If a third party steals from a North Carolina lawyer's trust account through counterfeit checks, hacking, or a spoofed wire request, must the lawyer replace the stolen client funds?

Plain-English summary

The opinion addresses a lawyer's professional responsibilities (not legal liability) when a third party steals from the lawyer's trust account, across several scenarios: counterfeit checks honored by the bank, a hacker who electronically drains the account, and a spoofed-email scheme that redirects a real estate disbursement. The throughline is reasonable care under Rule 1.15.

In Inquiry #1 (counterfeit checks), where the lawyer properly supervised staff under Rule 5.3 and maintained and reconciled the account under Rule 1.15-3, had no knowledge of the fraud, and no chance to prevent it, the lawyer is not professionally required to replace the funds. The committee states the governing principle: if the lawyer managed the account in substantial compliance with Rules 1.15-2, 1.15-3, and 5.3 but is victimized by third-party theft, the lawyer need not replace the funds; but if the lawyer's failure to follow those rules was a proximate cause of the theft, the lawyer may be obligated to replace them. Under all circumstances the lawyer must promptly investigate, seek every remedy (researching and pursuing the bank's liability and insurance, considering moving to a new trust account, and working with law enforcement), and protect the remaining funds. Inquiries #2 and #3 address outstanding checks after a theft: the lawyer must take reasonable measures so one client's funds are not used for another's obligations (stop payments, a list of outstanding checks to the bank, alerting payees), and need not deposit personal funds to cover checks if the account is short, but should notify payees if checks will not clear.

Inquiry #4 (hacker drains the account) reaches the same reasonable-care result, citing 2011 FEO 7's affirmative duties to learn online-banking security risks, maintain end-user security (strong passwords, encryption, security software, an IT consultant), and train staff; a lawyer who took reasonable care need not replace the funds, but one whose lapse proximately caused the theft may have to. Inquiry #5 (spoofed disbursement email in a closing) comes out the other way: because the lawyer wired funds on changed instructions without verifying by phone or confirming the email address, the lawyer failed to use reasonable security measures that could have prevented the theft and must replace the funds (subject to later reimbursement if the bank is responsible or insurance covers it). Inquiry #6 permits the lawyer to deposit personal funds into the trust account to replace stolen funds despite the anti-commingling rule (Rule 1.15-2(f)), with proper records. Inquiry #7 sets the duties to affected clients: notify them of the theft and its consequences, help identify sources of recovery, defer the matter if needed, and report the theft to the State Bar's Trust Accounting Compliance Counsel.

In practice

Under the North Carolina rules as they stood at the time of the opinion, the committee ties professional responsibility to replace stolen trust funds to whether the lawyer used reasonable care. Per the opinion, a lawyer who kept the account in substantial compliance with Rules 1.15-2, 1.15-3, and 5.3 and (for electronic theft) implemented the reasonable security measures described in 2011 FEO 7 is not professionally obligated to replace funds taken by a third party. The opinion holds the opposite where the lawyer's failure to follow the trust-accounting or security rules was a proximate cause of the theft, illustrated by Inquiry #5, where wiring funds on a spoofed email without a verifying phone call or email-address confirmation made the lawyer professionally responsible to replace the funds.

The opinion also states ongoing duties that do not depend on fault: the lawyer must promptly investigate, pursue every remedy (bank liability, insurance, law enforcement), protect remaining funds so one client's money is not used for another's checks, may deposit personal funds to restore the account notwithstanding Rule 1.15-2(f), and must notify affected clients and report the theft to the State Bar's Trust Accounting Compliance Counsel.

Common questions

Q: If a thief forges checks on a North Carolina lawyer's trust account, must the lawyer replace the funds?

A: Not if the lawyer maintained and reconciled the account under Rule 1.15-3 and properly supervised staff under Rule 5.3 and had no chance to prevent it. Opinion #1 holds a lawyer in substantial compliance who is victimized by third-party theft need not replace the funds.

Q: Does the answer change if a hacker drains the account online?

A: No, if the lawyer took reasonable care. Opinion #4 applies 2011 FEO 7's duties to learn online-banking risks, maintain end-user security, and train staff; a lawyer who did so need not replace the funds, while one whose lapse proximately caused the theft may have to.

Q: What about wiring funds based on a spoofed email in a closing?

A: There the lawyer must replace the funds. Opinion #5 holds that wiring on changed instructions without verifying by phone or confirming the email address was a failure to use reasonable security measures, making the lawyer professionally responsible.

Q: Can the lawyer put personal money into the trust account to cover the loss?

A: Yes. Opinion #6 holds that, despite the anti-commingling rule (Rule 1.15-2(f)), the lawyer may deposit personal funds to replace stolen funds, keeping records of the source, reason, date, and the clients and matters involved.

Q: What does the lawyer owe the affected clients?

A: Opinion #7 requires the lawyer to notify the clients of the theft and its consequences, help identify recovery sources, defer the matter if needed to protect their interests, take the remedial steps in Opinions #1 and #2, and report the theft to the State Bar's Trust Accounting Compliance Counsel.

Background and rules framework

The opinion interprets the safekeeping-property and supervision rules. Rule 1.15 (Model Rule 1.15) requires a lawyer to preserve client property, deposit entrusted funds in a separate trust account, and manage it under strict recordkeeping rules; Rule 1.15-2 sets general handling duties, Rule 1.15-2(f) bars commingling with limited exceptions, and Rule 1.15-3 sets records and reconciliation. Rule 5.3 (Model Rule 5.3) requires supervision of nonlawyer assistants. The committee reads these to require reasonable care to minimize risks to entrusted funds.

The committee relies on RPC 191 and 1997 FEO 9 (fiduciary duties and exceptions to the anti-commingling rule), and on 2011 FEO 7 for the affirmative cybersecurity duties that define reasonable care for online banking.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.15 / NC Rule 1.15-2, 1.15-2(f), 1.15-3 (safekeeping property; anti-commingling; records and reconciliation)
• Model Rule 5.3 / NC Rule 5.3 (supervision of nonlawyer assistants)

Statutes:

• N.C. Gen. Stat. § 25-4-406 (customer's duty to discover and report unauthorized items, cited as an example)

Other opinions cited:

• RPC 191: a lawyer is responsible for reimbursing the trust account for losses from disbursing against provisionally credited funds.
• 1997 FEO 9: exceptions permitting a lawyer to deposit personal funds in a trust account to safeguard entrusted funds.
• 2011 FEO 7: affirmative duties to learn online-banking security risks, maintain end-user security, and train staff who manage the trust account.

See also

• Alaska Op. 2025-2: Safeguarding Trust Funds From Fraud
• NC State Bar 2020 FEO 5: Avoiding Fraudulent Attempts to Obtain Entrusted Funds
• CA COPRAC Op. 2010-179: Confidentiality and Competence Using Technology

Source

• Landing page: https://www.ncbar.gov/for-lawyers/ethics-and-governing-rules/ethics-opinions/opinions/2015-formal-ethics-opinion-6/

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

NOTE: This opinion is limited to a lawyer’s professional responsibilities and is not intended to opine on a lawyer’s legal liability.

Inquiry #1:

John Doe, a third party unaffiliated with Lawyer, created counterfeit checks that were identical to Lawyer’s trust account checks. John Doe made the counterfeit checks, purportedly drawn on Lawyer’s trust account, payable to himself and presented the counterfeit checks for payment at Bank. Bank honored some of the counterfeit checks. As a consequence, client funds held by Lawyer in his trust account were utilized for an unauthorized purpose. Lawyer properly supervised all nonlawyer staff participating in the record keeping for the trust account. Lawyer also maintained the trust account records and reconciled the trust account as required by Rule 1.15-3. Lawyer had no knowledge of the fraud and had no opportunity to prevent the theft.

Does Lawyer have a professional responsibility to replace the stolen funds?

Opinion #1:

No.

A lawyer who receives funds that belong to a client assumes the responsibilities of a fiduciary to safeguard those funds and to preserve the identity of the funds by depositing them into a designated trust account. Rule 1.15-2, RPC 191, and 97 FEO 9. The responsibilities of a fiduciary include the duty to ensure that the funds of a particular client are used only to satisfy the obligations of that client. RPC 191 and 97 FEO 9. Rule 1.15-3 requires a lawyer to keep accurate records of the trust account and to reconcile the trust account. A lawyer has an obligation to ensure that any nonlawyer assistant with access to the trust account is aware of the lawyer’s professional obligations regarding entrusted funds and is properly supervised. Rule 5.3.

