Washington State Administrative Office of Courts Hacked

The Associated Press is reporting that 160,000 social security numbers were exposed when the Washington State Administrative Office of Courts was hacked in late 2012 or early 2013.

“The breach happened due to vulnerability in an Adobe Systems Inc. software program, ColdFusion, that has since been patched, court officials said. The hack happened sometime after September but wasn’t caught until February…

Mike Keeling, the courts’ information technology operations and maintenance manager, said officials were alerted to the breach by a business on the East Coast that had a similar intrusion.”

Following the breach, new security measures were implemented, including encryption.

Court officials have confirmed that 94 social security numbers were obtained – those affected will be contacted directly. Names and driver’s license numbers may also have been accessed. People who were booked in a city or county jail during specified periods or those who had a DUII, traffic, or a superior court criminal case in Washington may also be affected.

If you believe your information may have been exposed, call 1-800-448-5584 or visit this site.

Read more here.

Scam Alert – Professional Liability Renewal Spoof

If you receive the following e-mail it is a scam:

Subject line: Professional Liability Renewal April – May 2013:

I would like to review and Possibly lower your Professional Liability Insurance Premiums. I developed a relationship with a firm ( A rated companies and better ) that have saved 20-30% and thousands of dollars for some friends. To review yours, all we need is your last years application and declaration page. (fax 214.853.5846) If interested, email my assistant Ms Mindy Harris at mharris@universalfg.com or call me at 972-386-6639.

Mark S. Pincus
JP Morgan International Plaza III
14241 Dallas Parkway, Suite 650
Dallas, Texas 75254
mark@universalfg.com
www.universalfg.com

This e-mail is a phishing scam

  • An independent Google search of “Universalfg” returns no pertinent results.
  • Following the link listed in the signature line takes the user to www.universalfg.com, a poorly written site with grammar and punctuation errors.
  • While the phone numbers on the site match those listed in the spoof e-mail, there is no physical address included on the site. No legitimate insurer would fail to include a physical address on its Web site.
  • The About Us page lists Mindy Harris as a partner – not an assistant – contradicting the e-mail.
  • The About Us page contains an outdated photograph caption from 2011.
  • The About Us page lists two employees – a managing partner (the purported sender of this e-mail) and Mindy Harris, identified as a “partner.” There are no other employees, which seems odd for the scope of services provided by this “business.”
  • The last blog post on the site is dated July 2011.
  • The Address Bar icon that appears in the URL of the blog is a black and white4-23-2013 7-10-08 PM glamour shot of a woman. This is inappropriate imagery for a professional insurer.

The Professional Liability Fund is the sole provider of primary
malpractice coverage for Oregon lawyers

  • There are no private insurers from whom you can purchase the statutorily required coverage in Oregon.
  • Coverage rates are proposed by the Professional Liability Fund Board of Directors and approved by the Oregon State Bar Board of Governors.
  • Oregon lawyers do not complete an “application form” for primary plan coverage. [Granted, there is a form for Excess Coverage.]
  • “Renewals” of Professional Liability Fund coverage occur annually at year-end, not in “April-May.” Some lawyers elect to pay their assessment on a quarterly basis. E-mail notices are usually sent to bar members in November for the coming year. Additional e-notices follow. Payment is made through the secure member login on the Oregon State Bar Web site.

If you have questions regarding your Professional Liability Fund payment, please contact the PLF Accounting Department at 1-800-452-1639.

If you have been a victim of an Internet scam or have received an e-mail that you believe was an attempted scam, please file a complaint with one of the following:

Consider attending our CLE: Protecting Your Firm and Your Clients from Scams, Fraud, and Financial Loss – May 16, 2013.

Law Firm Falls Victim to Scam, Sued by Bank

If this headline doesn’t catch your attention, I’m not sure what will. Here is Sharon Nelson’s latest post on Ride the Lightning:

“It continues to amaze me how law firms fall for phishing scams, sometimes believing that they might have a potential client and sometimes, as here, clicking where they shouldn’t click. The latest law firm is Wallace & Pittman PLLC in North Carolina who reportedly got scammed to the tune of over $300,000.00. And it only went downhill from there.

