Trust Accounts and Client Money: IOLTA, Wire Instructions and Who Bears the Loss

Rule versions described: Idaho Rules of Professional Conduct 1.1, 1.4, 1.6 and 1.15 with comments, Idaho State Bar text current as of March 9, 2026; Idaho Bar Commission Rules Section VI (Client Assistance Fund, Rules 600 to 616) and Section XIII (Trust Accounts, Rules 1301 to 1309), current as of March 9, 2026; Idaho Code Title 28, Chapter 4, Part 6 (Uniform Commercial Code, Funds Transfers, sections 28-4-601 to 28-4-638) and sections 28-3-404 and 28-3-406, Idaho Legislature text read October 28, 2026; ABA Formal Opinions 477R (May 22, 2017), 482 (September 19, 2018), 483 (October 17, 2018) and 515 (March 5, 2025); North Carolina State Bar 2015 Formal Ethics Opinion 6 (October 23, 2015); FBI IC3 reports and public service announcements through the 2025 Internet Crime Report (April 2026). All were read October 28, 2026. Rules change; check the current text from the Idaho State Bar, the Idaho Legislature or the issuing body before relying on any point.

Most of this module is about information: client files, emails, tax returns, discovery. This lesson is about money. Law firms hold settlement proceeds, retainers, closing funds, escrow deposits and estate money that belong to someone else. Accounting firms, title companies, escrow agents and some financial advisers hold or move client money too. That money moves on predictable dates, in large round amounts, on instructions that usually arrive by email. Criminals have learned all three facts, and the losses are large and often permanent.

This lesson covers the professional rules that govern client money in Idaho (Rule 1.15 and the Bar Commission trust account rules), the frauds aimed at trust and escrow accounts, the law and bar opinions on who bears the loss when money goes to a criminal, the bank and bookkeeping controls that stop most of these frauds, and what to do in the first hour after a misdirected wire. The ethics groundwork (competence, confidentiality and supervision) is in lesson 1. The full treatment of business email compromise, including email authentication and how compromised mailboxes are used, is in lesson 6. If you want the plain-language basics of business scams first, read Scams Aimed at Businesses; for what an individual client can and cannot claw back after sending money, read Money, Credit and Identity.

Why client money attracts criminals

Three things criminals know about trust and escrow money

Fraud against a law firm's trust account is not random. It follows from how the money works.

• The amounts are large and the dates are known. A personal injury settlement, a home sale, a business closing or an estate distribution moves tens or hundreds of thousands of dollars at once. Closing dates appear in purchase contracts, court orders and calendar invites. Anyone who can read a firm's or a client's email knows when the money will move.
• Many people touch the transaction by email. A real estate closing can involve the buyer, the seller, two agents, a lender, a title company, the closing lawyer and their assistants. Each is a mailbox that can be spoofed or taken over, and each has a reason to send payment details.
• Trust money looks like it belongs to no one in particular. Staff move it on instructions because it is not the firm's money. A clerk who would question a strange request to pay a firm bill may follow a client's "updated" wire instructions without a second thought, because paying the client is the job.

The professional rules add one more pressure: Rule 1.15(d) requires a lawyer to "promptly deliver" funds a client or third person is entitled to receive.¹ Promptness is a duty, and criminals use urgency. The right answer is that prompt delivery to the right person, after verification, satisfies the rule; fast delivery to a criminal does not.

The numbers

The FBI's Internet Crime Complaint Center (IC3) publishes an annual report built from complaints filed by victims. Its 2025 report, released in April 2026, counted 1,008,597 complaints and $20.877 billion in reported losses. Business email compromise (BEC), the family of schemes in which a criminal uses a real or fake business email to redirect a payment, produced 24,768 complaints and $3,046,598,558 in losses, second only to investment fraud. In IC3's chart of the transaction types victims reported, wire transfer or ACH accounted for 86 percent of BEC. Real estate fraud, a separate category that includes many closing-fund diversions, produced 12,368 complaints and $275,110,419 in losses.⁹

Idaho appears in the state tables: 4,479 complaints and $88,725,284 in reported losses for 2025, up from 3,081 complaints and $63,035,342 in 2024.⁹¹⁰ Those totals cover every kind of internet crime, not only fraud against professional firms, and they count only what victims reported.

The Verizon 2025 Data Breach Investigations Report, drawing on about 19,000 FBI complaints, found that the median amount taken in a BEC case "has settled around the $50,000 mark," and that wire transfers made up "approximately 88% of all BEC proceeds."¹¹ For a small firm, $50,000 can be more than its malpractice deductible, its operating cushion and its trust account balance for a typical month.

Idaho Rule 1.15: safekeeping property

The text of the rule

Idaho Rule of Professional Conduct 1.15 (Idaho State Bar text current as of March 9, 2026, read October 28, 2026) is the core rule for client money. Its five paragraphs read:¹

(a) A lawyer shall hold property of clients or third persons that is in a lawyer's possession in connection with a representation separate from the lawyer's own property. Funds shall be kept in a separate account maintained in the state where the lawyer's office is situated, or elsewhere with the consent of the client or third person. Other property shall be identified as such and appropriately safeguarded. Complete records of such account funds and other property shall be kept by the lawyer and shall be preserved for a period of five years after termination of the representation.

(b) A lawyer may deposit the lawyer's own funds in a client trust account for the sole purpose of paying bank service charges on that account, but only in an amount necessary for that purpose.

(c) A lawyer shall deposit into a client trust account legal fees and expenses that have been paid in advance, to be withdrawn by the lawyer only as fees are earned or expenses incurred.

(d) Upon receiving funds or other property in which a client or third person has an interest, a lawyer shall promptly notify the client or third person. Except as stated in this Rule or otherwise permitted by law or by agreement with the client, a lawyer shall promptly deliver to the client or third person any funds or other property that the client or third person is entitled to receive and, upon request by the client or third person, shall promptly render a full accounting regarding such property.

(e) When in the course of representation a lawyer is in possession of property in which two or more persons (one of whom may be the lawyer) claim interests, the property shall be kept separate by the lawyer until the dispute is resolved. The lawyer shall distribute all portions of the property as to which the interests are not in dispute.

The comments that matter here

The Idaho Supreme Court adopted the comments along with the rules.¹² Four of them bear on money security:

• Comment [1]: "A lawyer should hold property of others with the care required of a professional fiduciary." The same comment says a lawyer "should maintain on a current basis books and records in accordance with generally accepted accounting practice," and points to the ABA Model Financial Recordkeeping Rule as an example.¹
• Comment [5]: a lawyer "who serves only as an escrow agent is governed by the applicable law relating to fiduciaries even though the lawyer does not render legal services in the transaction and is not governed by this Rule." A lawyer acting only as escrow agent is not off the hook; a different body of fiduciary law applies.¹
• Comment [6] (an Idaho comment) points to the Client Assistance Fund in Section VI of the Idaho Bar Commission Rules, covered below.
• Comment [7] (also Idaho only) says Section XIII of the Bar Commission Rules "sets forth provisions relating to licensing requirements and the establishment, maintenance and administration of trust accounts, including Interest on Lawyer Trust Account (IOLTA)."¹

What Rule 1.15 means for security

Rule 1.15 does not mention email, wire fraud or cybersecurity. It does not have to. Several duties in it reach security directly:

• "Separate" and "appropriately safeguarded." Paper property must be "appropriately safeguarded," and the duty to hold funds separately and with fiduciary care is a duty to protect them from loss, including loss to thieves. Electronic client files are also "other property," a point covered in lesson 2.
• "Complete records." Records kept for five years after the representation ends are the evidence that lets a firm show where every dollar went, spot a theft quickly and prove it took reasonable care. They are also old data that can be breached, which is why ABA Formal Opinion 483 urges data minimization consistent with Rule 1.15.¹³
• "Promptly deliver ... to the client or third person ... entitled to receive." Delivery to an impostor is not delivery to the person entitled to receive the money. If a firm sends a client's settlement to a criminal, the client is still owed the money, and the question becomes who pays. That is the subject of the section on who bears the loss.
• Disputed funds stay put. Rule 1.15(e) requires a lawyer to keep property separate when two people claim it. When a payment instruction is in doubt (for example, a seller's "new" account versus the account in the file), holding the money until the question is resolved is consistent with the rule's logic.

Rule 1.15 works alongside the other rules taught in lesson 1. Rule 1.1 and its Comment [8] require a lawyer to keep up with "the benefits and risks associated with relevant technology," which includes online banking and wire fraud.¹⁴ Rule 1.6(c) requires "reasonable efforts" to prevent unauthorized access to client information, and the information that lets a criminal time a fake wire request (closing dates, amounts, account details) is client information.¹⁵ Rule 5.3 makes partners and managers responsible for having measures in place so that staff who handle money act consistently with the lawyer's duties.¹⁶ And Rule 1.4 requires a lawyer to keep the client "reasonably informed," which includes telling a client promptly when the client's money is lost.¹⁷

The Idaho Bar Commission Rules on trust accounts (Rules 1301 to 1309)

The Idaho Bar Commission Rules (I.B.C.R.) are adopted by the Idaho Supreme Court and published by the Idaho State Bar. The index page says the rules are "current on this website as of March 9, 2026."¹⁸ Section XIII, Rules 1301 to 1309, governs trust accounts. Here is what each rule does, with an eye to fraud and security.

