We lawyers are a cautious if not downright cynical breed betimes. We are trained to be and indeed paid to be – as protectors of the interests of the clients we serve. So why are lawyers one of the most popular targets for email scams?
One would think the scammers would find a more lucrative hunting ground elsewhere than amongst a professional class attuned to sensing deception and skullduggery?
Well not necessarily and the reason why might surprise…
Firstly let’s look at a couple of examples of scam emails which are slipping into Irish solicitors’ inboxes with increasing frequency of late:
1. The unpaid divorce settlement aka Collaborative Law Agreement Scam
This is an actual email, variants of which have been sent to solicitors for years, invariably from a Ms Zaira Hoshiko;
Dear Counsel ,
My name is Zaira Hoshiko. I am a contacting your firm in regards to a divorce settlement with my ex husband (Allen Hoshiko) who resides in your jurisdiction.I am currently in Japan.
We had an settlement agreement for him to pay $950,500.00 plus legal fees. He has only paid me $251,500.00 since . I am hereby seeking your firm to represent me in collecting the balance from him. He has agreed already to pay me the balance but it is my belief that a Law firm like yours is needed to help me collect this payment from my ex -husband or litigate this matter if he fails to pay as promised.
2-1-2 Osaki, Shinagawa-Ku Tokyo
2. The Commercial Debt Collection Scam
This email is usually sent by a ‘Dave Desmond’ with a UK phone contact:
+44 704 573 4302
Request a callback?
Attn:- Learned Counsel,.
China Textiles (Shenzhen) Co., Ltd requires your legal representation for our delinquent customers in your respective market region as we have several outstanding payment from debtors.Please outline in your reply all official requirements from your end.Call me for more discussion and details of the said delinquent account between 7am-5pm
Akismet Spam Check: passed
Sent from (ip address): 22.214.171.124 (126.96.36.199)
Date/Time: March 5, 2013 4:59 pm
What is the aim of these lawyer email scams?
Well it’s money ultimately and obviously. The scam process essentially involves the following;
1. ‘Hiring’ a solicitor to chase down the delinquent husband/commercial creditor who is in reality an accomplice of the scammer
2. Comforting documents of engagement are often signed with solicitor albeit notwitstanding the ‘client’ gives his/her telephone number, this is rarely a succesful channel of communication due to ‘location time differences’
3. The ‘deliquent creditor’ readily pays up upon receipt of a solicitor’s letter and sends in a cashier’s bank cheque.
4. The solicitor sends the ‘client’ the recovered monies due minus his own fee without him or his bank realizing in time the client cheque will bounce
Why are the above examples obviously scam emails?
Google is your friend! At first blush both of these email enquiries are not too remarkably different from genuine enquiries which a solicitor might receive via his/her website.
However, if it smells a bit funny it often is and a cursory Google search on “Zaira Hoshiko” and/or “Dave Desmond” will yield a plethora of results from anti-scammer sites detailing their nefarious activities over the last few years.
Their emails are generally so similar in all instances of other lawyer reports thus further scenting their trail online when it comes to researching their bona fides.
So the big question – Why are these scammers so apparently naive?
Well the answer is naive like a fox it seems. It is not in fact stupidity that makes them operate in such a way i.e. using the same alias and almost identical messages for years.
They are using a technique known in scam circles as the clueless filter (or analogously in sales & marketing parlance it is called shrinking the sales funnel).
This is a technique which was exposed by Microsoft researcher, Cormac Herley who was able to explain why the similar, so-called Nigerian 419 scam, was so effective whilst seeming ridiculously ham-fisted in approach.
In his commentary, neuroscience marketer Roger Dooley put it thus;
In other words the lawyer scammers are leaving a wide scent trail – even risking ruling out potential lawyer victims early on, reasoning that a lawyer who has the cop-on to run a precautionary Google check is not a good ‘mark’ (in conman parlance).
Ergo their work output involved in raiding the coop is more efficient with a smaller number of headless chickens than a larger group with wary birds.
Whilst lawyer scam emails are moderately less ludicrous than the “$35m transfer into your account from the Bank of Lagos” type of emails, they are still dumb enough to ensure that any lawyer who falls for one may be a good mark.
In fairness to those who have already been duped however, it is commonplace for solicitors to be dealing with the transfer of large sums in and out of client accounts. Such activity is unusual for the layperson so the alarm trigger of ‘something being too good to be true’ may be more surpressed in a lawyer than a layperson once the scam advances to the latter stages.
5 tips for solicitors for identifying possible lawyer scam emails even when Google searches are inconclusive
1. They begin with a generic but arcane greeting form e.g. ‘My Learned Counsel’
2. Concerns debt collection of some sort from an out-of-jurisdiction client
3. The debtor is identified and is said to have form in at least part-paying the debt hitherto.
4. The prospect supplys phone number but prefers subsequently to deal by email.
5. The IP address in the email header does not originate in the same location that the sender purports to be.* (See example below)
*So apparently unsophisticated are their scamming efforts, is that they glibly allow their IP address location to be identifiably determined (via a reverse IP lookup) as not originating from where they purport to be. In the case of ‘Dave Desmond’ above, his IP location (188.8.131.52 ) originates in Germany although he purports to be in the UK
184.108.40.206 IP address location & more:
IP address [?]:
220.127.116.11 [Whois] [Reverse IP]
IP country code:
IP address country: