Website Security for UK Conveyancing Solicitors and Property Law Firms

The Risk Profile of Conveyancing Practice

Conveyancing solicitors handle property transactions — the largest financial events in most people's lives. The combination of large sums moving between parties, strict deadlines, and high client stress creates the ideal conditions for fraud. The Solicitors Regulation Authority, the National Cyber Security Centre, and Action Fraud have all specifically flagged conveyancing firms as among the highest-value targets for cybercriminals in the UK professional services sector.

The fraud model is well-established: compromise a solicitor's email account, monitor a live transaction, and redirect completion funds to a fraudulent account at the moment of exchange. Victims lose their entire property purchase funds. Recovery is rarely complete.

What Conveyancing Firms Hold Online

**Client portals and case management systems** — Identity documents, proof of funds, mortgage offers, title documents, searches, and correspondence. A compromised portal or case management account exposes the entire transaction history for every matter on the system.

**Client identity and AML documentation** — Passport copies, utility bills, bank statements, and source of funds documentation. This is precisely the identity data needed for financial fraud and account takeover.

**Bank account details for completion** — Client account numbers, sort codes, and completion statements containing precise amounts to be transferred. This data is what attackers are specifically looking for in business email compromise attacks against conveyancers.

**Online enquiry and quote forms** — Name, contact details, property address, and transaction value. This data scopes the potential fraud value and identifies clients at the start of a transaction.

The Specific Threat: Business Email Compromise

Conveyancing firms are the primary UK professional services target for business email compromise. The attack follows a consistent pattern: a phishing email or credential stuffing attack compromises a fee earner's email account. The attacker monitors incoming mail silently, identifies live transactions approaching completion, and sends a spoofed email to the client — appearing to come from the solicitor — with updated bank account details for the completion funds transfer.

Clients who transfer completion funds to the fraudulent account have no recourse from the bank if they authorised the transfer, however they were deceived. The Solicitors Compensation Fund covers some losses, but claims are slow and coverage is not guaranteed.

SRA Requirements and Professional Obligations

The SRA requires firms to have appropriate cyber security measures in place as part of their obligation to protect client money and confidential information. The SRA Accounts Rules require client money to be protected — a cyber incident that results in client money loss is both a regulatory and professional conduct matter.

Firms must also comply with UK GDPR as data controllers for client personal data. The combination of identity documents, financial data, and property information held by conveyancing firms makes a data breach potentially catastrophic for clients and severely damaging to the firm.

What a Security Scan Finds on Conveyancing Firm Websites

When Yrzo AI scans a conveyancing solicitor website, findings typically include:

- Client portal login pages without multi-factor authentication - Admin panels accessible without IP-based access controls - Email security misconfigurations enabling spoofing and impersonation - Missing DMARC records allowing attackers to send emails that appear to come from the firm's domain - Outdated website CMS with publicly known vulnerabilities - Missing security headers enabling cross-site scripting attacks - Cookies without Secure or HttpOnly flags exposing session tokens

Why DMARC Is Critical for Conveyancers

DMARC — Domain-based Message Authentication, Reporting, and Conformance — is a DNS record that tells receiving mail servers how to handle emails that claim to come from your domain but fail authentication checks. Without a correctly configured DMARC policy, an attacker can send an email that appears to your client to come from your firm's email address, even without compromising your actual email account.

The completion fund fraud described above is frequently executed using domain spoofing — sending a fake email that appears to be from solicitor@yourfirm.co.uk — rather than an actual account compromise. DMARC at p=reject policy blocks this attack vector entirely. Yrzo AI checks DMARC configuration as part of every scan.

Practical Steps for Conveyancing Firms

Implement DMARC at p=reject or p=quarantine — this is the single most effective technical measure against the email spoofing attacks that enable completion fund fraud. Enable multi-factor authentication on every email account in the firm. Implement a client portal with proper access controls rather than exchanging identity documents and bank details by email. Run a security scan on your website and email infrastructure and share the results with your PII insurer.

Yrzo AI scans conveyancing firm websites and email configurations automatically and delivers a plain-English security report with specific remediation steps.