The scam started with a batch of e-mails in May supposedly from an industry group saying that a transaction hadn’t cleared properly. These e-mails directed readers to click on a link to resolve the problem. Apparently, someone at the law firm did, which allowed hackers to install a keylogger on at least one law firm computer.

After figuring out the law firm’s online banking passwords, the hackers directed their bank, Park Sterling, to send a $336,600.01 transfer through JPMorgan Chase & Co. to a “Konstantin Pomogalove” in Moscow, according to a legal document filed by the law firm. As soon as the law firm received a confirmation of the transaction, it called the bank to cancel it, but it was too late. The bank initially refunded the stolen funds to the law firm’s account.

Later, the bank demanded the funds be returned. State and federal law does not compel banks to restore funds lost through fraudulent activity for commercial customers so long as the bank has reasonable security in effect.

But before the bank could debit the fund, the law firm obtained a restraining order against the bank, removed its funds and closed the account, igniting a lawsuit by the bank.

Park Sterling argues in court papers that Wallace & Pittman did not use an extra layer of security that would require two people to authorize wire transactions and that the request looked legitimate. It also said its customer agreement with the firm places the burden of loss on the customer.

Though the firm uses wire transfers regularly for real estate transactions, this was the first to go outside the country which the firm argues should have raised suspicion enough to put a hold on the transactions. Unsurprisingly, the firm questions the security practices of the bank.

Trial is scheduled for the fall.

There are conflicting cases on whether banks can be held liable, though most have found that they can be, putting a higher burden on information security for banks. My initial take, without having all the facts, is that a bank which suddenly received a high-figure transfer out of the country from a firm which has never done that before should sure as heck have flagged the transaction as potential fraud. And Wallace & Pittman needs to institute two-person authorizations and do some serious employee training!”

Learn how to avoid falling victim to such scams by attending “Protecting Your Firm and Your Clients from Fraud, Scams, and Financial Loss” on May 16 at the OSB Center. Registration open now – visit the PLF Web site > Upcoming Seminars.

Fraud Prevention CLE Coming May 16

Mark your calendars folks!  The Professional Liability Fund is offering a fraud prevention CLE live and via Webcast on Thursday, May 16, 2013 at the Oregon State Bar Center.  Details will be available on our Web site in the coming weeks.  (Check Upcoming Seminars.)

We have secured speakers from the banking industry with expertise in fraud protection products and services.  We will also offer tips and advice from our practice management team on how to identify and avoid the most common scams.  Experts from the Professional Liability Fund coverage department will address your coverage questions as they relate to fraud protection and data breach.  We are also working to secure a speaker from the Oregon State Bar General Counsel’s office to address the ethical implications of falling prey to a trust account scam.

We believe this will be an informative CLE with ample opportunity to get your questions answered!  Learn how to protect money belonging to you and your clients by stopping scammers in their tracks.

Bar Dues Scam

This alert appeared today on the Oregon State Bar Web Site:

FRAUD ALERT: We have received recent reports of fraudulent attempts to collect bar fees. The OSB does not solicit or accept credit card payments by phone, nor do we ask for your SSN or other sensitive information when processing online transactions. If you have questions about fee payments please check our FAQs or call us.

OSB Membership FAQs can be found here.

Stop Scams With Fraud Protection Services

Posted today on the Professional Liability Fund Web site for your consideration:

Don’t Get Scammed!  Consider Fraud Prevention Services

If you are concerned about fraudulent activity on your IOLTA or business bank account, ask your bank about fraud prevention services like Positive Pay and Automated Clearing House (ACH) “block and filter” for automated transactions.

Do Checks Presented for Payment Match the Checks You Wrote?

With Positive Pay, the bank customer transmits electronic files of the checks it issues to the bank. The bank then compares the checks presented for payment with the electronic file sent by the bank customer.  If a check presented for payment does not match, the customer is notified immediately.

Has a Payee’s Name Been Altered?