Rule 1301: definitions

Rule 1301(p) defines a trust account as "An account established by a lawyer to hold the property of clients and third persons for safekeeping." Rule 1301(i) defines an IOLTA account as "An interest or dividend-bearing trust account for client and third party funds as set forth in Rule 1304." Rule 1301(c) defines Bar Counsel as "Legal counsel for the Board," the Bar's governing board of commissioners.¹⁹

Rule 1302: consent and reporting to the Bar

Under Rule 1302(a), lawyers "shall be deemed to have consented to the trust account requirements" as a condition of licensing. Each licensing year, Rule 1302(b) requires lawyers to report trust account information or certify an exemption, and Rule 1302(c) requires written notice of "any changes regarding the lawyer's trust accounts information, including the opening or closing of any trust account, within thirty (30) days of such change."²⁰ That 30-day duty matters after a fraud: a firm that closes a compromised trust account and opens a new one has a reporting deadline.

Rule 1303: where the account lives

Rule 1303(a) requires lawyers, "in accordance with these Rules and I.R.P.C. 1.15," to "establish and maintain a trust account in a financial institution approved by the Bar under Rule 1306." Lawyers who do not handle client or third-party funds, or who have no office in Idaho, can certify an exemption under Rule 1303(b). Rule 1303(c) requires that accounts "be clearly identified as 'trust' or 'escrow' accounts," and Rule 1303(d) says "Funds deposited in trust accounts must be insured by an agency of the federal government."²¹

Deposit insurance protects against a bank failing. It does not protect against a lawyer or staff member sending money to a criminal. That is a common misunderstanding among clients and some staff.

Rules 1304, 1305 and 1309: IOLTA

IOLTA stands for Interest on Lawyer Trust Account. Rule 1304(a) requires a lawyer who must keep a trust account to "create and maintain an IOLTA account for deposit of all client and third person funds," except that under Rule 1304(b) a lawyer may use a separate interest-bearing account for the client when the funds "can earn net income for the client or third person in excess of the costs to secure such income." Rule 1304(c) lists the factors, including the amount, the expected duration, interest rates and the costs of a separate account.²²

Rule 1305 requires the lawyer to direct the bank to remit IOLTA interest, net of allowable fees, "at least quarterly, solely to the Foundation," and to "ensure that earnings from an IOLTA account are not made available to the lawyer." Rule 1309(a) says "The Foundation is the only entity authorized to receive and administer IOLTA funds in Idaho," meaning the Idaho Law Foundation, which distributes the interest for purposes including "legal aid to the poor" and "law-related education programs for the public."²³²⁴

For security, the key fact about IOLTA is that it is pooled: one account holds money for many clients. A fraudulent wire from a pooled account is, in practice, paid with other clients' money until the firm replaces it. North Carolina's 2015 opinion, discussed below, spends two of its seven inquiries on exactly that problem.⁸

Rule 1306: eligible banks

Rule 1306(a) allows IOLTA accounts "only in eligible financial institutions approved by the Bar," and the rest of the rule sets interest comparability standards. Rule 1307(g) requires the Bar to publish the list of approved institutions on its website.²⁵

Rule 1307: overdraft reporting to Bar Counsel

Rule 1307 is the rule a fraud victim is most likely to meet without warning. To be approved, a bank must file a notification agreement that requires it:²

to report to Bar Counsel if any properly payable instrument is presented against a trust account containing funds insufficient to honor the instrument in full, irrespective of whether the instrument is honored.

"Properly payable" means an instrument "that would require payment under Idaho law if presented in the normal course of business." For a dishonored item, the report to Bar Counsel is identical to the overdraft notice sent to the lawyer and goes out at the same time. If the bank honors the item anyway, the report must identify the bank, the lawyer, the account number, the presentment and payment dates and the overdraft amount, and it is due "within five (5) banking days of the date of presentation for payment." The agreement covers all branches, and reports are confidential except as provided in formal charge proceedings.²

Here is how fraud trips the rule. A firm deposits a counterfeit cashier's check for $95,000 from a fake client, the bank makes the funds available, and the firm wires $90,000 out at the "client's" request. Days later the check is returned as counterfeit and the bank reverses the deposit. The trust account now has less money than the firm's other clients are owed, and the next check written on the account for another client's matter may be presented against insufficient funds. The bank reports it to Bar Counsel. Nobody at the firm chose to make a report; the bank's agreement makes it automatic. (This example is a composite drawn from the pattern the FBI described in its October 2024 warning, not a specific Idaho case.)⁵

Rule 1308: what Bar Counsel does next

On receiving an overdraft notice, Bar Counsel must send the lawyer a written request for "A written explanation of the circumstances that resulted in the insufficient funds notification" and "Copies of bank statements on all trust accounts for the preceding six (6) months, including the month the overdraft occurred." Bar Counsel then either closes the matter "if the explanation satisfactorily explains the overdraft" or investigates it "as a disciplinary complaint if the explanation is not satisfactory."²⁶

A firm that has followed a written verification procedure, reconciled the account, held funds until checks finally cleared and reported the crime promptly is in a far better position to give a satisfactory explanation than a firm that cannot show any of those things. Your records are your explanation.

The Client Assistance Fund and what it does not cover

What the fund is

Section VI of the Idaho Bar Commission Rules (Rules 600 to 616, current as of March 9, 2026) establishes the Client Assistance Fund "for the purpose of promoting public confidence in the administration of justice and maintaining the integrity of the legal profession by reimbursing claimants for losses caused by the dishonest conduct of lawyers." The current rules apply to claims filed after July 1, 2014.²⁷ The fund is paid for by an assessment on Bar members of up to "$20 per member" a year until it reaches $1,000,000, plus donations and interest.²⁸

What it covers

The fund pays for a "Loss," defined in Rule 601(j) as "The loss of money or property occasioned by the Dishonest Conduct of a Lawyer occurring during the course of a Lawyer-client or fiduciary relationship between the Lawyer and the Claimant." Rule 601(f) defines "Dishonest Conduct" as:³

Wrongful acts committed by a Lawyer in the nature of theft or embezzlement of money or the wrongful taking or conversion of money, property or other things of value, including but not limited to: (1) Refusal to refund an advance payment of fees or expenses that have not been earned or incurred, as required by Rule 1.16 of the Idaho Rules of Professional Conduct; or (2) The borrowing of funds from a client without an intention to repay those funds, or with disregard of the Lawyer's inability or reasonably anticipated inability to repay the funds.

Rule 606 caps recovery: "The maximum amount that may be recovered from the Fund arising from an instance or course of Dishonest Conduct by a Lawyer is $25,000."⁴

What it does not appear to cover: theft by an outside criminal

Every element of the definition points to the lawyer. The wrongful act must be "committed by a Lawyer," and the loss must be "occasioned by the Dishonest Conduct of a Lawyer." When a criminal spoofs a seller's email and a careful but deceived paralegal wires closing funds to the criminal, no lawyer has stolen, embezzled or converted anything. Read by its terms, that loss does not fit the fund's definition. This is an interpretation of the rule text, not a ruling by the Bar or the Court; no decision on the point was found for this lesson.³

Several other provisions narrow the fund further:

• Rule 604(c): a claim must be filed "no later than three (3) years after the Claimant knew or should have known of the Dishonest Conduct of the Lawyer."²⁹
• Rule 604(e) excludes losses of a lawyer's family members, partners, associates and employees, losses covered by a bond, surety agreement or insurance contract "to the extent covered thereby," and losses of financial institutions recoverable under a banker's blanket bond or similar coverage.²⁹
• Rule 605(d)(2): the Board may deny a claim "where it appears that there will be unjust enrichment, or the Claimant unreasonably or knowingly contributed to the Loss."³⁰
• Rule 609: "No person shall have any right to payment from the Fund as a Claimant, third-party beneficiary or otherwise." Payment is discretionary.³¹

The practical lesson for clients: the fund is a backstop for lawyer theft, capped at $25,000, and not insurance against cyber fraud. The practical lesson for firms: when an outside criminal takes trust money, the money comes back, if at all, from a bank recall, a law enforcement freeze, the firm's own insurance, the firm's own pocket, or a lawsuit. That is why prevention matters so much here.

There is one place the fund may come into a cyber case: In re Davis, discussed below, where a Georgia lawyer was found by default to have been "a knowing and intentional participant" in a scheme that ran stolen money through his IOLTA account. A lawyer who knowingly helps launder fraud proceeds through a trust account is engaged in exactly the kind of dishonest conduct the fund addresses, but that is a lawyer's dishonesty, not a lawyer's mistake.³²

Escrow and settlement funds outside law firms

Accounting and tax firms

Accounting firms are not covered by Rule 1.15 or the Bar Commission trust account rules. Some CPA firms and bookkeepers still handle client money: paying bills from a client's account under a power or online banking access, running payroll, holding funds in escrow for a transaction, or paying tax liabilities on a client's behalf. Where they do, the same fraud patterns apply, and the same controls (verification by a known number, dual approval, daily reconciliation) apply too. The accounting firm's own rules, including the FTC Safeguards Rule and the IRS requirements for tax professionals, are covered in lesson 4. This lesson does not state escrow licensing or trust rules for accountants, which vary by role and were not checked for this module.

Title and real estate closings

Real estate closings are the single most targeted setting for changed wire instructions, because the buyer often wires a large sum to a closing agent the buyer has never met, on instructions that arrive by email. IC3's 2025 report counted 12,368 real estate fraud complaints with $275,110,419 in losses.⁹ In Idaho, closings are commonly handled by title and escrow companies as well as by lawyers. The rules that govern title and escrow companies were not checked for this module; what this lesson says about verification and bank controls applies to anyone who sends or receives closing funds.

