Policy · Trust accounting & handling client money
Payment-redirection and deepfake call-back verification protocol for trust disbursements
A firm protocol that stops trust money being paid to fraudsters: bank details collected securely, changes never accepted by email, phone or video alone, independent call-back to a known number, two-person checks before each disbursement, deepfake red flags and what to do if money goes astray.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia
- AI use
- Red Keep AI out of the decisive steps. A lawyer does the work.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use for every payment of trust money to a client or third party, especially settlements, estate distributions and damages payments. It applies equally to requests that appear to come from clients, other lawyers, agents and banks.
How AI may be used
Lawyer-led. AI-enabled fraud (cloned voices, deepfake video, convincing fake emails) is the threat this protocol addresses. AI tools may help flag suspicious emails, but verification is done by people, by phone, using independently sourced numbers.
AI may
- Flag inbound emails with lookalike domains, changed bank details or urgency cues for a person to review.
- Generate training scenarios and simulated phishing exercises approved by the risk partner.
AI must not
- Must not verify identity or bank details, or confirm that a caller is genuine.
- Must not have access to banking or payment functions.
- Must not be relied on to detect deepfake voice or video.
The lawyer checks
- Every change of bank details was verified by an independent call-back recorded on the call-back form.
- Two people checked the payee details against the verified record before release.
- Staff are trained at least yearly, including on deepfake voice and video scenarios.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Trust accounting & handling client money
- Client authority to withdraw trust money for legal costs, with notice of withdrawal and pre-transfer checklist (Uniform Law)
- Review checklist for AI-assisted monthly trust reconciliation (Uniform General Rules r 48)
- Client notice: our bank details will never change by email (payment fraud and deepfake warning)
- Controls standard: AI tools and trust records (read-only access, no payment functions, audit trail)
All precedents for Trust accounting & handling client money · Tasks and AI use in this area