Risk management Is identity fraud on your radar

We accept whatever name and contact details the client tells us. There is no requirement to do more, is there? We accept whatever name and contact details the client tells us and only if required by law do we obtain proof of identity.We obtain proof of identity if required, but leave it to a lawyer's discretion to obtain proof of identity in other circumstances, such as if they have doubts or suspicions.We routinely obtain proof of identity for all clients whether required to or not and whether there are suspicions or not. I will return to the significance of these statements later, but first here are some good reasons for taking a long, hard look at your approach to client ID. For some time, lawyers in Australia and New Zealand have been awaiting their fate under ‘Tranche Two‘ of Anti-Money Laundering (AML) legislation in their respective jurisdictions. The extension of AML legislation to the professions would see lawyers subject to client identification and proof of identity requirements similar to those imposed on financial institutions. Anticipating this extension, some law practices have already voluntarily adopted client ID regimes. In most cases, these are firms with connections to overseas jurisdictions such as the United Kingdom and parts of Asia where AML legislation already applies to lawyers.More recently, however, the adoption of client ID regimes has been driven by concerns about identity fraud. Identity fraud is a factor in a number of crimes, including money laundering. ID fraud covers not only the theft or misuse of the identity of real people and organisations, but also the use of fake, fictitious or disguised identities. Identity fraud is often supported by fraudulent ‘proof‘of identity such as documents that are stolen, fake or altered, and by false verification of identity by third parties in league with the fraudster.Although identity fraud potentially has an impact on law practices in several ways, I mention the following three: having your professional identity stolen, being victim of a scam involving fictitious identities that targets law practices, and client matters involving ID fraud that can give rise to professional indemnity claims.Fraud on the riseAn Australian Government survey on identity security in 2011 found that one in six people is affected by identity theft, either by having their identity stolen or knowing someone who has. Although you might think it would be difficult to impersonate a lawyer, there are now cases where lawyers or their law practices have had their professional identities stolen or ‘borrowed‘ by fraudsters. These days it is very easy to copy letterhead, business cards, domain names and websites. In addition, the profession is now so large that it is no longer possible to know everyone by name, or by signature.

Fraudsters are not always strangers to the law practice. There have been cases of disbarred lawyers impersonating their licensed former colleagues, and of lawyers who represent themselves as being from another law practice they perceive as having more ‘gravitas‘ than their own. While it may be difficult to protect yourself from this kind of identity fraud, it does raise the interesting question of how far to trust that a lawyer or law practice you are dealing with is who they say they are. With regard to scams that specifically target law practices, there is a type of ‘advance fee fraud‘ whereby a fake law firm refers a fake client with a fake matter to a real law practice. The fraudster, or someone in league with the fraudster, arranges for the law practice to receive and accept a fake cheque into the trust account and then pressures the law practice to release some or all of the funds before the fraud is discovered. This leaves the law practice with a deficiency in the trust account and with all the problems that a deficiency entails. Fortunately, the number of law practices in this part of the world being duped by this type of scam is small compared with other places such as Canada and the United States. However, there are concerns the number may rise given that the incidence of serious organised fraud in our region is known to be increasing.

With professional indemnity claims involving ID fraud, most arise in the context of the wave of property and mortgage frauds that in recent years have seen property owners, financiers and investors seriously out of pocket. Lawyers, and their insurers, become embroiled via allegations of negligence for failing to detect or prevent the identity fraud. In some cases, the ID fraud is so elaborate that the lawyers could be forgiven for not reading the signs. Unfortunately, in other cases the ID fraud would have been exposed by querying discrepancies in basic ID information such as name, age and, in some cases, gender, or by requiring proof of identity or verifying basic information.Growing headacheThe result of concerns about identity fraud in its many guises is that various state authorities have imposed obligations on lawyers and others to properly identify users of their services. In what is fast becoming a headache for law practices, the development and use of such measures is happening in a piecemeal fashion. The result is that there are now different identity requirements for different purposes between and within different jurisdictions.I have not done a full national survey, but here are a few examples of new identification and verification requirements that apply to lawyers.New South Wales, Queensland and Western Australia have tightened requirements for witnessing documents in certain land dealings, but to date Victoria has not.Western Australia requires not only verification of identity of parties to certain land dealings, but also verification that an identified person has ‘authority to give instructions‘ regarding the interests in land. NSW has different identification and proof of identity and witnessing requirements for identifying:  

a) parties to certain land registry dealings  
b) parties to certain documents submitted to Office of State Revenue    
c) parties seeking a solicitor's certificate of independent advice in relation to financial borrowings/guarantees
d) deponents of statutory declarations and affidavits.

