Notaires, lawyers and accountants: the four exposures where client money moves
These firms move other people's money on dates everyone knows in advance, and they agree the details by email. Their names carry authority, which is why fraudsters borrow them: one email with new bank details, from a forged, lookalike or hacked address, is enough. Courts and ombudsmen now ask what the firm did to prevent it.
French notarial offices, about 7% of the profession, were hacked from December 2022, with €35 to €40 million diverted according to ANSSI, France's national cybersecurity agency, as reported by Le Monde in September 2026.
Journal de l'économie, 4 Sep 2026of the cyber incidents reported to the SRA, the regulator of solicitors in England and Wales, were email modification fraud: emails intercepted and altered, for example to change bank details. The SRA said so in 2020.
SRA, 23 Nov 2020accounts taken over by someone else were reported to the Dutch data protection authority (AP) in 2025, up from 607 in 2024, almost always after phishing: a fake message that tricks someone into giving away their password.
Autoriteit Persoonsgegevens, 8 Jul 2026What each one looks like in your business
Email in your name
The completion money is due on Friday. Your client receives an email that looks like yours, logo and signature included, saying your bank details have changed. If it forges your exact address, the right email settings stop it: an enforced DMARC policy, the setting that tells mail servers to put fakes in spam or refuse them. If it comes from a lookalike domain (an address one letter off yours) or from your own hacked mailbox, those settings cannot help: two-step login (a code from your phone as well as the password) and a rule that clients call a number they already have are what stop it.
- Email modification was the most common cyber incident reported to the SRA, 68% of reports in 2020, and the SRA tells firms to tell clients they would never change bank details by email (SRA, 23 Nov 2020).
- Notaires de France, the French notaries' national body, say reports of fake RIBs are "en forte augmentation" (rising sharply), particularly in property (Notaires de France, 6 Sep 2024). The CNB, the national council of French avocats, says most avocats who fall victim have no email address on a professional domain of their own, the name after the @ (CNB, Oct 2023).
- Courts weigh precautions: the Dutch Supreme Court (Hoge Raad) said that how far each side guarded against someone impersonating it can decide who bears the loss (Hoge Raad, 28 May 2021).
Tracking before consent
A family law firm runs an advertising pixel (a small piece of code from an ad platform that records each visit) on its divorce and "book a consultation" pages. If it starts before the visitor answers the cookie banner, the ad platform learns that this browser read about divorce, and when, before anyone agreed to anything.
- The cookie rules, under which most tracking needs the visitor's yes first, apply to these firms like anyone else. We found no regulator decision against a law, notarial, bailiff or accounting firm for cookies in France, the UK or the Netherlands.
- For avocats, professional secrecy covers every medium, "voie électronique" (email and online) included, and extends to clients' names and the lawyer's diary (article 2.2 of the RIN, the profession's national rules) (CNB, updated 5 Nov 2026). Whether an ad pixel can breach that secrecy has not been decided.
- Since 14 April 2026 the CNIL, France's data protection regulator, applies the same consent rule to tracking pixels in newsletters (the code that reports when an email is opened), with a narrow exemption for measuring whether emails arrive (CNIL, 14 Apr 2026).
Customers with disabilities
A client who is blind is sent the client care letter as a scanned PDF to sign, then asked to book a first appointment through a form whose fields have no labels. The screen reader (the software that reads the screen aloud) finds nothing it can read, and the client has to ask someone else to read confidential papers aloud.
- The European Accessibility Act, the EU law that since 28 June 2025 requires many online services to work for people with disabilities, does not list legal, notarial, bailiff or accounting services. A firm comes within it only if consumers can conclude a contract on its site or app, for example book and pay for a service, and microenterprises (fewer than 10 staff and no more than €2 million in annual turnover or balance sheet total) are exempt (EUR-Lex, 17 Apr 2019).
- In the UK the Equality Act 2010 applies to every service provider: reasonable adjustments (reasonable changes so that disabled people are not put at a disadvantage) include giving information in an accessible format, and the duty is owed to disabled people generally, before anyone asks (Equality Act 2010, checked 8 Nov 2026; Equality Act 2010, checked 8 Nov 2026).
