Alleg

heny County B

ar Association

400 Koppers Building, 436 Seventh Avenue

Pittsburgh, PA 15219-1818

Address Service Re

quested

Non-Profit Org.

U.S. Postage

PAID

Pittsburgh, PA

Permit #130

Vol. 17 No. 9 May 1, 2015The Journal of the Allegheny County Bar Association

Bench-Bar Conference promises exceptionalnetworking and educational opportunitiesby Tracy Carbasho

Three days of camaraderie, educationand entertainment will make the 53rdAnnual ACBA Bench-Bar Conferenceanother unforgettable experiencefor attendees at the Seven SpringsMountain Resort.The nationally recognized conference

will get under way on the morning ofThursday, June 18, with a full scheduleof social events, athletic activities andeducational programs. Highlightswill feature four receptions, nightlyentertainment, 14 educational programswith the ability to earn eight hours ofContinuing Legal Education credit,sporting events, door prizes, music andfabulous food, including the Thursdaynight barbeque and the grand surf andturf buffet on Friday night.In addition, ACBA President Jim

Creenan will pass the gavel to MarkMartini, who will assume the presidencyin July. The Amram Award will also bepresented to an individual whoepitomizes the ideals of the honor’snamesake, Philip Werner Amram. Theconference will conclude with abreakfast and closing remarks onSaturday, June 20.This year’s guest speaker will be

Debora Spar, president of BarnardCollege. Her keynote address on Friday,June 19, will provide two substantiveCLE credits. She is described as alively speaker with an extraordinarystory-telling acumen that enables herto make difficult issues interesting.Spar’s scholarly research focuses

on issues of international politics andeconomic matters, examining howrules are created in new and emergingmarkets and how firms and governmentswork together to shape the evolving

global economy. She is the authorof several books, including Wonder Women: Sex, Power andthe Quest for Perfection; and Ruling the Waves: Cycles ofInvention, Chaos and Wealthfrom the Compass to the Internet.ACBA lawyer members are

urged to take advantage of theearly registration fee of $305 toattend the ACBA’s signatureevent. Online registration canbe completed on the association’swebsite at www.acba.org. Theearly registration deadline isFriday, May 22. The regularregistration deadline is Friday,June 5. Approximately 700people are expected to attend.“There is no other conference

where registrants can geteight hours of CLE credit froman excellent array of 14 programs from which tochoose, along with the receptions, meals and entertainment that they getfor the registration fee,” saidDorie Schnippert, director ofMembership Services andthe CLE Department for theACBA. “Then, add all of thenetworking opportunities,business developmentopportunities and the ability to haveone-on-one conversations withmembers of the judiciary. It really is ano-brainer to attend the conference.”Nobody knows better than

Schnippert how the conference canlead to long-lasting friendships, business relationships and treasuredmemories. She attended her first conference in 1973 and became theACBA’s staff point person for organizingthe event in 1985.“The continuation of the conference

over the past 53 years has fostered thecollegiality and camaraderie that

started so many years ago,” she said.“It is my responsibility to try to makeit an experience that will help thosethings carry on into the future. I takea lot of pride in my work.”Craig Simpson is serving as the

conference chair this year with BobRacunas as vice chair. They have bothenjoyed working with the peoplewho are committed to making theconference a success.“The conference has been a great

opportunity to make and renew friendships,” said Racunas. “It is always

surprising howmuch business andhow many referralsare conducted andmade over the threedays. Attend onceand you will behooked. You will beback every year.”Simpson said he is

most looking forwardto two things this year.First, he is excitedabout the new venueswhere some of theactivities will be held.Secondly, his stepsonis a new attorney whowill be attending theconference for thefirst time.The biggest change

to this year’s conferencewill be the entertainmentvenues on Thursday andFriday night. In particular,Simpson said the FoggyGoggle and the newlybuilt Foggy Brew, bothlocated in the Ski Lodge,will be utilized for thefirst time. Simpson encourages

seasoned attendees and thosewho have never attendedthe conference to make an

appearance this year.“Seasoned veterans know the many

advantages of attending the conferenceand need very little convincing toreturn,” said Simpson. “To newattendees, I would simply say thatattending the conference is the bestway to become acclimated to andfamiliar with the legal community inAllegheny County in general andthe judges in particular. Therefore,it is the best way to jump start your career.” n