Two of the court cases in this lesson, Otto v. Catrow Law in West Virginia and McCabe v. Talero in New York, arose from home purchases in which buyers wired money to an impostor. They show how fact-specific the question of responsibility is, and both are discussed under who bears the loss.³³³⁴

The fraud patterns aimed at trust accounts

This section describes how the frauds look from the receiving end, so staff can recognize them. It does not explain how to carry them out. The email side of these schemes (spoofed domains, compromised mailboxes, forwarding rules, email authentication) is covered in depth in lesson 6.

Pattern 1: changed payment instructions at closing or settlement

How it looks. Shortly before a closing or a settlement disbursement, the firm receives an email that appears to come from someone it expects to pay: the seller, the client, the lender, the other side's law firm. The message says the bank account has changed ("we are being audited," "our old account is frozen," "please use our new escrow account") and attaches or lists new wiring details. Sometimes it arrives in the middle of a real email thread, because the criminal has access to a real mailbox and replies within the conversation. Sometimes the sender's address differs from the real one by a single character. The message may ask the firm to reply only by email because the sender is "in meetings" or "traveling."

Real examples. In Beau Townsend Ford Lincoln v. Don Hinds Ford, a hacker controlled the email of the seller's sales manager, used forwarding rules to hide the real messages, and sent fake wire instructions; the buyer wired $736,225 to a Texas account and the money vanished.⁷ In Otto v. Catrow Law, buyers lost $266,069 after a scammer, writing from an email address that was not their real estate agent's, sent fake instructions.³³ In McCabe v. Talero, it was the buyers' own lawyer's email that was hacked, and the buyers wired about $171,000 to an impostor.³⁴ North Carolina's 2015 Formal Ethics Opinion 6, Inquiry #5, addressed a lawyer who wired closing proceeds to a hacker after a spoofed email changed the seller's instructions.⁸

The tell. Any change to where money goes, received by email, text or a web portal, is suspect until verified by a call to a number the firm already had. The IC3 tip is plain: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."⁶

Pattern 2: counterfeit cashier's checks from fake new clients

How it looks. The FBI described this pattern in an October 8, 2024 public service announcement titled "Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme." A fake creditor (often said to be overseas) hires a firm to collect a debt. Soon after, the fake debtor "pays" by cashier's check sent straight to the firm. The firm deposits the check in its trust account, the bank makes the funds available, and the "client" presses for the firm to wire the proceeds, minus its fee, right away. The check is later returned as counterfeit, and the money wired out was the firm's other clients' money.⁵

Variations include a fake business client in a contract dispute that "settles" quickly, a fake divorce client whose ex-spouse pays a settlement, and an overpayment scheme in which a new client sends a retainer check for far more than asked and requests a refund of the difference by wire.

The tell. The FBI's advice: "Be suspicious of requests or pressure to take action quickly," hold funds until the check fully clears, verify by phone, call the bank at once to recall a wire if money has gone out, and report to ic3.gov.⁵ ABA Formal Opinion 515 (March 5, 2025) uses this scheme as one of its examples, describing a collections matter in which both the supposed creditor and the supposed debtor are fake parties whose aim is to get lawyers to deposit fraudulent checks into their client trust accounts and then wire out funds. The opinion cites warning signs from New York City Bar Opinion 2015-3, for example a sender based abroad who gives no referral source.³⁵

The underlying problem is a timing gap. A bank may make deposited funds available for withdrawal before the check has been finally paid by the bank it is drawn on, and a counterfeit can be returned after the funds were made available. "Available" is not the same as "good." The firm's control is to wait until the issuing bank has actually paid the item and to confirm that with its own bank, not with the client.

Pattern 3: payoff letter fraud

How it looks. At a sale or refinance, the closing agent must pay off existing loans and liens using payoff statements from the lender. A fake payoff statement, or a real one with altered wiring details, sends the payoff to a criminal. Because the existing lender does not receive the money, the old loan is not paid, and the problem may not surface until the lender reports a missed payment or the title is examined weeks later. The same pattern can hit a settlement in which a medical lien, a hospital, a health plan or a prior lawyer must be paid out of the proceeds.

The tell. A payoff statement that arrives from an email address or fax number not used by the lender before, that carries wiring details different from the lender's published or prior instructions, or that comes with a request not to call. The control is to obtain payoff figures and payment instructions directly from the lender through a channel the firm establishes (the lender's main number from its own website or the borrower's statement, or the lender's secure portal), and to confirm the wiring details with the lender by phone before sending. This pattern is described here from general practice, not from a specific case in this module's sources.

Pattern 4: trust accounts used to move stolen money

Criminals also use lawyers' trust accounts as a way station for money stolen from someone else, because a wire to a "law firm IOLTA" looks legitimate to the victim and the victim's bank. In In the Matter of James W. Davis, III, No. S23Y0622 (Ga. May 14, 2024), an insurer was tricked by emails from someone posing as its policyholder's representative into wiring $3,093,085.50 to "J. Davis - Attorney at Law, LLC IOLTA," and the Georgia Supreme Court disbarred the lawyer on facts deemed admitted by default, including that he was "a knowing and intentional participant." This lesson read the decision only through a case-law aggregator copy, not on the Georgia Supreme Court's site, so treat the details as a secondary-source report.³²

The defensive point for honest firms: an unexpected incoming wire to the trust account, from someone who is not a client, followed by a request to send it onward, is a warning sign. Do not move money out of trust that you cannot tie to a real client matter.

ABA opinions that bear on client money

The ABA Model Rules are not Idaho law, and ABA formal opinions do not bind Idaho lawyers. Idaho's rules are based largely on the Model Rules, and the Idaho State Bar has issued no formal ethics opinion on technology, cloud computing or data breaches; its committee issued its last formal opinion of that era in 1992.³⁶ In practice, Idaho lawyers look to the ABA opinions. Four of them bear on money.

ABA Formal Opinion 515 (March 5, 2025): when the client is the criminal

Opinion 515 answers a question that used to make lawyers hesitate: if a "client" defrauds the lawyer, may the lawyer report the client to the police, given the duty of confidentiality in Rule 1.6? The opinion's answer: a lawyer who is the victim of a crime by a client or prospective client "may disclose information relating to the representation to the appropriate authority in order to seek an investigation and potential prosecution of the alleged offender," or to seek other services, remedy or redress. The opinion treats this as an implicit exception to Rule 1.6, extending to staff or relatives victimized when the lawyer witnessed the crime.³⁵

The opinion also notes that a scammer who never meant to form a real client-lawyer relationship is owed no duty at all: because no genuine client-lawyer relationship ever existed, the lawyer's confidentiality duty does not protect the scammer.³⁵ Idaho's Rule 1.6 differs from the ABA rule in several ways (for example, Idaho 1.6(b)(1) lets a lawyer reveal a client's stated intention to commit any crime), and Opinion 515 is not Idaho authority, so check the Idaho text before relying on it.¹⁵ The practical effect is still clear: a firm that has been hit by a counterfeit check scheme should report it to its bank, to IC3 and to local police without fear that it is violating confidentiality toward the scammer.

ABA Formal Opinion 477R (2017): securing communications

Opinion 477R (May 11, 2017, revised May 22, 2017) says a lawyer "generally may transmit information relating to the representation of a client over the internet" if the lawyer has made reasonable efforts to prevent unauthorized access, but "may be required to take special security precautions" when the information requires it. Its seven considerations include understanding the threat, using reasonable electronic security measures, training lawyers and staff, and doing due diligence on vendors.³⁷

For money, 477R matters in two ways. The information criminals need for a fake wire request (who is closing, when, for how much, and with whom) is confidential client information, and leaking it through an unprotected mailbox makes the fraud possible. And the opinion's call to train lawyers and assistants applies directly to the people who send wires.

ABA Formal Opinion 483 (2018): after a breach

Opinion 483 (October 17, 2018) says that when a data breach involves, or has a substantial likelihood of involving, material client information, "lawyers have a duty to notify clients of the breach and to take other reasonable steps." It requires lawyers to "act reasonably and promptly to stop the breach and mitigate damage" and to "make reasonable efforts to determine what occurred."¹³

A misdirected wire is very often the visible end of a hidden mailbox compromise. If a criminal read the firm's email for weeks to time the fake request, the criminal also saw other clients' information. Opinion 483 means the firm cannot treat the wire as a one-client problem; it has to find out what else the intruder saw. Notification duties under Idaho's breach statute and the rules of professional conduct are covered in lesson 5.

ABA Formal Opinion 482 (2018): disasters and trust accounts

Opinion 482 (September 19, 2018) is about natural disasters, but it states a duty that fits ransomware and fraud too: Rule 1.15 "requires lawyers to protect trust accounts, documents, and property the lawyer is holding for clients or third parties." It adds that "By proper advance preparation and planning and taking advantage of available technology during recovery efforts, lawyers can reduce their risk of violating the Rules of Professional Conduct after a disaster."³⁸ A firm that loses access to its accounting system in a ransomware attack still has to know, from records it can reach, what it holds for each client.

Who bears the loss

The question

When money goes to a criminal and cannot be recovered, someone who did nothing criminal ends up paying. It might be the client whose money it was, the firm that sent it, the party that expected to receive it, or a bank. There is no single statute that answers the question for every case. The answer depends on the contract between the parties, the professional rules that apply to a fiduciary, negligence law, and, for wire transfers between banks, Article 4A of the Uniform Commercial Code. Courts that have faced the question tend to ask the same thing in different words: who was in the best position to prevent the fraud?

