Fake Solicitor Messages: Verifying Inheritance and Crypto Recovery Claims

An unexpected inheritance or an offer to recover lost cryptocurrency can look like welcome news, especially when the sender uses a solicitor’s name, a firm name, a registration number and formal-looking documents. None of those details completes verification if every phone number, link and signature used to check the claim came from the original message.

The Solicitors Regulation Authority published a cluster of alerts from 19 to 24 August showing the same pattern under different pretexts. Its 24 August alerts covered emails misusing the names Duncan Smith and Michael Lightowler for an alleged inheritance claim, and correspondence misusing the names Melisa Suzan Fati, Manuel Jesús Martínez López and Global Legal Solutions Ltd for legal services. Alerts on 20 August described acquisition and non-disclosure documents misusing Craig Stevenson and Ernst & Young LLP, and documents misusing Elizabeth Murphy and the name “IMC International Mediation Center” to offer recovery of lost cryptocurrency. Alerts on 19 August covered trademark and legal emails borrowing the identities of genuine professionals or firms.

The stories differ, but the control points are the same. A recipient receives an unexpected approach, is given a plausible pretext, sees borrowed credibility such as a real name or registration detail, and is then pressed to pay or disclose information. If the recipient stays inside the links and contact details supplied by the sender, the sender controls the entire verification path.

Inheritance claims

Inheritance approaches often refer to a distant relative, overseas assets or a dormant account that is difficult to check quickly. The sender may say that a name match or family link makes the recipient eligible, then frame an administration fee, tax, certification charge or transfer cost as a small step toward a much larger payout.

Before replying with family or identity information, check whether the professional and firm exist in the official register. Compare the registered name, number, domain, address and telephone details. Do not treat a matching name as proof of identity. Enter the phone number from the register yourself and ask whether the stated matter reference, responsible solicitor and fee structure are genuine. Avoid opening attachments or supplying more information until that independent call is complete.

Cryptocurrency recovery offers

Recovery offers are especially sensitive because they target people who have already lost money. The UK Financial Conduct Authority describes “recovery room” scams as approaches that promise to recover previous losses in return for an upfront fee. The operators may impersonate government agencies, police or regulators, clone firms, present professional websites and demand supposed tax, legal or administration charges.

A claim that assets have been located does not prove authority to recover them. Ask which legal arrangement and contract supports the work, which regulator covers the solicitor or recovery business, and exactly who receives each payment. Check a solicitor or firm through the SRA register. If the sender describes a financial or claims-recovery service, also use the relevant financial regulator’s official checker. Type the regulator’s address directly or verify the official domain rather than following a link in the message.

Treat upfront fees, cryptocurrency transfers and payments to personal wallets as reasons to pause. Urgency, secrecy or an insistence that a fee cannot be deducted from recovered funds should send you back to the independent contact path. Even when the named professional is real, a different sender may be borrowing that identity. Confirm both the person and the matter through the registered contact details.

Contract and legal-document approaches

Acquisition papers, non-disclosure agreements, trademark documents and settlement forms can create pressure to review or sign quickly. A known company name and a real professional’s name do not authenticate a document. Separate the requested action first: signature, account login, identity upload or payment. A document link leading to a fresh login page or an attachment asking to run active content can expose a work account or device, so confirm the sender before opening it.

For an expected business matter, use an existing contact at the counterparty and your internal owner to check the title, reference and signing request. Inspect the actual sending domain and reply-to address rather than the display name. Logos and formatting can be copied; confirmation of the same matter through a known channel is harder for an impersonator to control.

Independent verification sequence

1. Pause replies, attachments, links and payments, then write down the exact action being requested.
2. Search the official register separately for the professional, firm and registration number.
3. Use a phone number or email newly obtained from the register or regulator, not from the message.
4. Confirm the matter reference, client relationship, contract, fee basis and receiving legal entity through that channel.
5. For cryptocurrency recovery or financial services, check the business through the relevant financial regulator as well.
6. Do not send identity documents, bank or wallet details, authentication codes or money until the checks agree.

Reading the register result

Finding a matching name in the official register does not authenticate the message, because an impersonator can copy public details. Compare the firm, business address, regulatory status and official telephone number as well as the name. Start a new call using the register entry and ask whether the specific matter and sender are genuine. A matching telephone number still needs a fresh call; the goal is to confirm the same matter outside the original conversation.

If several similar names appear, narrow them by location, firm and registration number. When the message omits a number, contact the firm’s registered switchboard rather than replying to request one. Record the register entry, call time and person who confirmed the result. If the real firm says it is not handling the matter, stop engaging with the original sender, preserve the evidence and follow the regulator’s scam-reporting route.

If you already replied or shared information

Preserve the conversation, full email headers, attachment names, phone numbers and payment instructions. If you reused a password, change the email account password first and enable multi-factor authentication. If you signed in through a link, use the service’s official app or a directly typed address to change the password and review login activity and connected devices.

For a bank transfer or card payment, contact the financial provider through its official customer channel immediately and request the available payment-stop, dispute and account-protection steps. For a cryptocurrency transfer, provide the transaction identifier and destination address to the exchange or wallet provider’s official support channel and secure the account. Report the preserved evidence through the official channels of the relevant police and regulator. Do not pay an additional fee to the original sender for a promised refund.

A name and registration number are only a starting point. Verification is complete when the same professional and the same matter are confirmed through an independent official channel.