intercepting emails or compromising an email account", so the genuine conversation and the fake one end up in the same inbox.

The six-year series shows a slow fall in total losses, from £68.8 million in 2020 to £41.3 million in 2025, and cases down from 4,721 to 2,305. Most of the money is lost from business accounts (£28.0 million in 2025, 68% of the total), because businesses make large genuine payments often enough that a fake one is hard to spot. Personal losses are the smaller line, but they turned up last year after four years of falling: 1,088 cases and £13.3 million. Dividing one by the other gives an average loss of about £12,200 a personal case.

UK Finance also reports how much came back. Across all invoice and mandate cases, £20.0 million (48% of losses) was returned to victims in 2025.

What the SRA has seen

The Solicitors Regulation Authority's Risk Outlook report on cybercrime, published on 1 June 2022, said that "phishing and email modification frauds" made up "half of all the cybercrime reports we receive", and that "over 80 percent of all the cybercrime reports we received in 2021 involved email". It added that "although conveyancing remains a frequent target, due to the large funds involved, criminals are broadening their attacks to other fields as well", and gave a probate case as its example: an executor solicitor, an email chain started from the client's genuine address, and a substantial transfer to an account the criminal controlled.

The SRA's case studies on information security tell the conveyancing version step by step. In one, a buy-to-let purchaser emailed her solicitors the day before sending her money to check their bank details. She got two replies a few minutes apart, both apparently from the firm. The second gave an account "in the name of XYZ Solicitors but with a different bank" and explained the firm was "having issues with their usual bank". The fraudsters, who had got into the firm's email server, deleted the follow-up emails on both sides so nobody noticed for three days, by which time the money had gone abroad. Her bank wouldn't refund her because it had acted on her instructions. In another case study, a firm that lost money to a fake supplier "instituted a policy of confirming requests to change bank account details by means of a telephone call to a known number".

The cloning hasn't stopped. The SRA's scam alerts page adds new warnings most working days, and on 13 October 2026 it published one about emails "in relation to conveyancing matters" that misused a genuine firm's name and address, sent from two lookalike domains and giving a different phone number. Its advice in every such alert is the same: check "the authenticity of the correspondence by contacting the law firm directly by reliable and established means".

Who carries the loss now?

Since 7 October 2024, the Payment Systems Regulator (PSR) has made reimbursement of authorised push payment fraud mandatory for payments made by Faster Payments or CHAPS between UK accounts. The protection covers individuals, microenterprises and charities. Victims should report within 13 months, can expect reimbursement within five business days in most cases, and the PSR set "the maximum amount of money people can claim" at £85,000, which it says covers over 99% of claims. Firms may apply an excess of up to £100, and nobody is reimbursed if they were complicit or "grossly negligent".

That's real progress for most scam victims. It's less comfort when the payment is a house deposit or the proceeds of a sale, which can run well past £85,000, and the PSR's own page says that above the cap the route is the Financial Ombudsman Service, case by case. For a buyer moving a deposit, stopping the payment going astray matters more than the refund rules.

Where a text helps

The scam works because the email channel is the one that's been compromised. A message on a different channel, from a number the client saved when they instructed you, isn't in that inbox. A fraudster who has read every email in the matter still doesn't have the text thread.

Texts have their own weakness, which is that a sender name can be faked. Our post on sender ID spoofing and the MEF registry covers how often that happens and what Ofcom is doing about it. So a firm's texts should never carry what a fraudster would want to change. No sort codes, no account numbers, no "please use this account instead". The text's job is to repeat a warning and point the client back to a number they already hold, the one on the client care letter, never a number given in the message itself.

A few habits follow:

• Text from one UK mobile number for the whole matter, and tell the client at instruction that it's the firm's number.
• Repeat the warning at the moments money moves: before the deposit, before completion, and whenever the firm receives a request to change where money goes.
• Make every text answerable, so a client who has had a strange email can reply "is this you?" and reach a person. A text sent from a sender name can't be replied to.
• Never put bank details in a text, in either direction, and tell clients you won't.

The texts that carry the warning

Written for a made-up firm, Calder & Webb, each in one part. At instruction:

Calder & Webb: welcome. Our bank details are in your client care letter and never change. If an email or text says otherwise, call the number on the letter.

Before the deposit is due:

Calder & Webb: your deposit is due to us by Thu 26 Nov. Use only the bank details in your client care letter. We will never send new details by email or text.

On receipt:

Calder & Webb: we've received your deposit today, thank you. If anyone asks you to send money elsewhere, call us first on the number in your client care letter.

On completion day, for a seller:

Calder & Webb: completion is confirmed for today. Your sale money will go to the account you gave us at the start. We will not ask you for new bank details.

And the one a firm hopes never to send, when an email arrives asking to redirect the money:

Calder & Webb: we've had an email asking to change where your sale money goes. Did you send it? Please call Priya now on the number in your client care letter.

None of these contains anything a criminal could use, and each one gives the client a reason to pick up the phone before a payment. They also leave a timestamped record that the warning was given, which is worth having if a payment does go astray.

The receipt text earns its place for a less obvious reason. In the SRA's buy-to-let case, three days passed between the client sending her money and anyone noticing it hadn't arrived, because the fraudsters were deleting the emails that would have given them away. A client who knows the firm always texts on the day funds land, and hasn't had that text by the evening, has a reason to ring the next morning.

What a client should do if a message asks them to pay somewhere new

The advice from the regulators is short, and it's worth putting in the client care letter as well as in texts. The SRA's alerts tell people to check correspondence "by contacting the law firm directly by reliable and established means", which in practice means a phone number from the letter or the firm's own website, never one in the suspicious message. The PSR tells consumers to "pay attention to warnings from your bank", including the name check it calls Confirmation of Payee, and to "take a moment to pause and think before sending money".

If money has already gone, the PSR's instruction is to "contact your bank immediately". The bank runs the reimbursement claim, and the PSR asks victims to report the details to the police or let the bank do it for them. The firm should hear about it the same day too, because if the firm's own email has been compromised, other clients' matters are at risk. The SRA said in its 2022 report that it would "urge all firms affected by cyber-attacks" to report them to it.

Setting it up in a firm

The completion text in particular needs to go from whoever is handling the matter that day, so the number can't live on one fee earner's phone. CaptiFi Connect gives a firm a UK mobile number with a two-way inbox and team logins with roles and two-step sign-in, so a client's "did you send this?" reaches whoever is in the office. Sender names on our service are reviewed by staff before use, though for these texts a number the client can reply to is the better choice. The sender ID guide explains the difference.

The SRA's 2022 report put it as an expectation that criminals will "continue to seek easier targets". A client who knows that your bank details never change, and has been told so by text at every payment, is a harder one.