A Higher Standard: Are The LSO's COVID-19 Verification Protocols Enough?

Technological advances in the 21st century have forever changed the practice of law, and COVID-19 has officially turned it on its head. Gone are the ‘olden days’ of lawyers having long-standing familiar relationships with all of their clients (although this may still happen in small towns). Instead the advent of virtual practice means that geography is barely a consideration when it comes to client acquisition. A lawyer in downtown Toronto can seamlessly act for a client in Timmins for example (or vice versa) without the two ever shaking hands. 

The virtual practice of law means that lawyers are now frequently assisting clients that they may never meet face-to-face. Even though law is declared an ‘essential service’ and lawyers have been allowed to keep their doors open throughout COVID-19 lockdowns, most intake consultations are happening virtually. This also means that lawyers have had to entirely reinvent their process of confirming their client’s identification - a process which can be fraught with risk if appropriate measures are not taken.

The trouble is that when it comes to determining ‘appropriate measures’ for client identification during lockdown, a lawyer’s standard protocols simply may not be enough. 

The Law Society’s Perspective

Lawyers across Ontario are familiar with the law society’s mandate to confirm a client’s identification, usually by obtaining their photo identification such as a driver’s license or a passport, and having either yourself or a member of your staff personally view the identification to confirm that the person before you is the person pictured in the identification that they have presented. 

During COVID-19 however, the Law Society of Ontario (“LSO”) has drawn a clear distinction between identifying a client (obtaining basic information about them) and verifying a client, who is not face-to-face, through an independent source to confirm that they are who they purport themselves to be. While the requirement to verify a client’s identity face-to-face has not been repealed, the Law Society’s practice guidelines surrounding COVID-19 suggest that “until further notice, the Law Society will interpret the requirement that lawyers and paralegals verify the identity of their client face-to-face as not requiring the lawyer or paralegal to be in the physical presence of the client. Rather, alternative means of verification such as face-to-face verification via video conference will be permitted.”

In acknowledging that the lack of face-to-face contact may bring about an increased risk of fraud, the guidelines state that lawyers “must be particularly alert to these red flags to ensure they are not assisting in or being reckless in respect of any illegal activity.” Lawyers should stay alert to the presence of any red flags, and document any that may arise. If there are too many red flags, lawyers can make the decision not to proceed with the matter. While this provides some guidance, it sets a vague standard of practice. 

The guidelines go on to say that lawyers can implement virtual steps for confirming identification in tandem with their video conferencing protocols, such as “Consider requesting that the client send a high-resolution image of the identification document by secure means in advance of the video conference and asking the client to show the original identification document during the video conference.” Yet these suggestions and guidelines dance around a greater problem - fraud is on the rise in Canada, and lawyers are highly susceptible in allowing it to happen.

FINTRAC’s Higher Standard

While the LSO guidelines are intended to warn lawyers against fraudulent activity, recent reports show that fraud has only been on the rise since COVID-19 lockdowns began. A recent report from TransUnion published in the Financial Post shows that digital fraud in Canada has risen substantially since March 2020 compared to the previous year, and both businesses and consumers are being targeted. While telecommunications schemes to steal individuals’ credit card information have always been a prime method for frauding individuals, fraudsters are also taking advantage of new and sophisticated identity theft schemes within the financial services sector, which saw a staggering 159% increase in fraud attempts over the last year.

In recognition of this growing challenge, the Financial Transactions and Reports Analysis Centre of Canada (more commonly known as FINTRAC) has recently updated their rules in an effort to crackdown. New measures to be introduced next month offer multiple ways of identifying and verifying clients in financial transactions, such as through government-issued photo identification or through their credit file. When using photo identification though, the new rules explicitly state that “it is not enough to only view a person and their government-issued photo identification document through a video conference or another type of virtual application.” 

Instead, if a party is not physically present, the rules require that a process must be in place to authenticate government issued IDs. This could include using a technology that asks the person to scan their ID, and then using a sophisticated tool that can analyze and verify that the fine details of the ID such as character spacing, holograms, watermarks, or other marks characteristic of that identification are all verifiably correct. Once that happens, the client’s identification can be confirmed either during a live video chat, or through the client taking a selfie that can then be authenticated using a facial biometricAI tool. In other words, having a party in a financial transaction show you their ID while on a video conference without taking additional ID verification measures simply will not suffice.

The Solution

There is clearly then a disconnect between the standards that lawyers are held to by the LSO versus the standards imposed on banks and financial institutions by regulators such as FINTRAC. At first glance, lawyers may view the FINTRAC regulations as onerous, and simply unnecessary to comply with the requirements of their practice. 

Yet it is this exact gap that leaves lawyers susceptible to unknowingly participating in fraud. Fraudsters have become increasingly more sophisticated, and it may be difficult for some lawyers to give client verification the attention it requires when they are wrestling with a host of other competing priorities. Conducting business on behalf of a fraudulent client may have serious implications, both on anyone that will fall victim to the fraud, and on the lawyer’s ability to practice in the future. It is simply not worth the risk.