Beau Townsend Ford Lincoln v. Don Hinds Ford (6th Cir. 2018)

The leading federal appellate decision on fake wire instructions between businesses is Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018). The opinion is unpublished (marked "Not Recommended for Full-Text Publication"), so it is not binding precedent even in the Sixth Circuit, and it is not Idaho law. A law firm article reports it at 759 F. App'x 348; that reporter citation was not confirmed in a primary source for this lesson.⁷³⁹

The facts: a hacker controlled the email of the seller's sales manager, set up forwarding rules, and sent fake wire instructions. The buyer wired $736,225 to a Texas account, and the money was lost. The trial court had granted summary judgment to the seller on its contract claim. The Sixth Circuit reversed and sent the case back for trial. It relied on the principle, drawn from other wire fraud cases and from the Uniform Commercial Code's rules on impostors and negligence for checks (sections 3-404 and 3-406), that "[i]f there is a policy implicit in the UCC's rules for the allocation of losses due to fraud, it surely is that the loss be placed on the party in the best position to prevent it," and applied that idea by analogy. It noted the trial court's own statement that "both parties were negligent in their business practices" and held that the factfinder must determine which party "was in the best position to prevent the fraud."⁷

Two cautions. First, the court did not decide the case under UCC Article 4A, the article that governs wire transfers; do not cite it as an Article 4A case. Second, Idaho has its own enactments of the same check provisions, Idaho Code 28-3-404 ("Impostors, fictitious payees") and 28-3-406 ("Negligence contributing to forged signature or alteration of instrument"), but no Idaho appellate decision applying the best-position analysis to a wire fraud was found for this lesson.⁴⁰

UCC Article 4A in Idaho: Idaho Code 28-4-601 to 28-4-638

Article 4A of the Uniform Commercial Code governs commercial wire transfers. Idaho did not number it as a separate chapter 4A. It is enacted as Part 6 of Chapter 4 of Title 28, "Uniform Commercial Code, Funds Transfers," sections 28-4-601 to 28-4-638, added in 1991.⁴¹ Consumer electronic transfers covered by the federal Electronic Fund Transfer Act are generally outside it (section 28-4-608).⁴² The provisions that matter most for fraud:

• Security procedure (28-4-609). A "security procedure" is a procedure agreed between a bank and its customer to verify that a payment order is the customer's, or to detect errors. It "may require the use of algorithms or other codes, identifying words or numbers, encryption, callback procedures, or similar security devices." Comparing a signature to a specimen "is not by itself a security procedure."⁴³
• Verified orders and commercial reasonableness (28-4-610). If a bank and customer agreed on a security procedure, a payment order the bank accepts is effective as the customer's order, "whether or not authorized," if the procedure "is a commercially reasonable method of providing security against unauthorized payment orders" and the bank accepted the order "in good faith and in compliance with the security procedure." Commercial reasonableness is "a question of law" decided by considering the customer's wishes, the customer's circumstances known to the bank, alternatives offered, and procedures in general use. A customer who refuses a commercially reasonable procedure the bank offered, chooses its own and agrees in writing to be bound is stuck with its choice.⁴⁴
• When the customer can still shift the loss (28-4-611). Even a verified order is not enforceable against the customer if the customer proves the order was not caused by a person entrusted with its payment duties or security procedure, or by someone who got access to its transmitting facilities or obtained, from a source the customer controls, information that let the criminal breach the security procedure.⁴⁵
• Refunds and the 90-day reporting window (28-4-612). If the bank accepted an unauthorized order that is not effective or enforceable against the customer, the bank must refund it with interest. The customer loses interest on the refund if it fails to exercise ordinary care to discover the problem and notify the bank "within a reasonable time not exceeding ninety (90) days" after notice of the debit.⁴⁶
• Name and number mismatch (28-4-615). If a payment order names one beneficiary but gives the account number of a different person, and the beneficiary's bank does not know they differ, the bank "may rely on the number as the proper identification of the beneficiary." It "need not determine whether the name and number refer to the same person." This is why a wire addressed to "Smith Title Company" can land in a criminal's account if the account number belongs to the criminal.⁴⁷
• Cancellation (28-4-619). After the beneficiary's bank accepts a payment order, cancellation generally requires that bank's agreement, and is effective only in listed situations, including a sender's mistake that ordered payment "to a beneficiary not entitled to receive payment from the originator."⁴⁸ That is the legal frame for a recall request: your bank asks the receiving bank to return the money, and the receiving bank has to agree and still have it.

The point most firms miss. Article 4A's strongest protections are for unauthorized payment orders: orders a criminal sends to the bank in the customer's name, for example by stealing online banking credentials. In the typical BEC case, the firm itself logs in and sends the wire. That is an authorized order. The bank did what its customer told it to do, so Article 4A usually gives the firm little ground to make its own bank pay. The fight then shifts to the parties to the deal and their negligence, as in Beau Townsend, or to the receiving bank's conduct, which some courts have examined under section 4A-207 (Idaho 28-4-615). This is analysis of the statute's structure, not a ruling, and cases vary on their facts. A Virginia federal case shows how unsettled that route is. In Studco Building Systems v. 1st Advantage Federal Credit Union, a federal trial court in 2023 held the receiving credit union liable for more than $550,000, but the Fourth Circuit reversed in 2025, holding under Virginia's version of section 4A-207 that a receiving bank may rely on the account number unless it actually knows the name and number do not match. The U.S. Supreme Court denied review on October 6, 2025 (No. 25-80). The appeal holding is described here from a law firm summary and the Supreme Court docket; the Fourth Circuit opinion itself was not read for this lesson.³⁹⁶¹

North Carolina 2015 Formal Ethics Opinion 6: the lawyer's professional duty

Court cases decide civil liability. Bar opinions decide professional responsibility, which can require a lawyer to restore trust money regardless of what a court might later say about who else is at fault. The clearest bar opinion on stolen trust funds is North Carolina State Bar 2015 Formal Ethics Opinion 6, "Lawyer's Professional Responsibility When Third Party Steals Funds from Trust Account," adopted October 23, 2015. It is not Idaho law, but it is a well-reasoned model, and it reads Rule 1.15 duties that Idaho shares in substance.⁸

The opinion answers seven inquiries:

1. Forged checks drawn on the trust account (Inquiry #1). A lawyer who substantially complied with trust accounting, reconciliation and supervision rules need not replace funds a forger stole; one who did not, where that failure was a proximate cause, may have to. Either way the lawyer "must promptly investigate the matter and take steps to prevent further thefts of entrusted funds."
2. Outstanding checks with enough money overall (Inquiry #2). The lawyer must keep one client's money from paying another's obligations, for example by stopping payments and giving the bank a list of outstanding checks.
3. Outstanding checks without enough money (Inquiry #3). The lawyer need not deposit personal funds to cover them but "should notify the payees if Lawyer knows that the checks will not clear."
4. A hacker drains the account (Inquiry #4). No duty to replace if the lawyer took reasonable care, including keeping current on the security risks of online banking, strong password policies and staff training.
5. Spoofed wire instructions (Inquiry #5). The lawyer wired closing proceeds to a hacker after an emailed change, and "did not verify the disbursement change by calling seller at the phone number listed in Lawyer's file." The opinion: "These were reasonable security measures that, if implemented, could have prevented the theft." And: "Lawyer is, therefore, professionally responsible and must replace the funds stolen by Hacker."
6. Replacing with the lawyer's own money (Inquiry #6). A lawyer may deposit personal funds to replace stolen money while recovery is pending, with records of the source, reason, date and matter.
7. Clients and reporting (Inquiry #7). The lawyer must tell affected clients and explain the effect on their matters, and must report the theft to the North Carolina State Bar's trust accounting compliance counsel.

The line the opinion draws is useful everywhere: a firm that was defrauded despite reasonable precautions is a victim; a firm that skipped a simple, known precaution (a phone call to a number in the file) is responsible for the loss.⁸

Otto v. Catrow Law (W. Va. 2020): the closing firm was not liable

In Otto v. Catrow Law, PLLC, No. 19-0361, the Supreme Court of Appeals of West Virginia affirmed summary judgment for a closing law firm in a malpractice suit. The buyers had wired $266,069 to a scammer after emails from an address that was not their real estate agent's. The court held that the buyers "were unable to establish that Respondent breached any duty owed to them," Respondent being the law firm.³³ The case shows the other side of Beau Townsend and the North Carolina opinion: a firm that did not send the money, and whose own systems were not the source of the fake instructions, may owe nothing.

McCabe v. Talero (N.Y. Sup. Ct. 2025): the hacked lawyer's mailbox

McCabe v. Talero, 2025 NY Slip Op 50597(U) (Sup. Ct. Queens County, March 31, 2025), is a trial court decision. The buyers' own lawyer's email was hacked, and the buyers wired about $171,000 to an impostor. The court denied the buyers summary judgment: there were triable issues on whether the lawyer should have warned them sooner, and on the buyers' own negligence, because the firm's emails had told them to verify wire instructions by phone.³⁴ Two lessons follow. A firm whose mailbox is the source of the fraud faces real exposure. And a standing written warning to clients to verify wire instructions by phone is evidence that can cut both ways: it shows the firm took a precaution, and it can show the client ignored it.

