Payment Fraud Prevention for Professional Services

Professional services firms are attractive targets for payment fraud because they handle other people's money. A law firm managing a property settlement, an accounting practice processing payroll for clients, or a consulting firm paying subcontractors on behalf of a client are all making payments where the consequences of fraud extend beyond the firm itself.

Trust accounts are a primary target. When a law firm or conveyancer holds client funds in trust and makes payments from that trust, a redirected payment is not just a financial loss. It is a breach of trust, a regulatory issue, and potentially a career-ending event. The firm's professional indemnity insurance may or may not cover the loss, and the claim process itself is damaging.

Business email compromise is particularly effective against professional services firms because clients expect to communicate with their lawyer, accountant, or consultant by email. When a scammer compromises a client's email and sends "updated bank details" for a payment, the request looks routine. The professional relationship creates a level of trust that scammers exploit.

Unlike a retailer or manufacturer, professional services firms cannot easily absorb the reputational damage from a fraud incident. Clients choose their lawyer or accountant based on trust and competence. A publicised fraud event undermines both, and the competitive nature of professional services means clients have plenty of alternatives.

From July 2026, lawyers, accountants, and other professional services providers become reporting entities under Tranche 2 of Australia's AML/CTF legislation. This introduces formal obligations for customer due diligence, suspicious transaction reporting, and compliance program maintenance.

For professional services firms, Tranche 2 creates a dual obligation. First, the regulatory obligation to AUSTRAC: conducting due diligence on clients and monitoring transactions. Second, the professional liability obligation: demonstrating to regulators, courts, and insurers that the firm took reasonable steps to verify payment details before releasing funds.

Payment verification directly supports both. By verifying the identity, business registration, and bank account ownership of every payee, firms meet their AUSTRAC compliance requirements while also building the evidence trail that professional indemnity insurers and courts expect.

The firms that adopt payment verification before Tranche 2 takes effect will have tested, refined processes in place when the obligations begin. Those that wait will be implementing new systems under regulatory pressure, with the risk that early compliance gaps become enforcement targets. Know Your Business (KYB) processes become a foundational requirement under these new rules.