Law firm credit card payments: where trust accounting meets PCI

Can a California law firm accept credit cards for legal fees?

Yes. The State Bar of California's ethics committee concluded in Formal Opinion 2007-172 that a lawyer may ethically accept credit card payment from a client, including for fees not yet earned, provided the payment does not include an advance for costs or expenses. The opinion also found that accepting cards is not unlawful fee splitting.

That opinion was written under former rule 4-100, which permitted but did not require unearned advance fees to be deposited in trust. The current rule reads differently. California Rule of Professional Conduct 1.15(a) requires funds held for the benefit of a client, "including advances for fees, costs and expenses," to be deposited in an account labeled as a trust account. The State Bar has since prepared an issue outline (19-0001) that asks whether advance fees and costs may be paid by card, how processing charges and chargebacks should be handled, and which account the money belongs in. It also raises whether the 2007 opinion should be reconsidered in light of changes in the card processing industry, without reaching a conclusion. Firms relying on the 2007 analysis should confirm their approach with ethics counsel.

Why do card payments create trust account problems?

Card processors take money back. Processing fees, refunds and chargebacks are typically debited from the account the processor deposits into, and if that account is the trust account, the processor is reaching into client funds.

The 2007 opinion saw this clearly. It explained that card agreements let the issuer, when a consumer disputes a charge, automatically debit the merchant account, which is why a merchant account cannot serve as a trust account. Rule 1.15(c) adds a second constraint: a lawyer's own money may sit in trust only in limited cases, including "funds reasonably sufficient to pay bank charges." A chargeback on one client's payment that pulls from a pooled client trust account, such as an IOLTA account, touches other clients' money, which is the scenario trust accounting rules exist to prevent.

This is why many firms use processors built for law practices that route fees and chargebacks to the operating account while deposits land in trust. That design addresses the trust accounting side. It does not settle the card data side, which is governed by a separate set of rules.

How does PCI DSS apply to law firm credit card payments?

PCI DSS applies to any business that accepts payment cards, and a law firm is a merchant like any other. The standard is a contractual requirement set by the card brands and passed down through the firm's acquiring bank or payment processor, which is usually the party that asks the firm to complete an annual Self-Assessment Questionnaire (SAQ).

Two points matter most for a law firm. First, the firm's PCI scope depends entirely on how card numbers move through its people and systems. Second, using a compliant processor does not transfer the obligation. When the PCI Security Standards Council revised the third-party service provider requirements in PCI DSS v4.0, it clarified that using a PCI DSS compliant third-party service provider does not make an entity PCI DSS compliant. The firm still has to manage its providers and confirm its own scope, which Requirement 12.5.2 asks merchants to document at least once every 12 months.

Which SAQ fits the way your firm takes cards?

It depends on whether anyone at the firm ever types, sees or stores a full card number. The eligibility criteria in the PCI SAQ documents draw the lines:

• SAQ A covers card-not-present merchants whose account data functions are "completely outsourced" to compliant third parties, who do not electronically store, process or transmit account data on their own systems or premises, and who keep any card data only on paper. A firm that sends clients a hosted payment link and never handles the card number itself is usually in this group.
• SAQ C-VT covers merchants that manually key one transaction at a time into a third-party virtual terminal in a web browser, on a computing device "isolated in a single location" and not connected to other locations or systems. A receptionist typing card numbers from a phone call into a processor's web portal on a normal office PC typically falls outside these criteria, because that PC is connected to everything else.
• Firms whose card data touches their network, email or document systems can end up in a much broader SAQ.

The firm's acquirer decides which SAQ applies, and our guide to choosing a PCI SAQ walks through the full decision.

Where does card data leak inside a law firm?

Card numbers usually escape through ordinary habits around intake and billing:

• Clients emailing card details to an assistant, or filling them into a fillable PDF fee agreement.
• Staff writing card numbers on intake sheets that are later scanned into the document management system.
• Card authorization forms saved to the matter file alongside privileged documents.
• Voicemails in which clients read their card number aloud.

Each of these pulls the firm's email, file shares or document management system into PCI scope. It also creates a confidentiality problem. Business and Professions Code section 6068(e)(1) requires a California attorney to maintain inviolate the confidence, and at every peril to preserve the secrets, of the client, and a client's payment details stored in the matter file are part of what the firm holds.

How do trust rules and PCI scope work together?

They point in the same direction. The cleanest setup for both is one where clients pay through a hosted link or portal operated by a processor, deposits route to the correct account, fees and chargebacks route to operating, and no one at the firm ever handles a full card number. That arrangement narrows PCI scope and keeps processor debits away from client funds.

Wire fraud is the other half of payment risk at a law firm. Our piece on verifying trust account payouts covers the outgoing side.

What should a law firm fix this quarter?

• Map every way a client can pay by card today, including phone, email, paper forms and payment links.
• Confirm with your processor which account receives deposits and which absorbs fees, refunds and chargebacks.
• Search email, file shares and the document management system for stored card numbers and authorization forms, and remove what you find.
• Move clients to a hosted payment link or portal and retire paper card authorization forms.
• Ask your acquirer which SAQ applies, and record your PCI scope decision with a review date 12 months out.
• Review the 2007 opinion, current Rule 1.15 and your payment setup with ethics counsel.

How does s90 help law firms with card payments?

s90 offers PCI DSS as a solo add-on, separate from our compliance bundles, for firms that accept cards. We help map how card data moves through your office, find stored card numbers, set up the isolated environment a virtual terminal requires if you need one, and keep the annual scope record current. If card payments have crept into your intake process, we are happy to take a look.