Ferentini, Jetcrete and other reported cases

Several other decisions are known in this lesson only through secondary sources. Read them as reports, not holdings:

• Ferentini (Conn. Super. Ct.). According to a March 14, 2025 article by McCarter and English, which represented the plaintiff, a Connecticut trial judge found a former law firm negligent after a bench trial for failing to secure its email system and not following its own policies after a similar earlier incident, and awarded $90,586 plus interest. The firm's name and docket were not confirmed for this lesson, and later reports mention an appeal and a resolution.⁴⁹
• Jetcrete North America v. Austin Truck and Equipment, 484 F. Supp. 3d 915 (D. Nev. Sept. 3, 2020). After a bench trial, judgment went to the seller. According to a law firm summary, the court placed the loss on the buyer that wired funds to the impostor without verifying, applying a best-position approach. The case header was read; the body of the opinion was not.⁵⁰
• Arrow Truck Sales v. Top Quality Truck and Equipment (M.D. Fla. 2015) is commonly described as placing the loss on a buyer that received conflicting invoices and paid without calling to verify. The Sixth Circuit's Beau Townsend opinion cites it as No. 8:14-cv-2052 (M.D. Fla. Aug. 18, 2015) and describes the court placing the loss on the buyer, whose assistant manager did not confirm the changed wire instructions with the seller; the Florida opinion itself was not read.⁷³⁹
• In re Davis (Ga. 2024), described above, is a discipline case about a lawyer found to be a participant, read only through an aggregator copy.³²

No reported decision was found for this module in which a law firm or CPA firm was held liable to its own client specifically for a BEC loss caused by the firm's compromised email, beyond the trial-level reports above. The search was limited, and absence of a found case is not proof there is none.

Bank and bookkeeping controls that stop most of these frauds

Most trust account frauds are stopped by a few dull controls, used every time. The bank services below go by different names at different banks, and not every bank offers every one to every account; ask your bank's treasury or business services staff what is available for a trust or IOLTA account and what it costs. Under Idaho Code 28-4-610, what you agree with your bank about security procedures also affects who bears the loss for an unauthorized order, so read the agreement and keep a copy.⁴⁴

Positive pay

With positive pay, the firm sends the bank a list of the checks it has issued (number, date, amount and often payee). When a check is presented, the bank compares it with the list and holds any item that does not match, asking the firm to approve or reject it. It is the most direct defense against forged and altered checks drawn on the trust account, the problem in Inquiry #1 of the North Carolina opinion.⁸ Some banks offer a similar service for ACH debits.

ACH debit blocks and filters

An ACH debit block tells the bank to reject any electronic debit to the account unless the firm has authorized that originator. A trust account should almost never be debited electronically by anyone, so a full block (or a filter that allows only listed originators, such as the bank's own fee) closes a door that criminals can use with nothing more than the account and routing numbers printed on a check.

Dual authorization

Dual authorization (sometimes called dual control) means one person sets up a wire or ACH payment in online banking and a second person, using separate credentials, must approve it before the bank sends it. It does not help if both people trust the same fake email, so the approver's job must include checking that the verification call was made and logged. In a two-person office, the second person may be the lawyer on the matter, approving from a separate device.

Callback verification

Callback verification means calling the person who supposedly sent the instructions, at a phone number the firm already had before the request arrived: the number in the engagement letter, the intake form, the client file or the counterparty's website, not one in the email, the signature block or the attached letter. The call should confirm the full account and routing numbers read aloud by the recipient, not just "did you send us new instructions?" This is the step whose absence decided Inquiry #5 of the North Carolina opinion.⁸ The plain-language version of this tool is taught in Scams Aimed at Businesses.

Out-of-band confirmation

"Out of band" means using a different channel from the one the request came in on. A request by email is confirmed by phone; a request by phone is confirmed in writing through a channel the firm controls, such as a secure client portal the client logged into with multifactor authentication. The point is that a criminal who controls one channel (a mailbox) rarely controls a second one (the client's known phone). The FBI's BEC tips put it this way: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."⁶ For the firm's own systems, CISA, NSA, FBI and MS-ISAC recommend phishing-resistant multifactor authentication on email and banking.⁵¹

Daily review and reconciliation

Review trust account activity in online banking every business day. A daily check catches an unexpected debit, an unknown incoming wire, or a returned deposit while there is still time to act, and the first hour after a misdirected wire matters more than any other (see the first hour). Daily review is a short look at what moved; it is not a substitute for the monthly three-way reconciliation.

Three-way reconciliation

A three-way reconciliation compares three numbers that should agree on the same date: the adjusted bank balance (the bank statement, adjusted for deposits in transit and outstanding checks), the trust account journal or check register balance, and the total of all individual client ledger balances. The Iowa Judicial Branch, for example, describes the test as: "Verify that the [total of subaccount balances] = [general ledger balance] = [adjusted bank balance]," and says it "is required to be completed each month" in Iowa.⁵² The ABA's model trust account records rules, in their commentary, call monthly reconciliation "the preferred practice."⁵³

The Idaho rules read for this lesson do not set a reconciliation schedule in so many words. Idaho Comment [1] to Rule 1.15 says books and records should be kept "on a current basis" in accordance with "generally accepted accounting practice," and Bar Commission Rule 1308 shows what Bar Counsel will want after an overdraft: six months of statements for every trust account.¹²⁶ Monthly three-way reconciliation is how a firm can produce a satisfactory explanation, and North Carolina's opinion ties a lawyer's duty to replace forged-check losses partly to whether reconciliation rules were followed.⁸

A safe payment-instruction workflow

The controls above fit together into one routine for every outgoing payment from a trust or escrow account. The graphic shows it, and the sample procedure later in this lesson puts it in writing.

1. Collect instructions at intake, not at closing. Get the client's payment details early, through a channel the firm controls (in person, by phone to a number from intake, or through a secure portal). Record who gave them, when and how.
2. Tell clients in writing, at the start, that the firm will never change payment instructions by email and that any message saying otherwise is fraud. Put it in the engagement letter and on closing documents (see lesson 5).
3. Treat any change as a red flag. New account, new bank, new beneficiary name, "updated" letterhead: stop.
4. Call a known number. Use a number on file from before the request. Have the payee read back the full account and routing numbers.
5. Log the call. Who called, the number used, who answered, what was confirmed, date and time.
6. Second person approves. The approver checks the log and the matter ledger before releasing the wire in online banking.
7. Confirm funds are good. Never disburse against a deposit until the issuing bank has actually paid it.
8. Confirm receipt. Call the payee the same day at the known number to confirm the money arrived.

The Idaho angle: Idaho State Bar scam alerts, 2023 to 2025

The Idaho State Bar posts scam alerts on its website. Read together, they show Idaho lawyers being targeted with the same tools used against firms everywhere, and one alert is aimed squarely at settlement money:⁵⁴

• April 7, 2023: a phishing email in which the scammer "purports to be part of Bar Leadership and asks for an expense to be paid via payment app."
• April 22, 2024: "scammers are sending Dropbox links via email with the eventual goal of getting wire transfers for settlement funds." The Bar's reminder: "Never click on suspicious links sent to you."
• July 8, 2024: phishing using ISB President Gary Cooper's name "and an illegitimate email address."
• May 14, 2025: a scam email posing "as a District Bar Officer requesting money."
• June 24, 2025: phishing impersonating Bar staff "requesting confirmation of preferences for secure communications."
• December 2, 2025: phishing "impersonating Idaho State Bar Executive Director, Maureen Braley and requesting personal information."

The April 2024 alert describes a two-step pattern. A file-sharing link is the bait: the recipient clicks what looks like a shared document and is led to a fake sign-in page that captures the email password. With the password, the criminal can read the firm's mail, learn which settlements are pending, and then send fake wire instructions from inside a real thread. The Bar's alert does not describe the mechanics in that detail; the description here is the general BEC pattern that the FBI and CISA describe, applied to the Bar's warning.⁵⁴⁵¹ The defenses are in lesson 6: phishing-resistant multifactor authentication on email, alerts on new forwarding rules, and the verification call before any payment.

No Idaho Supreme Court or Idaho State Bar public discipline record involving trust account wire fraud by an impostor, or client data loss, was found for this module. That does not mean none exists; it means a reporter or researcher would have to look further (see the reporting section below).⁵⁵

Cyber insurance: social engineering coverage versus computer fraud coverage

Many firms assume their cyber policy covers a misdirected wire. Often it does not, or covers it only with a much smaller limit. The general structure of cyber insurance (first-party and third-party coverage, ransomware, exclusions, the application) is taught in Continuity, Recovery and Cyber Insurance. For client money, two coverage types matter, and the difference between them decides many claims. The descriptions below are general; policy names, definitions and conditions vary by insurer, and this lesson quotes no policy wording.

Three practical points follow. First, read the declarations page for a social engineering sublimit; a $1 million cyber policy may have a far smaller limit for this loss. Second, if the policy conditions coverage on a verification callback, the firm's written procedure must require exactly that, and the log must prove it was done. Third, a lawyer's professional liability policy is a different policy with its own terms; whether it responds to a client's claim over lost trust money depends on its wording. Ask your broker in writing which policy responds to each of the scenarios in the table above and get the answer in writing.

The ABA's 2023 Legal Technology Survey found that "40% of respondents reported their firms having cyber liability insurance, which is down from 46% in 2022."⁵⁶ Most firms, in other words, would face a wire loss with no cyber coverage at all.