Payee Positive Pay provides additional protection by helping bank customers detect and prevent alteration of payee names on checks.  The customer provides the bank with a list of approved payees.  Deposited checks and checks presented at the teller line are compared and verified against the approved payee list.  The customer is notified of any non-matching payee names.  Reverse Positive Pay (RPP) is also available. With RPP, the bank generates an electronic file of all items paid on a daily basis.  The customer receives the file and compares the paid items with the customer’s own records.  In the event of a discrepancy, the customer can inform the bank in time to make a return decision, i.e., the customer can instruct the bank to dishonor the check.

Do You Want to Block or Control Automated Transactions Posted to Your Account?

ACH block and filter services provide this protection.  With “block and filter” the customer can:

  • Set criteria to authorize ACH debits or credits to the customer’s account
  • Exclude specified ACH debits or credits
  • Block all ACH debits
  • Block all ACH credits
  • Block both ACH debits and credits

Are Fraud Prevention Services Right for Your Law Firm?

When assessing whether fraud prevention services make sense for your firm, consider the following:

  • Do you or a trusted, authorized staff person have the time to generate and review electronic reports for potential non-matching transactions?  (Unauthorized ACH transactions must be challenged within 24 hours.)
  • Can your system generate the electronic files needed for transaction comparison?  If not, does your bank offer compatible software, and at what cost?
  • Are you willing to pay for fraud prevention services?  Banks offering Positive Pay, Payee Positive Pay, Reverse Positive Pay, or equivalent services generally charge per transaction or item presented.

At the very least, it is worth talking to your banker and reviewing the services your bank offers.

Copyright Beverly Michaelis

2013

The Year in Review – Useful Tips You May Have Missed

Thank you readers!  I hope this has been a fruitful year for you.  Just in case you missed a tip or two, here is a list of 2012 blog posts for your perusal:

January

February

March

April

May

June

July

August

September

October

November

December

All Rights Reserved 2012 Beverly Michaelis

Data Breach Coverage for Law Firms

In the October 2012 issue of In Brief , the Professional Liability Fund (PLF) announced the addition of data breach and cyber liability coverage for law firms covered by the PLF Claims Made Excess Plan beginning January 1, 2013.  Here is the announcement:

The number of businesses suffering data breach losses has been increasing in recent years.  These breaches occur both electronically and on paper.  Information lost could include Social Security numbers, driver’s license numbers, credit and banking information, e-mail addresses, case histories, etc.  Law firms are particularly vulnerable to these types of losses due to the quantity of sensitive information contained in client files.

After a loss occurs, the statutorily required notification and credit monitoring for each affected individual can be expensive and time-consuming.  Such claims are excluded under the PLF primary coverage plan.  Beginning January 1, 2013, PLF Excess Coverage will include Data Breach and Cyber Liability Coverage.  This coverage includes forensic and legal assistance to determine compliance with applicable law, notifications to individuals as required by law, an offer to each notified individual for 12 months of credit monitoring, and loss mitigation resources for law firms.

The PLF recommends that Oregon law firms obtain data breach coverage either through PLF Excess Coverage or a commercial carrier.  If you are considering additional malpractice coverage for your firm, the PLF Excess Program limits are available up to $10 million in total coverage.

New firm and renewal applications for 2013 PLF Excess Coverage will be available in November.  Check the PLF Web site (www.osbplf.org), e-mail us at excess@osbplf.org, or call the PLF at 503-639-6911 or 1-800-452-1639 for more information.

The October issue of In Brief is Now Online

The October issue of In Brief is now available on the Professional Liability Fund Web site.  Articles and announcements include:

ABA Techshow 2013

Adjusted Tort Liability Limits Against Public Bodies

Check Scams Become Even More Sophisticated and Generally Have No PLF Coverage

Data Breach Coverage Added to 2013 PLF Excess Coverage

Immigration Law Resources

In Brief Returns to Print

Modification to Civil Case Management System in Multnomah County

New Foreclosure Law Requirements and PLF Practice Aids

PLF Claims Attorney Position

Reporting Responsibilities Under Medicare

Tips, Traps, and Resources