In part one, I discussed the details of the new scam. Now I will examine several ethical and legal concerns...

What are the ethical and legal concerns and why are they pertinent to me? 
First, by failing to preserve client property, the lawyer may violate Model Rule of Professional Conduct 1.15 (“Rule 1.15”). Under Rule 1.15, lawyers have obligations of safeguarding, accounting and delivery when holding the money or property of others. Rule 1.15 does not expressly include an intent element and some authorities have suggested that no intent need be proven to establish a violation.^[1]  

Most state bar associations have not yet directly addressed the lawyer’s ethical duties when a third party not employed or supervised by the lawyer steals client funds. The North Carolina State Bar was the first to address this question in an October 2015 Ethics Opinion.^[2] According to the Opinion, lawyers are required to use reasonable care to prevent third parties from gaining access to client funds held in the trust account.^[3]  

As a result, a duty is imposed upon the lawyer to implement reasonable security measures, such as telephoning the intended recipient of the funds at the phone number listed in the lawyer’s file or confirming the intended recipient’s email address.^[4]  

In addition, the lawyer has affirmative duties to “educate himself regularly as to the security risks of online banking; to actively maintain end-user security at the law firm through safety practices such as strong password policies and procedures, the use of encryption and security software, and the hiring of an information technology consultant to advise the lawyer or firm employees; and to insure that all staff members who assist with the management of the trust account receive training on and abide by the security measures adopted by the firm.”^[5]  

Am I responsible if my client is a victim of this scam? 
The Opinion concludes that when a lawyer fails to take reasonable care to minimize the risks to client funds by implementing reasonable security measures, the lawyer may be found professionally responsible and may be required to replace funds stolen by the criminal.^[6]  

Knowing that you might be responsible if this were to occur should generate some concerns. However, knowing how to implement proven risk control measures can help reduce the threat of being victim to such an attack. Part three of this three- blog series will conclude with actionable tips to reduce your risk of being a victim.  
    

^[1] See In re Mayeaux, 762 So.2d 1072 (La. 2000)(“lawyer’s mistake, good faith, or lack of conscious wrongdoing does not negate an infraction of the rule”); Att’y Grievance Comm’n v. Stolarz, 842 A.2d 42 (Md. 2004)(“an unintentional violation…is still a violation of the attorney’s affirmative duties imposed by the rule”); Restatement (Third) of the Law Governing Lawyers §5 cmt. (d)(2000).  

^[2] See FEO 6, The North Carolina State Bar, October 23, 2015.

^[3] Id.

^[4] Id.  

^[5] See 2011 FEO 7, The North Carolina State Bar, 2011; 2015 FEO 6, The North Carolina State Bar, October 23, 2015. 

^[6] See, e.g., 2015 FEO 6, The North Carolina State Bar, October 23, 2015.