The first hour after a misdirected wire

When a firm learns that trust or escrow money went to the wrong account, speed is the only thing that reliably helps. The IC3 2025 report says: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." And: "Regardless of the amount lost, file a complaint at www.ic3.gov."⁹

1. Call your bank's fraud or wire department now. Use the number on your bank card or online banking site. Say the words "fraudulent wire" and "recall." Give the date, amount, receiving bank, account number and the wire reference number (sometimes called the IMAD or Fed reference). Ask the bank to contact the receiving bank immediately and request that the funds be frozen and returned. Under Idaho Code 28-4-619, cancellation after the receiving bank has accepted the order generally needs that bank's agreement, so every hour the money sits there is a chance; once it moves on, recovery gets harder.⁴⁸
2. File a complaint at ic3.gov. Include the transaction details. The IC3's Recovery Asset Team (RAT), "Established in 2018," works with banks through the Financial Fraud Kill Chain (FFKC) to freeze money. In 2025 it handled 3,900 incidents with $1,163,919,846 in attempted theft and froze $679,013,183, a "58% Success Rate": $507,042,623 domestic across 3,574 incidents and $171,970,560 international across 326. The RAT works with FinCEN's Rapid Response Team and FBI legal attaches on international freezes.⁹ In 2024 the RAT reported a 66 percent success rate.¹⁰ FinCEN reported in 2022 that its Rapid Response Program had "facilitated the recovery of more than $1.1 billion for U.S. victims" since 2015.⁵⁷
3. Do not rely on a deadline. You may hear that the FBI can help only within 72 hours. The IC3 2024 and 2025 reports, as read for this module, do not state a 72-hour cutoff; they say to act immediately. Report even if days have passed.¹⁰
4. Stop all other disbursements from the account until you know whether the account itself or your online banking is compromised, and whether other wires are queued.
5. Preserve evidence. Keep the fraudulent emails with full headers, the call log, the wire confirmation and screenshots. Do not delete the messages or "clean up" the mailbox. Call your IT provider to secure the email account (password reset, sign out all sessions, check for forwarding rules) without wiping anything.
6. Call your insurer or broker. Many policies require prompt notice and have panel vendors for investigation.
7. Report to local police and keep the report number; banks and insurers often ask for it. ABA Formal Opinion 515 supports a lawyer's discretion to report a client's or prospective client's crime against the lawyer.³⁵

After the first hour

• Tell the client. Rule 1.4 requires keeping a client reasonably informed; a client whose money is missing must hear it promptly from the firm, with what is being done.¹⁷
• Protect other clients' money. If the loss came out of a pooled IOLTA account, other clients' balances are now short. North Carolina's opinion lets a lawyer deposit personal funds to restore the account while recovery is pending, with full records.⁸ In Idaho, Rule 1.15(b) allows a lawyer's own funds in trust only for bank charges, so read Idaho's rules and check with your firm's ethics or risk partner before putting firm money into the trust account, and document everything.¹
• Expect a Rule 1307 report if any item is presented against insufficient funds, and prepare the Rule 1308 explanation and six months of statements now.²²⁶
• Investigate the mailbox. Under ABA Opinion 483 the firm must make reasonable efforts to determine what happened, and a compromised mailbox may have exposed other clients' information, which can trigger client notice and Idaho's breach notice statute if personal information such as Social Security or financial account numbers was acquired.¹³⁵⁸ Notice steps are in lesson 5.
• Report to the Bar if a trust account change follows. Closing the account and opening a new one starts the 30-day clock in Rule 1302(c).²⁰

The full BEC response, including email forensics, the FinCEN and IC3 reporting channels and what banks can and cannot do, is in lesson 6. For what an individual client can do after sending money from a personal account, see Money, Credit and Identity.

Sample policy: trust account and client funds payment verification procedure

Where this lesson links instead of repeating

• Scams Aimed at Businesses: the verification callback and dual approval explained for any small office, with a scam-by-scam table.
• Money, Credit and Identity: what an individual can and cannot get back after sending money, useful for clients who sent closing funds from personal accounts.
• Continuity, Recovery and Cyber Insurance: how cyber insurance works in general, and backups that survive ransomware.
• Lesson 1: Rules 1.1, 1.4, 1.6 and 5.3 and the ABA opinions on competence and confidentiality.
• Lesson 2: client files as property, cloud services and AI tools.
• Lesson 4: the FTC Safeguards Rule and IRS rules for accounting and tax firms.
• Lesson 5: engagement letter terms, incident response and breach notice.
• Lesson 6: the full business email compromise lesson.

Common mistakes

Calling the number in the email

A "verification" call to the phone number printed in the fraudulent email or its attached letter reaches the criminal. The North Carolina opinion faulted the lawyer for not calling the seller "at the phone number listed in Lawyer's file."⁸ The number must predate the request.

Wiring before the deposited check is finally paid

This is the whole mechanism of the counterfeit check scheme the FBI described in October 2024: the firm treated available funds as good funds, wired the money, and the check came back.⁵ The trust account was then short other clients' money.

Taking on the obvious fake client

ABA Opinion 515's collections example and the New York City Bar red flags it cites (an overseas sender, no referral source) describe matters that look wrong from the first email.³⁵ Firms that lose money to these schemes often had the warning signs in their intake notes.

Leaving the firm's own email open

In McCabe v. Talero, it was the lawyer's mailbox that was hacked, and the court let the claim that the lawyer should have warned the clients sooner go to trial.³⁴ In Ferentini, as reported by the plaintiff's counsel, the firm was found negligent for failing to secure its email and not following its own policies after an earlier incident.⁴⁹ A firm whose mailbox is the source of the fake instructions is in a weak position.

Relying on the beneficiary name

Staff often assume the bank will reject a wire if the account name does not match. Under Idaho Code 28-4-615, the receiving bank "may rely on the number" and "need not determine whether the name and number refer to the same person."⁴⁷

Waiting to report

Firms sometimes spend a day trying to reach the payee, or wait for Monday, before calling the bank. The IC3 says "time is of the essence."⁹ Call the bank first and investigate second.

Assuming insurance or the Client Assistance Fund will pay

Social engineering losses are often sublimited or excluded, and the Client Assistance Fund addresses lawyer dishonesty, capped at $25,000.⁴ A firm that has not checked both before a loss usually finds out after.

No reconciliation, or reconciliation months late

The North Carolina opinion ties a lawyer's duty to replace stolen funds in part to whether the lawyer complied with reconciliation and supervision rules.⁸ Late reconciliation also means a fraud is found weeks after the money is gone.

Questions people ask

My settlement is in a federally insured trust account. Is it safe from fraud?

Insured against the bank failing, yes: Bar Commission Rule 1303(d) requires trust funds to be "insured by an agency of the federal government."²¹ Insured against being sent to a criminal, no. Deposit insurance does not cover a payment the account holder authorized, even if the firm was tricked. That is why the payment verification procedure matters more than the account type.

If the firm wires my money to a scammer, who pays me back?

Rule 1.15(d) requires delivery to the person entitled to the money, and payment to an impostor does not satisfy it.¹ Whether the firm must replace the money as a matter of professional responsibility depends on whether it took reasonable precautions; North Carolina's 2015 opinion required replacement where the lawyer skipped a call to a known number.⁸ Civil liability depends on the facts and on who was in the best position to prevent the loss.⁷ The Client Assistance Fund does not appear to cover a loss caused by an outside criminal, because its definitions require a lawyer's own dishonest conduct.³

Can the bank just reverse the wire?

Not on its own say. Under Idaho Code 28-4-619, once the receiving bank has accepted a payment order, cancellation generally requires that bank's agreement and is limited to listed situations.⁴⁸ In practice your bank sends a recall request, the receiving bank freezes what is left if it agrees, and the FBI's Recovery Asset Team can help through the Financial Fraud Kill Chain. In 2025 that process froze 58 percent of the attempted theft it worked on.⁹ The sooner you call, the more likely money is still there.

Is there a 72-hour deadline to report to the FBI?

No such cutoff appears in the IC3 2024 or 2025 annual reports as read for this module. They say to contact your bank immediately and to file at ic3.gov "Regardless of the amount lost."¹⁰⁹ Report as fast as possible, and report even if time has passed.

Will Bar Counsel find out if our trust account is hit by fraud?

Possibly without anyone at the firm making a report. Under Bar Commission Rule 1307, approved banks must report to Bar Counsel when a properly payable item is presented against insufficient funds, whether or not the bank honors it. Bar Counsel then asks for an explanation and six months of statements under Rule 1308.²²⁶ A firm with a written procedure, reconciliations and a prompt police and IC3 report has the explanation ready.

May we report a client who scammed us to the police without breaching confidentiality?

ABA Formal Opinion 515 says a lawyer who is the victim of a crime by a client or prospective client "may disclose information relating to the representation to the appropriate authority" to seek investigation and prosecution, and that a scammer who never intended a real client relationship was owed no duty at all.³⁵ The opinion is not Idaho law, and Idaho's Rule 1.6 has its own text, so read the Idaho rule; the reasoning is likely to be persuasive.¹⁵

Doesn't UCC Article 4A make the bank responsible?

Mostly for unauthorized orders, such as a criminal sending a wire with stolen online banking credentials, and then only if the bank's security procedure was not commercially reasonable or the bank did not follow it, among other conditions in Idaho Code 28-4-610 and 28-4-611.⁴⁴⁴⁵ When the firm's own employee sent the wire because of a fake email, the order was authorized, and Article 4A usually gives the firm little claim against its own bank. That is analysis of the statute, not a ruling for any particular case.

What should clients do to protect themselves?