If Lawyer has managed the trust account in substantial compliance with the requirements of the Rules of Professional Conduct (see Rules 1.15-2, 1.15-3, and 5.3) but, nevertheless, is victimized by a third party theft, Lawyer is not required to replace the stolen funds. If, however, Lawyer failed to follow the Rules of Professional Conduct on trust accounting and supervision of staff, and the failure is a proximate cause of theft from the trust account, Lawyer may be professionally obligated to replace the stolen funds. Compare RPC 191 (if a lawyer disburses against provisionally credited funds, the lawyer is responsible for reimbursing the trust account for any losses caused by disbursing before the funds are irrevocably credited).

Under all circumstances, Lawyer must promptly investigate the matter and take steps to prevent further thefts of entrusted funds. Lawyer must seek out every available option to remedy the situation including researching the law to determine if Bank is liable;1 communicating with Bank to discuss Bank’s liability; asking Bank to determine if there is insurance to cover the loss; considering whether it is appropriate to close the trust account and transfer the funds to a new trust account; and working with law enforcement to recover the funds.

Inquiry #2:

Prior to learning of the fraud and theft from the trust account, Lawyer issued several trust account checks to clients and/or third parties for the benefit of a client. Despite the theft, there are sufficient total funds in the trust account to satisfy the outstanding checks. However, because of the theft, funds belonging to other clients will be used if the outstanding checks are cashed.

What is Lawyer’s duty to safeguard the remaining funds in the trust account?

Opinion #2:

Lawyer must take reasonable measures to ensure that funds belonging to one client are not used to satisfy obligations to another client. Such reasonable measures include, but are not limited to, requesting that Bank issue stop payments on outstanding trust account checks; providing Bank with a list of outstanding checks and requesting that Bank contact Lawyer before honoring any outstanding checks; and determining if Bank is liable and, if so, demanding the outstanding checks be covered by Bank. If Lawyer determines Bank is not liable or liability is unclear, Lawyer must maintain the status quo and prevent further loss by not issuing new trust account checks. If payment will be stopped on the outstanding checks, Lawyer must contact the payees and alert them to the problem.

Inquiry #3:

Assume the same facts in Inquiry #2 except there are insufficient funds in the trust account to satisfy the outstanding checks. Must Lawyer deposit funds into the trust account to ensure that the outstanding checks are not presented against an account with insufficient funds?

Opinion #3:

No. In addition to the remedial measures listed in Opinion #2, Lawyer should notify the payees if Lawyer knows that the checks will not clear.

Inquiry #4:

Hacker gains illegal access to Lawyer’s computer network and electronically transfers the balance of the funds in Lawyer’s trust account to a separate account that is controlled by Hacker. Lawyer’s trust account now has a zero balance. Lawyer has written several trust account checks to clients and/or third parties for the benefit of clients. Because of the theft, there are insufficient funds in the trust account to satisfy the outstanding checks.

Does Lawyer have a professional responsibility to replace the stolen funds?

Opinion #4:

No, Lawyer is not obligated to replace the stolen funds provided he has taken reasonable care to minimize the risks to client funds by implementing reasonable security measures in compliance with the requirements of Rule 1.15.

Rule 1.15 requires a lawyer to preserve client property, to deposit client funds entrusted to the lawyer in a separate trust account, and to manage that trust account according to strict recordkeeping and procedural requirements. To fulfill the fiduciary obligations in Rule 1.15, a lawyer managing a trust account must use reasonable care to minimize the risks to client funds on deposit in the trust account. 2011 FEO 7.

In 2011 FEO 7 the Ethics Committee opined that a lawyer has affirmative duties to educate himself regularly as to the security risks of online banking; to actively maintain end-user security at the law firm through safety practices such as strong password policies and procedures, the use of encryption and security software, and the hiring of an information technology consultant to advise the lawyer or firm employees; and to insure that all staff members who assist with the management of the trust account receive training on and abide by the security measures adopted by the firm.

