Warning: Emails from an "@dutongregory․com" address, misusing the name of Dutton Gregory Solicitors

12 July 2019

An email has been sent misusing the name of Dutton Gregory Solicitors, providing supposedly new bank details to a client.

What is the scam?

An email has been sent misusing the name of a genuine firm (see below), providing supposedly new bank details to a client.

The SRA has been informed that an unknown individual registered the domain "", and subsequently sent an email to a client of the genuine firm from the email address "" – providing supposed new bank details. The scam email seen by the SRA states to the client that “you should make the remaining transfer to our other bank because of a security measure".

The email signs off misusing the name of a genuine employee at the genuine firm (see below).

Any business or transaction through the above email address (or any email address ending “”) is not undertaken by an authorised solicitor’s practice or an individual authorised or regulated by the SRA.

Is there a genuine firm or person?

The SRA authorises and regulates a genuine firm of solicitors called Dutton Gregory LLP (trading as Dutton Gregory Solicitors). The firm’s genuine email addresses end with the domain "".

The genuine firm do employ a genuine individual called Nikki Todd.

The genuine firm and employee have confirmed they have no genuine connection to the email referred to in the above alert. The firm have also stated that they will never inform clients of bank account changes via email.

What should I do?

When a firm's or individual's identity has been copied exactly (or cloned), due diligence is necessary. If you receive correspondence claiming to be from the above firm(s) or individual(s), or information of a similar nature to that described, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means. You can contact the SRA to find out if individuals or firms are regulated and authorised by the SRA and verify an individual's or firm's practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records) may be required in other circumstances.