EMAIL SECURITY FOR LAW FIRMS AND CONVEYANCERSCompletion money,
sent where it should go.
Conveyancing is where an email that changes bank details does the most damage: a deposit, a completion or sale proceeds sent to a criminal's account, often late on a Friday. This is the check that stops it, and where Jatzo fits.
Note 1: Replies go to a different address
Hi Alex,
Ahead of completion on Friday, my bank details have changed, so the sale proceeds need to go to my new bank account belownote 2. The old account closes this week, so please do not use it.
Note 2: New bank details by email, days before completion
Account name: D Hughes Sort code: 11-22-33 Account number: 12345678
I am in meetings all day so email is bestnote 3. Please confirm by return once the transfer is set up so I can let the buyers know.
Note 3: Steers you away from a phone call
Thanks, Daniel
High riskJatzo's result for this fictional email
What moved the score
- Payment change with a warning sign+28
- Supplier payment details changed+16
- Reply-To domain mismatch+8
Invoice and mandate fraud, as UK Finance recorded it.
- £41.3 millionlost to invoice and mandate fraud in 2025
- 2,305cases recorded in the year
- 68%of the losses came from business accounts
Criminals intercept emails or take over an email account, then pose as a supplier, a solicitor or a builder with new bank details. UK Finance, Annual Fraud Report 2026, June 2026 (opens in a new tab)
What law firms worry about.
And what Jatzo does about each, in the inbox your team already uses.
Completion money sent to a criminal
One email with new bank details close to completion, and the firm replaces the client money from its own funds, reports to the SRA and tells its indemnity insurer.
What Jatzo does
Whoever has the email open presses Check and sees a score out of 100 with the reasons, such as replies going to another address. A High risk result emails your COLP at once.
Business and Business ProA fee earner's password, and every matter in their mailbox
A fake sign-in page that takes one password opens that person's email: client files, completion dates and the very chain a payment fraud is sent from.
What Jatzo does
The check flags requests for a password or a sign-in code, and emails borrowing a name they do not come from, before anybody types anything. Links are checked against Google Web Risk.
Every planYour firm's name on somebody else's email
The SRA warns of emails copying a real firm's letterhead from a domain one letter away from its own, asking the firm's clients for a deposit.
What Jatzo does
Domain Watch looks for new web addresses made to look like yours, and checks whether anybody could send email as your domain.
Business Pro
How it unfolds for law firms.
The chain is read
A criminal reads the email chain on a matter, or forges one, and waits.
Completion draws near
They act close to exchange or completion, when money is about to move and everybody is busy.
- Check it here
New details arrive
An email in the seller's name gives a new account for the proceeds, often on a Friday afternoon.
The money goes
Unless somebody rings the client on the number from the start of the matter, the money goes to the criminal.
The gold mark is where Jatzo's check fits: somebody has the email open and nothing has been paid yet.
The check before you pay.
Six steps, every time. Print it, put it by whoever pays the invoices, and agree that nobody skips it because somebody senior is in a hurry.
Download the one-page checklist (PDF)Never act on bank details that arrive or change by email alone, whoever appears to send them.
Ring the client or the other firm on the number on the file from the start of the matter, never a number in the email.
Check new details against documents already on file, and record the call on the file.
A second person, not the fee earner who received the email, approves any change before money moves.
For sale proceeds, send £1 first and wait for the client to confirm by phone that it arrived.
If money has gone, ring your bank's fraud line at once, then report to Report Fraud on 0300 123 2040 or reportfraud.police.uk (Police Scotland on 101 in Scotland).
Also on day one: replace the client money as the SRA Accounts Rules require, report to the SRA, and tell your indemnity insurer.
What the firm gets.
It does not replace the call. It makes sure somebody makes it. Jatzo adds a check beside the message in Outlook and Gmail, at the moment somebody decides whether to pay, reply or click, and your existing email protection stays as it is.