 The NSW requirements for identifying deponents of statutory declarations and affidavits are notable for the requirement of visual identification. That is, the witness must certify to having seen the face of the person or, if not, that the person had a ‘special justification‘ for not removing the face covering. At present a special justification would seem to be medical, not cultural.

Trust account rules require that money must not be received in a false name and that if the client uses more than one name then the other names need to be noted in the trust account records. Also, if a cash transaction report (cash of $10,000 plus) needs to be made to Austrac, then certain client identification details are required to be included in the report.While these requirements are intended to reduce concerns about ID fraud, these measures are, in turn, giving rise to new concerns. For example:are there circumstances where clients should be entitled to access legal services anonymously or at least without having to prove their identity? Or should all clients be identified properly even if they only want advice and even if there are no trust account transactions, land or financial dealings, or execution and witnessing of documents?do identity measures comply with or breach privacy laws? Should lawyers sight or keep copies of identity documents? Is it risky for practice management systems to have the functionality to scan passports and drivers licenses and store other identity data, or is this functionality essential to facilitate compliance with record-keeping obligations regarding identity checks? Does identity checking turn lawyers into ‘identity certifiers‘ which carries the risk of new exposures to liability or penalty if identity checking fails and what are the insurance indemnity implications? This is one of the hold-ups with proposed National Electronic Conveyancing. While some say that identity certification should be left to government agencies, Australia Post or other third-party providers, others say this could be a new source of business for lawyers.who should bear the costs of compliance with new identity requirements; lawyers, clients, or those imposing the requirements? It would be useful to see some discussion in the profession about these kinds of issues.

Meanwhile, back to the question of where your law practice stands on the question of client ID? The four earlier approaches correlate to different attitudes towards whether client ID is seen as a good thing and whether a law practice has a good client ID system. Perhaps you recognise your law practice in one of the following thumbnail sketches.Yes, Client ID is a good thing.

Hit and miss
Good intentions are not matched by effective action. Some client ID is done well, some not. Approach is ad hoc and individualistic, or if there is a system of sorts, the system has flaws. There are real risks that some ID frauds will not be detected or formal requirements will be overlooked.

ID fraud-savvy
The practice ‘walks the talk‘ of effective client ID. Shared commitment to reduce exposure to ID fraud is backed by a robust system that ensures not only that any ID obligations are met but that there is a clear policy about when, how and by whom additional client ID is to be performed, recorded and monitored.

ID fraud-friendly
The practice is not persuaded of the need for client ID and does not do it. Even if there are ID requirements, a (misplaced) trust in clients may lead to non-compliance. However, the bigger risk is that fraudsters have a knack of finding practices that do not ask ID questions.

Token compliance
No matter how good the ‘system‘, a lack of commitment to client ID can result in ‘spiritless compliance‘ or creative avoidance. Even if technical or minimum requirements are met, there is a real risk that lawyers will not ‘join the dots‘ and will miss the signs of ID fraud.

NoGood Client ID System
Yes Remember, obtaining a client's name and address is not sufficient ‘identification‘ to combat identity fraud and meet client ID requirements. If you are not already in quadrant 4, then consider adding ‘client ID‘ to your risk management to-do list

Please note: A list of reports and requirements referred to in this article is available from the author on request. Ronwyn North is the managing director of Streeton Consulting and a qualified lawyer who specialises in consulting to the legal profession on practice management issues, including risk management. She can be contacted atrjnorth@streetonconsulting.com.au.