- In the Netherlands the Wgbh/cz, the law on equal treatment of disabled and chronically ill people, applies to anyone offering services in the course of a profession, with a duty to make effective adjustments unless they are disproportionate (Wet gelijke behandeling op grond van handicap of chronische ziekte (Wgbh/cz), version from 1 Jan 2026).
Payment and site security
An accounting practice takes fee payments on its website, and staff reach the mailbox and client files from home with a password alone. One phishing email collects a password. Someone else can now read clients' tax files and send payment instructions from the firm's real address.
- The ICO, the UK's data protection regulator, fined Tuckers Solicitors £98,000 after ransomware (software that locks a firm's files and holds them to ransom) put court data on the dark web. It singled out missing two-step login (multi-factor authentication), late security updates and stored data that was not encrypted (Legal Futures, 10 Mar 2022; NCSC, 22 Jun 2023).
- ANSSI counted at least a dozen French law firms hit by ransomware since 2017, at least seven through the outside company that ran their IT (CERT-FR (ANSSI), 27 Jun 2023). In the Netherlands, ransomware at one IT supplier took 96 notarial offices offline in 2021 (KNB, Jun 2021).
- A firm that takes fees by card on its own pages also carries the card industry's security rules (PCI DSS, set by the card companies and applied through its contract with its bank) on the outside code its payment pages load (Deepstrike, 4 Nov 2026). A passive scan, which reads only what any visitor can see, shows the certificate behind the padlock, the security settings the site sends to browsers (its headers) and that outside code; two-step login and updates need the firm's own confirmation.
Does the European Accessibility Act apply to you?
Usually not: the Act does not list legal, notarial, bailiff or accounting services, and reaches a firm only if consumers can buy from it online and it is not a microenterprise.
The Act lists the services it covers: electronic communications, access to audiovisual media, parts of passenger transport, consumer banking, e-books and e-commerce. Legal, notarial, bailiff and accounting services are not among them. The one route in is "e-commerce services": services provided at a distance, through websites and apps, at a consumer's request, with a view to concluding a consumer contract, and recital 43 (one of the explanatory paragraphs at the start of the Act) applies this to the online sale of any product or service. Microenterprises providing services are exempt: fewer than 10 staff and no more than €2 million in annual turnover or balance sheet total (EUR-Lex, 17 Apr 2019). We found no official guidance applying the definition to these professions.
Likely in scope
- A firm that sells a fixed-fee service, a paid online consultation or a document to consumers through its own site or app, with 10 or more staff or more than €2 million in turnover and balance sheet total.
- In that case, the part of the site where the consumer chooses, books and pays.
Likely outside it
- A microenterprise: fewer than 10 staff and no more than €2 million in turnover or balance sheet total.
- A firm that serves only businesses.
- A brochure site with a contact form, or a client portal used after the engagement letter is signed on paper.
In the UK the Act is not law, but the Equality Act 2010 applies to every firm, whatever its size: a service provider must not discriminate and must make reasonable adjustments (Equality Act 2010, checked 8 Nov 2026). WCAG, the international checklist for accessible websites, is not itself a legal requirement for a private firm; it is the usual yardstick for showing the adjustments were made.
Our reading of the directive and the regulators' guidance, not legal advice. If your case sits close to the line, ask a lawyer.
Checks you can do in a minute
Can someone send email as your exact address?
Run the free email check on your domain. If DMARC is missing or set to p=none (watch only), anyone can still send email from your exact address. The safe settings are p=quarantine (fakes go to spam) or p=reject (fakes are refused). DMARC does not stop lookalike domains or a hacked mailbox, which is what the next checks are for.
Every domain, not only the one you use
Repeat the check for old names and for domains you never send from. The NCSC, the UK's National Cyber Security Centre, asks legal firms to set SPF, DKIM and DMARC, the three public email settings that protect your address, "for all your domains, even if they are not used for email" (NCSC, 22 Jun 2023).