Ask the firm at the start how it will send and receive payment instructions. Save the firm's main number from its official website or engagement letter. Never act on emailed wiring instructions without calling that number. Call again after sending to confirm receipt. If something goes wrong, call your own bank first, then the firm, then file at ic3.gov.

We are a two-lawyer office. Is all this realistic?

Most of it costs little. The verification call takes minutes. ACH debit blocks and positive pay are usually modest bank fees. Dual authorization can be one lawyer and one staff member. A three-way reconciliation is a monthly task the trust rules effectively expect already. The expensive controls (email security monitoring, phishing-resistant multifactor authentication for everyone) are covered in lesson 6 and are worth comparing against a single $50,000 loss, the median BEC amount in the 2025 Verizon report.¹¹

Hard questions

Who should bear a wire fraud loss when everyone was deceived?

The case for putting it on the sender. The party that pushed the button is usually the one that could most cheaply have stopped it with a phone call. Placing the loss there gives every sender a strong reason to verify, and it matches the North Carolina opinion and cases such as Jetcrete as reported.⁸⁵⁰

The case for looking at whose system was breached. If the fake instructions came from a compromised mailbox, the party that failed to secure its email created the danger, and the sender was deceived by a message from a real address in a real thread. Beau Townsend left room for this by sending the case to a factfinder to compare the parties' negligence, and McCabe kept a claim against the lawyer whose mailbox was hacked alive.⁷³⁴

The case for putting more on banks. Banks see patterns no single customer can: a new account receiving one large incoming wire and sending it abroad the same day. Some argue receiving banks should bear more of the loss when a name and number do not match; Article 4A as enacted lets the receiving bank rely on the number (Idaho Code 28-4-615).⁴⁷ Banks answer that checking names on every wire would slow payments and that customers control their own email and verification practices.

What the evidence shows. The sources in this lesson do not settle on one rule; outcomes turn on facts. They do agree that a documented verification call to a known number is the single strongest fact a party can have.

Should the Client Assistance Fund cover trust losses caused by outside criminals?

For expanding it. From the client's side, money held by a lawyer is gone either way, and the fund's stated purpose is "promoting public confidence in the administration of justice."²⁷ Clients cannot evaluate a firm's email security before hiring it.

Against expanding it. The fund is paid by a capped per-member assessment and is designed for lawyer dishonesty. Covering negligence-driven cyber losses would make careful lawyers subsidize careless ones, could be large enough to exhaust a fund capped at $1,000,000 for assessment purposes, and could weaken the incentive to verify.²⁸ Malpractice and crime insurance exist for that risk.

What the evidence shows. The Idaho rules as written point to lawyer dishonesty, and no Idaho proposal to change that was found for this lesson. How often Idaho clients lose trust money to outside criminals is not publicly measured.

Should Idaho write reconciliation and payment verification into its trust account rules?

For. Some states, Iowa among them, describe a required monthly three-way reconciliation in official guidance.⁵² An express Idaho rule would set one clear standard, help Bar Counsel evaluate overdrafts, and give small firms a checklist.

Against. Rule 1.15 and its comments already require fiduciary care and current books, and the overdraft program catches serious problems. Detailed procedures in a court rule can go stale as payment systems change, and the ABA's Ethics 20/20 Commission, as quoted in Formal Opinion 477R, declined to list specific security measures because "technology is changing too rapidly to offer such guidance."³⁷

What the evidence shows. The Idaho rules read for this lesson do not name a reconciliation schedule or a verification method. Whether that leads to more losses in Idaho than in states with explicit rules is not shown by any public data found.

Should Idaho's ethics CLE requirement specifically cover trust account fraud?

For. Idaho requires at least three ethics credits per three-year period, and the rule says such courses may include "client trust account administration."⁵⁹ Fraud aimed at trust accounts is a direct threat to client property, and a short required session on payment verification might prevent large losses.

Against. The current rule already allows trust account courses to count, lawyers vary in how much client money they handle, and a mandate adds cost without proof it reduces fraud. Idaho does not require a technology or cybersecurity credit; whether it should is discussed in lesson 1.⁵⁹

What the evidence shows. No study was found measuring whether trust-fraud training requirements reduce losses.

Where to go next

• IC3: file a complaint: The FBI's Internet Crime Complaint Center. Free. File here immediately after a misdirected wire, after calling your bank; keep the complaint number for your bank, insurer and police report.
• FBI IC3 PSA: Counterfeit Check Scam Targets Law Firms: Free, short FBI warning (Oct. 8, 2024) describing the fake debt collection scheme and its red flags. Good for staff training on new-client screening.
• Idaho Bar Commission Rules, Section XIII, Trust Accounts: Free official text of Idaho Rules 1301 to 1309. Read Rules 1302, 1307 and 1308 before you need them; check the ISB index page for the current version date.
• North Carolina 2015 Formal Ethics Opinion 6: Free. Not Idaho law, but the clearest bar opinion on what a lawyer must do when a third party steals trust funds; useful for writing a firm procedure.
• FBI IC3 PSA: Business Email Compromise, The $55 Billion Scam: Free FBI tips for preventing BEC, including verifying account changes through secondary channels. Share with staff and clients.
• CISA Phishing Guidance: Stopping the Attack Cycle at Phase One: Free government guidance for IT providers on phishing-resistant multifactor authentication and email authentication, the defenses that keep criminals out of the mailbox in the first place.

Still being checked (10 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The reporter citation 759 F. App'x 348 for Beau Townsend Ford Lincoln v. Don Hinds Ford was confirmed only through a law firm article, not a primary source.
• In re James W. Davis, III (Ga. May 14, 2024) was read only through a case-law aggregator copy, not on the Georgia Supreme Court's site.
• The Ferentini negligence verdict is known only from the plaintiff's counsel's March 14, 2025 article; the defendant firm's name and docket number were not confirmed, and later appeal and resolution details were not read.
• Jetcrete North America v. Austin Truck and Equipment (D. Nev. 2020): the holding details come from a secondary summary; the opinion body was not read.
• Arrow Truck Sales v. Top Quality Truck and Equipment (M.D. Fla. Aug. 18, 2015) is described from the Sixth Circuit's Beau Townsend opinion and a secondary source; the Florida opinion was not read. The Fourth Circuit's 2025 reversal in Studco Building Systems v. 1st Advantage Federal Credit Union is described from a law firm summary (Spotts Fain) and the U.S. Supreme Court docket (No. 25-80, certiorari denied Oct. 6, 2025); the appellate opinion and its reporter citation (reported as 133 F.4th 264) were not read.
• That the Client Assistance Fund does not cover thefts by outside criminals is an interpretation of I.B.C.R. 601(f) and (j), not a ruling by the Bar or the Idaho Supreme Court.
• No Idaho public discipline case on impostor wire fraud or client data loss was found; absence of a found case is not proof none exists.
• The rules governing Idaho title and escrow companies and accountants who hold client funds were not checked for this lesson.
• The analysis that BEC wires sent by the firm's own staff are usually 'authorized' orders is this lesson's reading of Idaho Code 28-4-610 and 28-4-611, not a court ruling.
• ABA Formal Opinion 515's holding was confirmed through the ABA's March 5, 2025 news release, which quotes the opinion's disclosure sentence. The collections example and the no-duty-to-a-scammer point are paraphrased, not quoted, because their exact wording could not be confirmed in a copy of the opinion (americanbar.org blocks automated retrieval).

