Almost $1 million, gone from a trust account. What the VLSB+C expects you to do

Almost a million dollars, moved out of a Victorian law firm’s trust account and into an account that had nothing to do with the firm. That isn’t a what-if. It’s the case the Victorian Legal Services Board and Commissioner (VLSB+C) chose to highlight in its Risk Outlook for 2026.

Here’s what makes it worse. Money lost that way mostly doesn’t come back. Funds taken by a scam generally aren’t covered by the Fidelity Fund, even when they were sitting in your trust account. And a shortfall in trust has to be reported to the VLSB+C. So one redirected payment can become a client loss, a trust deficiency, and a regulator conversation, all at the same time.

That’s why the VLSB+C has spent the last two years making one point clear: for a law firm, cyber security is now part of running a competent practice, not a side job for whoever handles the computers.

The regulator has drawn a line

In February 2024 the VLSB+C published its Minimum Cybersecurity Expectations, a plain list of what it expects every firm it regulates to have in place. It hasn’t gone away. Cyber security is one of the four practice risks the VLSB+C put front and centre again in its Risk Outlook 2026, this time with a warning that AI-generated phishing and deepfakes are making scams harder to spot.

The expectations carry weight because of what sits behind them. The VLSB+C has said that poor cyber practices can be relevant to whether conduct amounts to unsatisfactory professional conduct or professional misconduct, and it can direct a practice to fix its systems. This lines up with your professional obligations, not only your insurance renewal.

This article explains the expectations in general terms. It isn’t legal advice on your specific obligations. For that, read the VLSB+C’s own guidance or speak to your professional body.

Start with the three it says to fix first

The expectations are grouped, and three of them are flagged as the ones to act on straight away. They’re also the cheapest. If you do nothing else this month, do these:

• Turn on automatic updates on every device used for work. Most break-ins walk through a hole that a patch had already fixed.
• Use strong, unique passwords on every work account, with a password manager so nobody is reusing the same one across their email, the practice system and their bank.
• Switch on multi-factor authentication (MFA) wherever it’s offered, email first. A stolen password on its own then isn’t enough to get in.

That’s the critical layer. The rest of the expectations build around it:

• Security software and real backups. Not backups you assume are working. Backups someone has actually restored from in a test.
• Training that fits the role. New staff at induction, everyone else refreshed at least once a year, so your people can pick a phishing email or a fake invoice.
• A verification step for any change of bank details. This is the one that stops the trust-account scam above. If an email asks you to pay a new account, or a client is sent “updated” details, someone picks up the phone and confirms it on a number you already had. Every time, no exceptions.

None of this is exotic. It’s the same set of fundamentals behind a recognised standard like SMB1001, which is a practical way to show, with evidence, that the controls are genuinely in place rather than assumed.

“We think we’re fine” is the gap

Most firms we meet aren’t reckless. They’re busy, and no one has ever shown them where they actually stand against a list like this. That uncertainty is the real exposure. If you can’t answer a client’s “how do you protect my matter?” or an insurer’s renewal question with evidence, you’re carrying the risk whether or not anything has gone wrong yet.

No one can promise you’ll never be targeted. What you can do is make the sensible controls real, keep them current, and be able to prove it. So a redirected payment gets caught before the money leaves, and so you can show a client, an insurer or the regulator that you did the right things.

The short version

The VLSB+C isn’t asking for a security team in a basement. It’s asking for the basics, done properly and kept up: updates, unique passwords, MFA, tested backups, trained staff, and a habit of verifying every payment change. Get the critical three on this week. Build the rest around them. And make it provable, because “we think we’re fine” is not the answer you want to give a client after the money’s gone.

That’s what our cyber security service for law firms is built to do, and it starts with a free Security X-Ray.