If Lawyer has taken reasonable care to minimize the risks to client funds, Lawyer is not ethically obligated to replace the stolen funds. If, however, Lawyer failed to use reasonable care in following the Rules of Professional Conduct on trust accounting and supervision of staff, and the failure is a proximate cause of theft from the trust account, Lawyer may be professionally obligated to replace the stolen funds.

Inquiry #5:

Lawyer is retained to close a real estate transaction. Prior to the closing, Lawyer obtains information relevant to the closing, including the seller’s name and mailing address. Lawyer also receives into his trust account the funds necessary for the closing. Lawyer’s normal practice after the closing is to record the deed and disburse the funds. Lawyer then mails a trust account check to the seller in the amount of the seller proceeds.

Hacker gains access to information relating to the real estate transaction by hacking the email of one of the parties (lawyer, realtor, or seller). Hacker then creates a “spoof” email address that is similar to realtor’s or seller’s email address (only one letter is different). Hacker emails Lawyer with disbursement instructions directing Lawyer to wire funds to the account identified in the email instead of mailing a check to seller at the address included in Lawyer’s file as previously instructed.2 Lawyer follows the instructions in the email without first implementing security measures such as contacting the seller by phone at the phone number included in Lawyer’s file to confirm the wiring instructions. After the closing and disbursement, the true seller calls Lawyer and demands his funds. Lawyer goes to Bank to request reversal of the wire. Bank refuses to reverse the wire and will not cooperate or communicate with Lawyer without a subpoena.

While pursuing other legal remedies, does Lawyer have a professional responsibility to replace the stolen funds?

Opinion #5:

Yes. Lawyers must use reasonable care to prevent third parties from gaining access to client funds held in the trust account. As stated in Opinion #4, Lawyer has a duty to implement reasonable security measures. Lawyer did not verify the disbursement change by calling seller at the phone number listed in Lawyer’s file or confirming seller’s email address. These were reasonable security measures that, if implemented, could have prevented the theft. Lawyer is, therefore, professionally responsible and must replace the funds stolen by Hacker. If it is later determined that Bank is legally responsible, or insurance covers the stolen funds, Lawyer may be reimbursed.

Inquiry #6:

While pursuing the remedies described in Opinion #2, may Lawyer deposit his own funds into the trust account?

Opinion #6:

Yes.

Generally, no funds belonging to a lawyer shall be deposited in a trust account or fiduciary account of the lawyer. Rule 1.15-2(f). The exceptions to the rule permit the lawyer to deposit funds sufficient to open or maintain an account, pay any bank service charges, or pay any tax levied on the account. Id. The exceptions were expanded in 1997 FEO 9 to include the deposit of lawyer funds when a bank would not route credit card chargeback debits to the lawyer’s operating account. These exceptions to the prohibition on commingling enable lawyers to fulfill the fiduciary duty to safeguard entrusted funds.

Therefore, notwithstanding the prohibition on commingling, Lawyer may deposit his own funds into the trust account to replace the stolen funds until it is determined whether the Bank is liable for the loss, insurance is available to cover the loss, or the funds are otherwise recovered. If Lawyer decides to deposit his own funds, he must ensure that the trust accounting records accurately reflect the source of the funds, the reason for the deposit, the date of the deposit, and the client name(s) and matter(s) for which the funds were deposited.

Inquiry #7:

With regard to all of the situations described in this opinion, what duties does Lawyer owe to the clients whose funds were stolen?

Opinion #7:

Lawyer must notify the clients of the theft and advise the clients of the consequences for representation; help the clients to identify any source of funds, such as bank liability and insurance, to cover their losses; defer a client’s matter (by seeking a continuance, for example) if necessary to protect the client’s interest; and explain to third parties or opposing parties as necessary to protect the client’s interests. If stop payments are issued against outstanding checks, Lawyer must take the remedial measures outlined in Opinions #1 and #2 to protect the client’s interest. Finally, Lawyer must report the theft to the North Carolina State Bar’s Trust Accounting Compliance Counsel.

End Notes

• See e.g. N.C. Gen. Stat. §25-4-406.

• The inquiry assumes that Lawyer believed that, by wiring the funds to the account designated in the email, he was disbursing the funds to the seller as required by the settlement statement. This opinion does not address the issues of professional responsibility raised when a lawyer knowingly makes disbursements contrary to a settlement statement.