Page 6 / May 1, 2015

Co

ontre cers morywparties and their lat, and throser cwt a lo, as timelesses and p tz helps businesaole KCar

•

or theourt ftrict CUS Dis

ers:tosanels & Red PvoAppr•

FromResolto

nflict

.omecer the outvol oret givses thaesocough pr

onflicts ine cesolv people r

yompanortune 500 CFe ofecutivormer ExSeasoned F

ution.

tionaluavCase EtionaArbitrtionMedia

•

•

ortaor and ArbitrtFINRA Media–ortaor and ArbitrtA MediaAA–

orteMedia,er,tMasSpecial ery voeDisc•

ortourt Mediay CcBankrupt•

orta, Arbitror, taluavEal , Early Neutror, tMedia•

Atrict of Pern Distes Wor theourt ftrict CUS Dis–

ountyy CAllegheners, ywrial Lay of TcademA

ounseloregal Cand Lerywrial Laears as Ter 25 Ye Ov

yp

•4 74 12.916.484cial/BusineommerC• yment Emplo

omctz.aolek cargyEnersional Libability • esof Pr•s es

The anatomy of a lawyer engagement fraud scamby Gregg R. Zegarelli

In managing my law firm for morethan 25 years, I have received my shareof high-risk client engagement attempts.But now, with the integration of the

Internet and less personal engagements,these attempts are getting even moreclever. Sure, we will probably alwayshave the call from a potential client,professing a huge opportunity in acase, only to determine – for the luckyor prudent ones, as the case may be –that a hearing is the next day. (I callthis the “Dropping a Bomb on Me”engagement attempt.) But, theinternational identity theft engagementattempt that happened to my firmrecently, was quite sublime. I almostrespect it, like a scientist might almostrespect the “cleverness” of a virus.There are many well-known

engagement scams directed towardattorneys. One paradigm is to engageyour law firm to collect a debt. Thecommunication is by electronic mail,sometimes because of internationaltime differences. The new clientprovides a retainer by check. Then,the client informs you that the caseindependently settled.The client gladly (and possibly

generously) pays you from the retainerfor your work during case assessment,and requests a return of the balance.The firm returns the balance of funds,only to find out later that the originalfunds were never finally paid andcleared by the bank; therefore, thereturned funds were paid from otherclient IOLTA funds. Not good.Another paradigm uses the attorney’sIOLTA account to launder money. Notgood either.I once taught a Continuing Legal

Education course professing the benefitsof electronic client engagement/signaturesystems. An “old-school” seniorlawyer retorted from the audiencethat electronic engagement proceduresare dangerous because of fraudattempts and not personally knowingyour client. My response was simplythat it is a judgment call for each lawpractice in its own operational context,but the efficiency of new technologiesis not intended to replace prudentclient engagement scrutiny by the firm. However, his point is particularly

well-taken in light of this most recentidentity-theft engagement attempt. Ishare this paradigm as a type ofpreventative warning, because I dothink some excellent attorneys willbecome victims, such as even thebest scientists, I suppose, willsometimes simply forget to washtheir hands. I will summarize andparaphrase for convenience.

The first contact is an email. (Toprotect the yet unauthenticatedactors, we will change the names.)The email is from Rolf Doe at Solid-IntlCorpAG, apparently in Germany.Rolf writes, “Mr. Zegarelli. Can youhelp us collect an overdue debtagainst BigUSAHealthCo, Inc.?”My office gets its fair share of these

types of email inquiries, and I willnormally ignore the email or respondwith a rote pushback. Something like,“Thank you for your interest. Myfirm is a quality firm and will requireauthentication of your identity priorto any engagement. We apologize forthe formality.”Now, I must tell you that, in

responding, I have confirmed myemail address, but I take that risk. Inthis case, my name was used, therewere no typographical errors in therequest, and my firm has spamtechnologies to stop lesser fraudattempts. In any case, this has stoppedthe conversation in the past; manydefrauders will simply divert to someonewho would not try to authenticatethem. But not this time.A few days later, behold, I have a

response, “Mr. Zegarelli, how will weproceed with that?” This is what gotme to bite, just a nibble. I never had awould-be defrauder inquire about theprocess of authentication. In my mind,the probability for this being a realengagement significantly increased.So now, I invest some time into “kickingthe tires” of the apparent opportunity.First, I notice that he is using

