Introduction

1. 1. Law firms and clients are frequently targeted by cyber criminals.

   2. Methods of attack can vary greatly, and are constantly evolving. Common attack vectors are known to include attempts to:

      1. steal money — including misppropriating funds transferred to or from trust accounts of law firms;
      2. gain access to sensitive information by compromising email accounts, computer systems and mobile devices;
      3. intercept emails, SMS, instant messages and other communications;
      4. use publicly available information (such as information published in government registries and databases);
      5. send false, misleading, fraudulent or unsolicited correspondence and fraudulent "invoices" or requests for payment;
      6. request payments for unofficial or illegitimate services (such as trade mark 'renewal', 'publication' or 'registration' services).

   3. We take our own security and that of our clients very seriously, and we regularly engage in learning initiatives to improve our cybersecurity.

   4. The purpose of this Policy is to outline the measures and procedures that we adopt to mitigate the risk of fraudulent payment transactions.

   5. We will review and update this Policy in line with industry advice and best-practice standards as they develop over time.

Payment Policy

1. Security Measures

   1. We have adopted a range of security measures to reduce the risk of fraudulent transactions.

   2. In particular, we will:

      1. never contact you by email only to advise a change of bank account details, payment arrangements or other contact details;
      2. require additional telephone, or in-person verification of the payee's bank account details prior to making any trust account payment, refund or funds transfer to you or a third party;
      3. require additional telephone or in-person verification for any change of bank account or contact details.

   3. Credit Card payments are processed by an external payment gateway supplier. We do not store credit card details, but may receive and store partial cardholder information for transaction verification purposes.

2. Payments we make to third parties (including clients)

   1. Prior to actioning any outgoing payment or transaction (whether or not the transaction involves trust account funds and regardless of the amount of the transaction), we reserve the right to:

      1. seek and obtain independent verification of payment details and client instructions; and
      2. decline to action any transaction if the independent verification is not met to our satisfaction.

   2. In accordance with industry guidelines, for any outgoing payment or transaction of AU$10,000 or above (or equivalent), we will require as a minimum separate telephone verification of all transaction details prior to actioning the transaction.

3. Requests for Changes to Contact Details or Payment Information

   1. We reserve the right to require independent verification of any request to change contact details or payment information. This may include telephone or in-person verification.

   2. We will never contact you by email only to advise you of a change to our bank account details or payment arrangements or other contact details. If you receive such a notification, we strongly recommend that you contact us as soon as possible via an independently verified telephone number.

Your security

1. 1. We strongly recommend that all third parties (including clients) consider adopting the following measures to enhance their own cybersecurity:

      1. Do not pay any money or action any transfer of funds (sending, depositing, paying or transferring) without first telephoning the apparent sender to verbally confirm the account number, details and amounts by reading out and reading back the payment details (eg BSB and account number, or other specific payment details where applicable) and confirming any payment instructions.

      2. Do not contact us using a telephone number, email address or other details listed in any communication that asks for money or includes payment details without first checking the telephone number, email address or other details against our website.

      3. Do not action any changes of bank account details or contact details, unless you have contacted us by telephone (using a separately verified phone number) to verify the details.

      4. Be suspcious of any unexpected communications (email, SMS, telephone, mail, instant message, etc) — especially if payment is requestedor the communication asks you to open a document or click a link to access a document.

         Examples of suspicious activity may include:

         • 'invoices' or requests for payment from third parties in relation to intellectual property rights, business names, domain names and companies;

         • offers to 'register', 'advertise', 'publish' or 'renew' your trade mark, business name or domain name;

         • notifications that another person has applied to 'register' your trade mark, business name or domain name in another jurisdiction.

         We recommend that you treat any such communications with caution and seek independent advice before acting on them - even if the communication appears to be from an official source or seems convincing.

         Read our post, Trade Marks - Don't Get Scammed, for more information about trade mark scams.

      5. Do not open attachments, links or downloads in any email, SMS message, instant message or other communications without first contacting the sender (using a separately verified telephone number) to check legitimacy.

      6. Give these same warnings to anyone else may also be involved in transferring money (eg your accountant, bookkeeper, accounts payable staff, agent, broker, family members or any other third party payers).

      7. Implement robust IT and cyber security measures, including:

         1. ensuring all devices, operating systems, software and apps are regularly updated with the latest available security patches;

         2. implementing 2-Factor Authentication (also known as Multi-Factor Authentication or Multi-Step Authentication) wherever possible and especially on all critical accounts including email, social media and bank accounts;

         3. using unique, complex passwords for each of your accounts - Do not re-use the same password or similar passwords across multiple accounts;

         4. using a reputable password manager app or browser extension to generate and securely store unique passwords for each account;

         5. implementing verification protocols for all significant payments; and

         6. regularly engaging in cyber security awareness training and education.

   2. These measures are by no means exhaustive, and we recommend that you consider taking professional advice in relation to your particular security needs.