Do your clients know you never change bank details by email?
Read your engagement letter, your website's payment page and your email footer. Each should say, in plain words, that you will never change your bank details by email and that clients should call a number they already have. The SRA advises exactly this (SRA, 23 Nov 2020).
Is two-step login on for every mailbox?
In your email admin, confirm it is on for every account, shared and old ones included. DMARC cannot stop someone who is inside your real mailbox. Account takeovers reported to the Dutch AP nearly tripled in 2025 (Autoriteit Persoonsgegevens, 8 Jul 2026).
Does tracking start before the visitor answers the banner?
Open your site in a private window and leave the banner alone. In the browser's developer tools, Network tab, reload your enquiry or booking page. Any request to an advertising or analytics domain at this point is tracking before consent. Then check that Reject is as easy to find as Accept.
Can a client reach you without a mouse?
Tab through your enquiry form, booking or payment page. Can you reach every field and the submit button, and see where you are? If consumers can buy a service from you online and you are above the microenterprise threshold, check that an accessibility statement (a public page saying how accessible your site is and how to report a problem) is published.
Click the padlock
The certificate behind the padlock encrypts the connection to your site. Is it valid, who issued it, and does it renew automatically? A lapsed certificate on a page that asks for identity documents or payments puts a browser warning in front of your clients.
Is someone using your firm's name?
Search your regulator's warnings for your own name: the SRA publishes scam alerts about cloned firms (SRA, checked 8 Nov 2026). In the Netherlands, check that your details in the official register match your website and email domain, which is what the KBvG, the Dutch bailiffs' professional body, tells the public to check (KBvG, May 2019).
What owners in this sector tell themselves
Email and Cookie Fix
Email Fix and Cookie Fix together: your email protected, and no tracking before visitors say yes. For businesses the accessibility law does not cover.
Keep it fixed: from €39 a month
Confirm it with a real scan
We read only what any visitor can see, and your domain's public settings: no login, no testing of your systems. You get a private report by email with screenshots, a score for each of the four exposures, and fixed prices.
The detail, for those who want it
The bank details that went by email
A notarial office emailed a buyer its settlement statement and its bank details, its RIB (the French slip that gives an account's details). The email was intercepted, the account number (IBAN) was changed, and the buyer paid the fraudster: the loss was €68,607.38. In March 2026 the Paris court, the Tribunal judiciaire de Paris, put 70% of it on the office and 30% on the buyer, and cleared both banks. The office had sent its RIB "par un moyen non sécurisé" (by an unsecured means), against the notaries' own warning of 2022, and the court would not read that warning as meant for clients only (Journal du Net, 22 Sep 2026). The ruling is first instance (from the first court to hear the case), known to us from a press column, and we do not know whether it was appealed.
The court looked less at who was fooled than at who had sent bank details by plain email.
What applies, market by market
Bank details
Notaires' professional accounts are held only at the Caisse des Dépôts, a public financial institution: a notary's RIB "ne peut en aucun cas provenir d'une autre banque" (can never come from another bank) (Notaires de France, 6 Sep 2024). The CNB tells avocats never to send a RIB by email, and CARPA, the fund that handles avocats' client money, never to accept one sent that way (CNB, Oct 2023). The Ordre des experts-comptables, the accountants' professional body, asks firms to call back a number already on file before acting on any change of RIB (Ordre des experts-comptables, 2017, revised 2019).
Who carries the loss
Paying an impersonator does not settle a debt: the payer still owes the real creditor (Cour de cassation, 17 Jun 2026). A bank that executed the transfer on the IBAN it was given is usually not liable (Cour de cassation, 1 Jul 2026). A Paris court put 70% of one loss on a notarial office that had emailed its RIB, a first-instance ruling known from the press (Journal du Net, 22 Sep 2026).