rolf.doe@SolidIntlCorpAG.com. (Goodfactor. If he were using, e.g., gmail orhotmail, it would have been a negativeflag.) Second, I do some cross-checking.I check to see if www.SolidIntlCor-pAG.com is a live website, which it is(good factor). Then, I checkhttps://who.godaddy.com to see whenthe domain name was purchased,which was within one year (badfactor), although not marked privateownership (good factor). Also, thewww.SolidIntlCorp.com (no “AG”suffix) was live with a matchingwebsite (good factor). Then, I go ontoLinkedIn.com to see if Rolf Doe existsas a professional and he does and withthe stated officer position at SolidIntl-Corp. He even has long-term connectionsand personal recommendations.But, all that is just high-level

circumstantial. So, now I bait himwith a hedge: I neither want toinsult him with too much distrustfulauthentication overhead (he’s real,after all…maybe), nor am I yetcomfortable that his identity isproperly authenticated and legitimate.“Hi Rolf. We can finalize authentication

at or prior to the point of engagement,if we decide to move forward withrepresentation. However, so that I canassess your question, please provideme with a copy of the basic evidencefor an overview of what is going on.Also, I will need the contact informationof the involved persons and theaddress of BigUSAHealthCo, Inc. inmy location.”If he is a defrauder, producing some

evidence and details will certainlymake him go away, right?Well, the next day, he actually

complies. I receive a purchase orderwith terms, and pdf of an email threadinvolving a variety of people addressingthe dispute. As to the purchase order,I do some math and determine that thetotal of $1.5M is correct, but there is asubtotal error. BigUSAHealthCo wouldprobably not make a subtotal error.I check the date of the purchase

order that does not seem to be correctfor the dispute. I check the address ofBigUSAHealthCo and it checks out.There is an 866 number on the purchaseorder, so I call (simply using my officecaller ID) and it answers. It is anautomated digital voice with a list ofrelevant names to deposit voicemail,but the personnel list is finite.The voicemail attendant offers me

to dial 0 for the operator. I dial the 0and it immediately disconnects. I trieda few times with the same result. Itis not necessarily intuitive, butauthenticating the would-be defendantprovides an important clue to thelegitimacy of the client request.Some defrauders do not use realdefendant entities.As to the pdf evidence email thread,

it appears to be a real conversationaldispute, but it is a pdf and not thesource emails; therefore, I cannotcheck the source email meta-data toverify that the purported conversantswere, indeed, the senders of therespective emails in the thread. Icheck the human names in the threadby googling and LinkedIn, and theyare living people with respected jobs.However, they do not necessarilydisclose the correct relationshiprelevance with SolidIntlCorpAG.At this point, with so many good

and bad factors, I consider the entirecontext a learning experience. Afterall, I will get either a good client or agood CLE war story for my courses, soI go with it. I send my standardengagement email that requires aclick-through acceptance of my firm’sonline terms and conditions, butwith three modifications: 1) Withoutproviding my wire information, Irequire a retainer; the retainer mustbe by a wire, instructions for which

will be provided as a final step in theengagement process. Wiring fundsprovides immediately available fundsand an important level of wiring bankauthentication. 2) I require that Rolflink to me on LinkedIn. This connectsthe author of the emails with the“apparent” human listed on LinkedIn.The person on LinkedIn will not knowto connect with me unless there is aconnection with the author of theemails. 3) I caveat that I am stillreviewing the evidence and reservethe right to require additional evidencebefore accepting the engagement.This is because I want to flush out thefirst factors, but I still have thereservation to be satisfied with whythere are amount and date problemson the purchase orders, and I willwant to see the source emails (throughemail forwarding) to authenticatethe email conversants from theemail meta-data. I did not receive any response on

that day or the next. So, I send afollow-up email to Rolf and it getsreturned to me “undeliverable.” Uh-oh.(I am not quite sure if I am happy orsad about it.) Now, I log onto LinkedInand send an “InMail” (LinkedIn’s internalemail system) to Rolf, “Rolf, I sent youthe engagement letter you requested toyou at rolf.doe@SolidIntlCorpAG.com...”to which he immediately responded, “Idon’t know what you’re talking about…” What the would-be defrauder did