Check before the proceeds go
Every planA fee earner unsure about an email presses Check in Outlook or Gmail and gets a score out of 100, with the reasons, before anybody pays.
Your COLP hears at once
Business and Business ProWhen anybody in the firm checks a message scoring High risk or above, an email goes to addresses you choose at your own domain, such as your COLP's.
Web addresses that copy your firm's
Business ProDomain Watch looks for new web addresses made to look like your firm's, the trick the SRA's scam alerts describe, and checks whether anybody can send email as you.
A record for your indemnity insurer
Business ProBusiness Pro builds a dated proof pack of the checks your firm made, the training completed and the domains you watch, for an insurer's or client's questionnaire.
Training for every fee earner
Business ProBusiness Pro includes every Training Centre course for everyone in the team, Invoice and payment fraud among them, with a record of who completed it.
For the invoices the firm pays
Separate licence, from £129 a yearInvoice Fraud Checker, a separate Windows program, compares the bank details on each invoice with the ones you confirmed for that supplier.
Which plan fits: an example
For law firms with 12 people, we suggest Business Pro: £144 a month, or £1,440 a year paid annually.
That is £12 a person a month.
Domain Watch, for the lookalike web addresses the SRA warns about, and the proof pack for your indemnity insurer are both on Business Pro.
Business Pro includes the threat report, so you know what is being aimed at the firm and whether it is getting worse: every email your team checked that came back Suspicious or above, by kind of attack, the last 30 days against the 30 before, naming nobody. At the start of each month a report goes by email to the addresses you choose, saying what was checked and what is still waiting.
- The Check button in Outlook, including on a phone, and in Gmail, for everybody in the team.
- Staff do nothing. Whoever looks after your email adds it once, for everybody.
- Nothing to replace. Your email, and the protection it already has, stay as they are.
- Jatzo keeps the score and the findings for up to 90 days, never the email or its attachments.
- Pay monthly, or a year in advance for ten months' price.
The Invoice Fraud Checker is a separate licence, from £129 a year. About the Invoice Fraud Checker
What your sector's own bodies say.
Each point is linked to where it was published, with its date.
Treat a late request to change bank details as a possible cyber attack, ring the client on the number recorded at the start of the matter, and consider a £1 test payment, confirmed by the client, before the balance.
Report cyber attacks that stop transactions or put client money at risk to the SRA promptly; serious breaches must be reported under the Code of Conduct for Firms.
The SRA publishes scam alerts naming domains set up to impersonate real firms.
Report Fraud replaced Action Fraud in December 2025. The number, 0300 123 2040, did not change. GOV.UK, Report Fraud: new service from City of London Police, December 2025 (opens in a new tab)
Questions law firms ask.
Does Jatzo read our client files or the rest of the mailbox?
No. Jatzo reads only the email somebody chooses to check, and the add-in cannot reply, forward, move, delete or change anything in the mailbox. It keeps the subject line, the score and the findings for up to 90 days, never the message or its attachments. Links in it are checked against Google Web Risk.
Does it replace our call-back procedure?
No. Ringing the client on the number from the start of the matter is still the check that settles where money goes. Jatzo helps whoever reads the email notice that it needs that call, before anybody pays.
Will our IT company need to do anything?
A little, once. Whoever looks after your email proves your domain with one DNS record. For Microsoft 365 they then upload one file in the admin centre, which needs the Exchange Administrator or Global Administrator role, and Microsoft takes 24 to 72 hours to add the button. For Google Workspace they install Jatzo for the domain. Staff do nothing.
Where is our data kept?
On Jatzo's server in Germany, with encrypted backups in Finland, both in the European Economic Area. None of it is stored in the UK. What is kept is the subject line, score and findings of each check, never the email itself.
Check the next email that makes you pause.
For other businesses: Accountants; estate and letting agents; construction firms and architects; manufacturers, wholesalers and distributors; recruitment agencies; marketing and digital agencies; healthcare practices; insurance brokers and charities.