A story we hear too often
The trust-account wire that was one phone call from leaving
the managing partner of a 14-attorney firm
Tom runs a 14-attorney firm on the fifth floor of a building on Dearborn. Real estate, estates, a growing personal-injury practice. The trust account is the thing he checks before he checks his own.
On a Wednesday the bookkeeper brings him a disbursement: $186,000 in settlement funds to a client, wire instructions attached, approved in an email from the associate on the matter. The associate is in a deposition. The email came from her address at 7:12 a.m., which is not when she writes emails.
This is where the bar’s disciplinary summaries begin. In that version the wire goes, the client calls Friday, the money is in a third bank, the firm makes the client whole from partner capital, and the state bar opens a file under Rule 1.15 while the carrier reads the social-engineering exclusion aloud.
In Tom’s version, the firm’s rule is that trust disbursements are confirmed by voice with the attorney and the client, and the bookkeeper waits. The associate comes out of the deposition at noon and has never seen the email. Her mailbox had been forwarding to an outside address for three weeks; the engineer on watch had already flagged it that morning and was waiting for her to call back.
The email came from her address at 7:12 a.m., which is not when she writes emails.
What changes the ending
- Voice confirmation with the attorney and the client on every trust disbursement, written into the procedure (CIS Control 14, Security Awareness and Skills Training)
- MFA on every attorney and staff mailbox, with forwarding rules and foreign logins watched (CIS Controls 5 and 9)
- A rehearsed response plan that satisfies ABA Opinion 483: stop, restore, notify (CIS Control 17, Incident Response Management)