was take the time that is not customaryto: 1) purchase a domain name with areasonable extension, such as the“AG” or “Inc” and then point/forwardthat domain to the authentic site, sowhen you go to the AG site, you areviewing the authentic site; 2) establisha virtual 866 telephone number withsome digital voicemail technologies;3) spoof emails to appear from theofficial company site (with or withoutthe AG suffix); 4) research some livinghuman names in the authentic companyor related industries; and 5) fabricatepurchase orders, using logo graphicsnow obtainable online from theauthentic websites. In my view, theultimate failure of the scheme wasbecause I required a wire transfer andthe LinkedIn connection.With the understanding that we

still do not really know if LinkedInRolf is would-be client Rolf, thissituation provides some importantpoints to consider. 1. Domestic contacts tend to be

rather easily authenticated, because atelephone call is customary. It is theinternational opportunity that providesa variety of “legitimate excuses” foruse of electronic communications.Therefore, potential international

May 1, 2015 / Page 7

OUR COMPUTER FORENSIC EXPERTISE.

NOW IN A BOX.

We get it. sm

Presenting bit-x-bit in-a-box.™ Our small kit is packed with everything you need to collect and preserve electronic evidence – affordably and easily. It’s like we are right there with you. Learn more by calling 412-325-4033, or visit us at bit-x-bit.com.

clients are inherently cause for higherengagement scrutiny.2. Review emailed engagement

requests carefully. It may or may notbe too good to be true; it may just begood enough to defraud you for a fewthousand dollars. Look for typographicalerrors or unusual syntax; look for useof your personal name. Determine ifthe email matches the companydomain. Determine if the email isfrom an informal consumer mail service(e.g., Hotmail, AOL, Gmail) and not aprivate domain source (e.g.,@zegarelli.com). Check the emailmeta-data. There is hidden data inemails that provides evidenceregarding senders and the sentpathway details. (Google somethinglike, “how to view headers [e.g., outlook2010, gmail, hotmail]” to see how yourown email package allows you to viewthe meta-data.)3. From unauthenticated sources,

consider only wire transfers to ensureavailability of funds and authenticationrecord-keeping by the sender bank.Checks and credit cards have risks offinally-paid delays and chargebacks.4. Obtain definitive party contact

information and google the identities.Ensure that the people and companiesexist. Depending upon the context andapplicable standards, perform duediligence on contact information.5. Consider requesting confirmation

by social media links, which can

assist with flushing out stolen orspoofed identities.6. Review the evidence carefully.

Look for unusual flaws. Check forreconstituted emails.There are also certainly less technical

ways to authenticate a new internationalclient request. For example, if thefirm has access to a multilingualresource, an international telephonecall would, of course, force a level ofauthentication. Also, consider askingfor referrals or an internationalcontact for existing legal counsel inthe international venue. In conclusion, this particular

situation demonstrates the lengths towhich a would-be defrauder will go toimplement the fraud. That is, tomanufacture evidence, spoof identitiesand to establish telephonic contactpoints. In the digital and virtualshrinking world, we increasingly donot personally know our clients in thesame physical way that has beencustomary. Nevertheless, we remainprofessionally responsible for prudentengagement practices and, hopefully, theabove assists with exposing some of thelatest schemes and risks with technicalguidance for your consideration. n

Copyright © 2015 Gregg R. Zegarelli,Managing Shareholder, Technology &Entrepreneurial Ventures Law Group,P.C., www.zegarelli.com. Mr. Zegarelli isa frequent CLE instructor and lecturerfor a variety of educational institutions.

Need new clients? We’ll help bring them to you.

www.PittsburghFindaLawyer.org.

The Allegheny County Bar Association Lawyer Referral Service staff made over 4400 referrals to participating panel members in 2013 and our referrals generated close to HALF A MILLION dollars in attorneys fees for our panel attorneys.

Those interested in applying for panel membership must complete an application, pay a $220 annual panel membership fee and submit proof of professional liability insurance.

To receive an application please contactWhitney Hughes, Esq. at 412-402-6703.

YOU CANNEVERH A V EENOUGHCLIENTS.

Let the

bring you even more!

436 Seventh Avenue, 3rd Floor, Koppers BuildingPittsburgh, PA 15219

www.acba.org