Cookies, pixels and secrecy
The rule that visitors must agree before the site uses trackers it does not need applies to firms as to anyone (CNIL, 2025 to 2026), and since 14 April 2026 to tracking pixels in emails (CNIL, 14 Apr 2026). For avocats, professional secrecy covers every medium (RIN 2.2) (CNB, updated 5 Nov 2026). The CNIL has fined individual avocats, a law firm and a notaire, €500 to €5,000, for ignoring people's requests to see or delete their data and for failing to cooperate; none of those decisions was about cookies or security (CNIL, updated 14 Apr 2026).
Accessibility
The DGCCRF, France's consumer protection authority, lists e-commerce among the services the accessibility rules cover, and says firms with fewer than 10 employees and turnover or balance sheet under €2 million have no accessibility obligation under them (DGCCRF, Jul 2025). We found no official source applying the public-sector rules (the RGAA, France's official accessibility checklist) to notaires or commissaires de justice.
Decisions and rulings in this sector
| Market | Date | Who decided | Against | Outcome | Why | Source |
|---|---|---|---|---|---|---|
| FR | Jun 2026 | Cour de cassation, commercial chamber (n° 24-13.306, published) | A company that paid a spoofed invoice (not named here) | Appeal ruling overturned; case sent back to the Lyon court of appeal | An invoice for €103,375.64 came from an address one letter off the supplier's. An impersonator is not an apparent creditor (someone the payer could reasonably take for the real one), so paying the invoice did not settle the debt | Cour de cassation |
| FR | Jul 2026 | Cour de cassation, commercial chamber (n° 25-15.283) | Two bank customers (not named), in a claim against BNP Paribas | Order for the bank to repay overturned; case sent back to the Lyon court of appeal | A builder's instalment was paid to the account number (IBAN) in an email from a fake address; the bank had made the transfers to the account number given (article L.133-21, Code monétaire et financier) | Cour de cassation |
| FR | Mar 2026 | Tribunal judiciaire de Paris (first instance, known from a press column) | A notarial office (not named in the reports) | 70% of the €68,607.38 loss on the office, 30% on the buyer; both banks cleared | The office had emailed its bank details (RIB) "par un moyen non sécurisé" (by an insecure means), against the notaries' own 2022 warning; the email was intercepted and the account number changed. Appeal status unknown | Journal du Net |
| FR | Nov 2025 | CNIL (simplified procedure) | A law firm (anonymised by the CNIL) | €5,000 | A request to delete personal data not respected; failure to cooperate with the CNIL | CNIL |
| FR | Oct 2021 | CNIL | A notary (anonymised by the CNIL) | €3,000 and an order to comply | Failure to cooperate with the CNIL | CNIL |
| UK | Sep 2025 | Legal Ombudsman (as reported) | Anthony & Jarvie | Firm to cover the £41,548 loss (less deductions), a year's lost rent and £1,000 for distress | The firm had been hacked and a client paid a deposit to an account given in an email from the firm's address. Security not adequate; the client had never been told the firm would not change bank details, and bore no responsibility | Legal Futures |
| UK | Apr 2025 | ICO | DPP Law Ltd | £60,000; the firm said it would appeal | An administrator account without two-step login (a code as well as the password) was broken into and about 32GB of data taken; the breach was reported 43 days after the firm knew | The Register |
| UK | Aug 2023 | ICO (reprimand) | Swinburne Snowball & Jackson | Reprimand | A mailbox without two-step login, taken over through a fake login email (phishing), was used to interfere with payments to the beneficiaries of an estate; the firm repaid them; the breach was reported late | Legal Futures |
| UK | Jul 2023 | Supreme Court ([2023] UKSC 25) | A customer's claim against Barclays Bank UK | No Quincecare duty (a duty to hold back a payment ordered by someone acting for the customer when fraud is suspected) where the customer authorised the payment; a narrower claim to recover the money left for trial | "The bank's duty is to execute the instruction"; refunding push payment fraud, where customers are tricked into sending the money themselves, is for regulators and Parliament | UK Supreme Court |