Last verified October 28, 2026. General education, not legal, ethics, accounting or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Idaho State Bar, Idaho Rules of Professional Conduct, full text, Rule 1.15 (Safekeeping Property) and Comments [1] to [7], text current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
2. Idaho Bar Commission Rules, Section XIII (Trust Accounts), Rule 1307, Bar Approval of Financial Institutions, Notification, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
3. Idaho Bar Commission Rules, Section VI (Client Assistance Fund), Rule 601(f) (Dishonest Conduct) and 601(j) (Loss), current as of March 9, 2026. The statement that the Fund does not appear to cover outside criminals is this lesson's reading of the definitions, not a ruling (read Oct. 28, 2026). Read it online. ↩
4. Idaho Bar Commission Rules, Section VI, Rule 606, Limitations on Reimbursement Amount ($25,000), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
5. FBI Internet Crime Complaint Center, Public Service Announcement I-100824-PSA, "Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme," October 8, 2024 (read Oct. 28, 2026). Read it online. ↩
6. FBI Internet Crime Complaint Center, Public Service Announcement I-091124-PSA, "Business Email Compromise: The $55 Billion Scam," September 11, 2024 (read Oct. 28, 2026). Read it online. ↩
7. Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018) (not recommended for full-text publication), opinion by Judge Siler, Justia copy (read Oct. 28, 2026). Read it online. ↩
8. North Carolina State Bar, 2015 Formal Ethics Opinion 6, "Lawyer's Professional Responsibility When Third Party Steals Funds from Trust Account," adopted October 23, 2015, Inquiries #1 to #7. Not Idaho law (read Oct. 28, 2026). Read it online. ↩
9. FBI Internet Crime Complaint Center, Internet Crime Report 2025 (released April 2026): totals, BEC and real estate figures, Recovery Asset Team and Financial Fraud Kill Chain results, recall guidance, and Idaho state table (read Oct. 28, 2026). Read it online. ↩
10. FBI Internet Crime Complaint Center, Internet Crime Report 2024 (released April 2025): BEC figures 2022 to 2024, Recovery Asset Team results, Idaho state table. No 72-hour cutoff was found in the 2024 or 2025 report text (read Oct. 28, 2026). Read it online. ↩
11. Verizon, 2025 Data Breach Investigations Report, section on business email compromise (median about $50,000; wire transfers about 88% of BEC proceeds) (read Oct. 28, 2026). Read it online. ↩
12. Idaho State Bar, Idaho Rules of Professional Conduct, introductory note: rules effective November 1, 1986, revised effective July 1, 2004, and "The Idaho Supreme Court also specifically adopted the comments to the IRPC" (read Oct. 28, 2026). Read it online. ↩
13. American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 483, "Lawyers' Obligations After an Electronic Data Breach or Cyberattack," October 17, 2018, including footnote 45 on data minimization (read Oct. 28, 2026). Read it online. ↩
14. Idaho Rules of Professional Conduct, Rule 1.1 (Competence) and Comment [8], current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
15. Idaho Rules of Professional Conduct, Rule 1.6 (Confidentiality of Information), including 1.6(b)(1) and 1.6(c), and Comment [19], current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
16. Idaho Rules of Professional Conduct, Rule 5.3 (Responsibilities Regarding Nonlawyer Assistance), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
17. Idaho Rules of Professional Conduct, Rule 1.4 (Communication), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
18. Idaho State Bar, Idaho Bar Commission Rules index page ("Rules are current on this website as of March 9, 2026") (read Oct. 28, 2026). Read it online. ↩
19. Idaho Bar Commission Rules, Section XIII, Rule 1301, Definitions, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
20. Idaho Bar Commission Rules, Section XIII, Rule 1302, Consent and Information, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
21. Idaho Bar Commission Rules, Section XIII, Rule 1303, Establishment of Trust Accounts, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
22. Idaho Bar Commission Rules, Section XIII, Rule 1304, Establishment of IOLTA Accounts, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
23. Idaho Bar Commission Rules, Section XIII, Rule 1305, Maintenance of IOLTA Accounts, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
24. Idaho Bar Commission Rules, Section XIII, Rule 1309, Administration of IOLTA Funds (Idaho Law Foundation), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
25. Idaho Bar Commission Rules, Section XIII, Rule 1306, Eligible IOLTA Financial Institutions, and Rule 1307(g) (published list), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
26. Idaho Bar Commission Rules, Section XIII, Rule 1308, Bar Counsel Review of Overdraft Notifications, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
27. Idaho Bar Commission Rules, Section VI, Rule 600, Establishment of Fund (purpose; effective for claims filed after July 1, 2014), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
28. Idaho Bar Commission Rules, Section VI, Rule 602, Appropriation to and Maintenance of Fund ($20 per member; $1,000,000), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
29. Idaho Bar Commission Rules, Section VI, Rule 604, Recognition of Claims, subsections (c) and (e), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
30. Idaho Bar Commission Rules, Section VI, Rule 605(d)(2), Recommendation of Committee, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
31. Idaho Bar Commission Rules, Section VI, Rule 609, No Legal Right to Payment, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
32. In the Matter of James W. Davis, III, No. S23Y0622 (Ga. May 14, 2024) (disbarment), as reproduced by the law.co case-law aggregator. Secondary copy only; not confirmed on the Georgia Supreme Court site (read Oct. 28, 2026). Read it online. ↩
33. Otto v. Catrow Law, PLLC, No. 19-0361 (W. Va. 2020), Supreme Court of Appeals of West Virginia, Justia case page and summary (read Oct. 28, 2026). Read it online. ↩
34. McCabe v. Talero, 2025 NY Slip Op 50597(U) (Sup. Ct. Queens County, March 31, 2025), New York Official Reports (read Oct. 28, 2026). Read it online. ↩
35. ABA Formal Opinion 515, "A Lawyer's Discretion to Report When a Client Commits a Crime Against the Lawyer or Against Someone Associated with, or Related to, the Lawyer," March 5, 2025 (citing New York City Bar Formal Opinion 2015-3). Not Idaho law (read Oct. 28, 2026). Read it online. ↩
36. Idaho State Bar, Formal Ethics Opinions page: committee opinions 1944 to 1992, Board opinion No. 136 (1999), and Opinion 137 (2024); none addresses technology, cloud computing or data breaches (read Oct. 28, 2026). Read it online. ↩
37. ABA Formal Opinion 477R, "Securing Communication of Protected Client Information," May 11, 2017, revised May 22, 2017, including its quotation of the ABA Commission on Ethics 20/20 (read Oct. 28, 2026). Read it online. ↩
38. ABA Formal Opinion 482, "Ethical Obligations Related to Disasters," September 19, 2018 (read Oct. 28, 2026). Read it online. ↩
39. McDonald Hopkins, "Businesses beware: Business email compromise liability" (law firm article, secondary source) summarizing Beau Townsend (reported at 759 F. App'x 348, citation not confirmed in a primary source), Arrow Truck Sales (M.D. Fla. 2015) and Studco Building Systems (E.D. Va. 2023, trial court ruling; later reversed); article date approximate (read Oct. 28, 2026). Read it online. ↩
40. Idaho Code, Title 28, Chapter 3, Part 4, sections 28-3-404 (Impostors, fictitious payees) and 28-3-406 (Negligence contributing to forged signature or alteration of instrument), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩
41. Idaho Code, Title 28, Chapter 4, Part 6, Uniform Commercial Code, Funds Transfers, sections 28-4-601 to 28-4-638 (added 1991, ch. 135), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩
42. Idaho Code 28-4-608, Relationship to Electronic Fund Transfer Act (amended 2013) (read Oct. 28, 2026). Read it online. ↩
43. Idaho Code 28-4-609, Security procedure (read Oct. 28, 2026). Read it online. ↩
44. Idaho Code 28-4-610, Authorized and verified payment orders (read Oct. 28, 2026). Read it online. ↩
45. Idaho Code 28-4-611, Unenforceability of certain verified payment orders (read Oct. 28, 2026). Read it online. ↩
46. Idaho Code 28-4-612, Refund of payment and duty of customer to report with respect to unauthorized payment order (amended 2004) (read Oct. 28, 2026). Read it online. ↩
47. Idaho Code 28-4-615, Misdescription of beneficiary (Idaho's version of UCC 4A-207) (read Oct. 28, 2026). Read it online. ↩
48. Idaho Code 28-4-619, Cancellation and amendment of payment order (Idaho's version of UCC 4A-211) (read Oct. 28, 2026). Read it online. ↩
49. McCarter & English, "Client Who Sent Money to Fraudster Wins Negligence Suit Against Prior Firm," March 14, 2025 (article by plaintiff's counsel; secondary source). The defendant firm's name and the docket number were not confirmed (read Oct. 28, 2026). Read it online. ↩
50. Jetcrete North America LP v. Austin Truck & Equipment, Ltd., No. 2:18-cv-01999-APG-BNW, 484 F. Supp. 3d 915 (D. Nev. Sept. 3, 2020), Leagle header; holding details from a secondary summary, opinion body not read (read Oct. 28, 2026). Read it online. ↩
51. CISA, NSA, FBI and MS-ISAC, "Phishing Guidance: Stopping the Attack Cycle at Phase One," October 2023 (read Oct. 28, 2026). Read it online. ↩
52. Iowa Judicial Branch, Office of Professional Regulation, "What is a monthly 3-way trust account reconciliation?" Iowa guidance, not Idaho law (read Oct. 28, 2026). Read it online. ↩
53. American Bar Association, Model Rules on Client Trust Account Records, Rule 1 Comment (comment on reconciliation: monthly reconciliation "is the preferred practice") (read Oct. 28, 2026). Read it online. ↩
54. Idaho State Bar, Scam Alert posts, April 7, 2023 to December 2, 2025, including "Scam Alert: Malicious Dropbox Links sent via email" (April 22, 2024) (read Oct. 28, 2026). Read it online. ↩
55. Module 110 fact sheet: no Idaho Supreme Court or Idaho State Bar public discipline record involving trust account wire fraud by impostors or client data loss was found in searches of isb.idaho.gov on October 28, 2026; absence of a found case is not proof none exists (read Oct. 28, 2026). Read it online. ↩
56. John Simek, "2023 Cybersecurity TechReport," ABA Law Practice Division, December 18, 2023, based on the 2023 ABA Legal Technology Survey (read Oct. 28, 2026). Read it online. ↩
57. FinCEN, FIN-2022-FCT1, Rapid Response Program fact sheet, February 11, 2022 (read Oct. 28, 2026). Read it online. ↩
58. Idaho Code 28-51-104 (definitions, including "personal information") and 28-51-105 (notice to affected Idaho residents; Attorney General notice required of public agencies only), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩
59. Idaho Bar Commission Rules, Section IV (Mandatory Continuing Legal Education), Rule 402(a), current as of March 9, 2026; a text search found no technology or cybersecurity credit requirement (read Oct. 28, 2026). Read it online. ↩
60. Idaho Bar Commission Rules, Section VI, Rule 611, Confidentiality (statistical information may be released), current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
61. Supreme Court of the United States, docket No. 25-80, Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union (Fourth Circuit Nos. 23-1148 and 23-1766; petition for certiorari denied Oct. 6, 2025); Spotts Fain, "Fourth Circuit: No Bank Liability For Accepting ACH Transfer Unless Actual Knowledge of Account Misdescription" (law firm summary of the Fourth Circuit's 2025 reversal, reported at 133 F.4th 264) (read Oct. 28, 2026). Read it online. ↩