FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Conveyancers and property lawyers
AI makes phishing emails and cloned voices more convincing, which raises the risk of completion money being sent to a fraudster. Whether the loss is met by PI, cyber cover or the firm itself depends on the policy terms and when the firm knew its email was compromised.
Part of: AI in Conveyancers and property lawyers
In short
Payment redirection fraud has long targeted conveyancing because large sums move on a known date. Generative AI removes the spelling mistakes and odd tone that used to give phishing away, and voice cloning can make a call-back sound genuine. The CLC Minimum Terms let insurers exclude losses from fraudulent use of electronic signatures or external email after the firm discovered, or should have discovered, the misuse (cl.5.15), while cl.8.13 affirms cover for listed computer and malware events. Cyber cover and crime cover may respond to parts of the loss that PI does not.
The basic fraud is familiar: a criminal intercepts or imitates an email between the firm, the client or the other side and changes the bank details for a deposit, completion monies or sale proceeds. The CLC's fraud and cybercrime hub warns about email interception, bank detail changes, fake CLC emails and bogus websites, and cites Law Society research that 1 in 5 firms were targeted by scammers. None of the CLC alerts is labelled as AI, but the CLC's ConveyancingTech Guide warns that conveyancing fraud is rising and becoming more sophisticated.
AI helps the fraudster in three ways. It writes fluent, well-timed emails in the style of the real sender. It can summarise a stolen mailbox to find the transaction stage and the right moment to strike. And voice cloning means a phone call to confirm details is no longer a guaranteed check if the number came from the email.
Firms hold client money and must protect it. The CLC's AI and Technology Guidance does not address fraud directly, but its security Principle (2) suggests two-factor authentication, limited access, regular cyber training for all staff, including senior staff, and its robustness Principle (3) asks for contingency and escalation plans if technology fails. For solicitor conveyancers, Code for Firms 2.1 requires effective systems and controls, and the SRA Misuse of AI warning notice expects safeguards around client data.
Illustrative scenario: a fee earner's mailbox is compromised. The fraudster uses AI to read the thread and sends the buyer a well-written email, in the fee earner's style, saying the firm's bank has changed. The buyer rings the number in the email signature and speaks to a convincing voice that confirms the new details. The deposit goes to the fraudster. A week later the fraudster tries the same trick on another client before the firm notices unusual mailbox rules.
The timing matters for insurance. The first loss happened before anyone knew the mailbox was compromised. The second happened after the firm should arguably have spotted the warning signs. Claims across multiple clients may also raise aggregation questions.
Under the CLC Minimum Terms, permitted exclusions include cl.5.13 (electronic documents), cl.5.14 (data corruption and viruses, with an exception for wholly independent third parties where transmission was inadvertent) and cl.5.15, which lets insurers exclude losses arising from fraudulent use of an electronic signature or external email after the insured discovered, or should have discovered, the misuse. Clause 8.13, the Cyber-Related Losses Affirmation, provides that indemnity is not restricted for listed computer, data and malware events.
For SRA firms, the permitted cyber and data protection exclusion must preserve cover for civil liability, including remediation under the Accounts Rules, and defence costs.
The result is that a client's claim for lost money may sit under PI, but a loss after discovery may be excluded on CLC terms, and the firm's own costs (forensics, notification, business interruption) usually belong to a cyber policy. Where the firm itself is tricked into paying away money, crime or social engineering cover may be relevant. See wire fraud and compromised email, social engineering and fund transfer fraud and cyber insurance for law firms.
Apex arranges PI for conveyancers. A broker can review how PI and any cyber cover fit together for payment fraud. See AI in conveyancing and chatbots and client updates.
Often in part. A client's civil claim may fall under PI, but CLC insurers may exclude losses from fraudulent use of external email after the firm discovered, or should have discovered, the misuse (cl.5.15). The firm's own costs usually need cyber cover.
Not if the number came from the suspect email. AI voice cloning means a familiar voice is no longer proof. Use a number from an independent source and a pre-agreed second channel.
It is the Cyber-Related Losses Affirmation. It provides that indemnity is not restricted for listed computer, data and malware events, so a cyber cause does not by itself remove PI cover for a civil liability claim.
Contact the banks immediately, preserve evidence, follow your incident plan and tell your broker so both PI and cyber insurers can be notified as required.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