| UK | Mar 2022 | ICO | Tuckers Solicitors LLP | £98,000 | Ransomware put court data on the dark web, hidden criminal websites; no two-step login on remote access, a critical security update installed about five months late, an archive not encrypted | Legal Futures |
| UK | May 2018 | Court of Appeal ([2018] EWCA Civ 1082) | Solicitors in two sales by impostor sellers | Sellers' solicitors liable for releasing the purchase money; a buyer's solicitor refused relief, to be excused by the court, although honest (majority) | Who carries the loss when completion money reaches a fraudster. Impostor sellers, not spoofed email | Court of Appeal |
| UK | Mar 2017 | SRA, the solicitors' regulator (regulatory settlement) | Perry Hay & Co | Rebuke and £1,350 costs | Paid £333,532 of sale proceeds to an account given in an email from the client's compromised mailbox, without checking by any other channel; the firm admitted breaches of the SRA Principles and accounts rules | Legal Futures |
| NL | Aug 2023 | Kamer voor het notariaat Den Haag (ECLI:NL:TNORDHA:2023:14) | A notary (not named here) | Berisping (reprimand) and €2,000 costs | Paid out €738,859.09 after emails from the seller's address changed the foreign account several times; a test payment was not enough. The insurer repaid; the office paid the €10,000 excess. Appeal status not checked | Kamer voor het notariaat Den Haag |
| NL | May 2021 | Hoge Raad (ECLI:NL:HR:2021:783) | A supplier whose email identity was used (not named here) | Payment to the fraudster settled the debt in the circumstances (appeal ruling upheld) | A spoofed email from the supplier's real address carried a forged invoice. The payer's reasonable belief can be attributed to the creditor in whole or in part, and each side's precautions against impersonation can count | Hoge Raad |
| NL | Apr 2021 | Rechtbank Midden-Nederland (ECLI:NL:RBMNE:2021:1528) | A buyer, on its supplier's claim (not named here) | Ordered to pay the supplier again (€745,624) | The supplier's mailbox was hacked and €751,493 went to a Spanish account after a change of bank details; such a request calls for a call to a number known independently. Decided a month before the Hoge Raad ruling | Rechtbank Midden-Nederland |
| NL | Oct 2018 | Gerechtshof 's-Hertogenbosch (ECLI:NL:GHSHE:2018:4531) | A creditor (not named) | Payment to the fraudster settled the debt | The parties' first deal: the forged invoice was the only account number the buyer had seen, so there was nothing to compare it with | Gerechtshof 's-Hertogenbosch |
| NL | Oct 2017 | Gerechtshof 's-Hertogenbosch (ECLI:NL:GHSHE:2017:4625) | A tenant (not named) | Payment did not settle the debt; contractual penalties also due | Rent paid to an account number (IBAN) pasted onto intercepted invoices; a short phone call would have exposed it | Gerechtshof 's-Hertogenbosch |
| EU | Mar 2019 | Court of Justice of the EU (C-245/18) | A paying company's claim against the banks (not named here) | Banks protected when they pay the account number (IBAN) given, even if the name does not match | Under the Payment Services Directive, the EU law on payments, the account number decides; the protection covers both the payer's and the payee's bank | Court of Justice of the EU |
Questions worth asking
Your answers stay on this page. Each one shows why it matters.
Do clients pay you, or do you pay out, on instructions given by email?
Do your engagement letter, website and email footer say you never change bank details by email?
When someone emails you new bank details, what happens before you pay?
Is two-step login on for every mailbox, shared and old accounts included?
Do your pages on sensitive matters, or your enquiry forms, carry advertising trackers (pixels)?
answers point to something worth fixing.
The full assessment scores all four exposures and builds your list for the next 30 days.
Not legal advice. A lawyer should confirm whether a firm's online booking or payment flow is an "e-commerce service" under the European Accessibility Act; whether the French public-sector accessibility rules reach notaires or commissaires de justice; whether an advertising pixel on an enquiry or booking page engages professional secrecy; and who carries a given loss, since several of the rulings here are first instance or known only from press reports.