The email looks routine. Opposing counsel's paralegal sends updated wiring instructions for a settlement payment. The signature block is right. The case number is right. The tone matches every other message in the thread.
The only thing wrong is the bank account. And by the time anyone notices, the money is gone.
This is business email compromise, often shortened to BEC. For law firms, it's one of the most expensive and embarrassing threats there is, because it targets the exact moment when large sums move on a client's behalf.
What Business Email Compromise Looks Like in a Legal Practice
BEC isn't usually a virus. It's a con. Attackers either break into a real email account or create a look-alike address that's one letter off. Then they wait for the right moment to insert themselves into a conversation about money.
In law firms, the most common targets are:
- Settlement disbursements where funds move to or from opposing counsel.
- Trust account transfers involving client funds.
- Real estate closings handled by the firm.
- Vendor payments such as court reporters, experts, or e-discovery providers.
- Client retainers where a fake message asks the client to pay into a new account.
The FBI's Internet Crime Complaint Center (IC3) consistently ranks business email compromise among the costliest types of reported cybercrime.
Warning Signs Worth Pausing For
Most BEC attempts share a few patterns. None of them prove fraud on their own, but each one is a reason to slow down.
A change in payment instructions
This is the biggest red flag. Legitimate parties rarely change bank details in the middle of a matter. Any change should be treated as suspicious until confirmed by phone.
Urgency that discourages checking
"The court needs this today." "Our bank is closing the old account." Pressure is designed to make you skip verification.
A slightly different email address
Look closely. "smithlaw.com" can become "smith1aw.com" or "smithlaw-firm.com." On a phone screen, these are easy to miss.
Requests to keep things quiet
Messages that ask you not to copy a partner or to handle something "between us" deserve extra scrutiny.
Replies going somewhere unexpected
Attackers who control a mailbox sometimes create hidden rules that forward or delete messages. If clients say they never got your replies, investigate.
Building a Verification Habit That Actually Holds
Technology helps, but the strongest defense against BEC is a firm-wide rule that money doesn't move on email alone.
A practical verification procedure looks like this:
- Collect wiring details early through a secure method, and record a verified phone number for the receiving party at the start of the matter.
- Never use contact details from the email requesting payment. Call the number already on file.
- Confirm any change in instructions by phone with someone you know, before funds move.
- Require a second person to approve outgoing wires above a set amount.
- Tell clients in writing that your firm will never change payment instructions by email.
That last step protects clients too. Attackers increasingly impersonate the law firm to trick clients into paying the wrong account.
Technical Controls That Reduce the Risk
Good habits work best with strong email security behind them. Key controls include:
- Multifactor authentication on every mailbox, so a stolen password isn't enough to log in.
- Email authentication records (SPF, DKIM, and DMARC) that make it harder for others to send mail pretending to be your domain.
- External sender warnings that flag messages coming from outside the firm.
- Alerts for new mailbox rules, especially forwarding to outside addresses.
- Look-alike domain monitoring to spot fake versions of your firm's name.
Out-of-office replies can also help criminals time their attacks. Our article on why your vacation auto-reply might be a hacker's favorite email explains why.
Professional Responsibility Considerations
Lawyers have duties around competence and safeguarding client property. ABA Model Rule 1.1 and its comments address technology competence, and Rule 1.15 governs safekeeping property. The ABA has also issued formal opinions on securing client communications. Requirements vary by state, so firms should check their own state bar's rules and guidance.
This isn't meant to alarm anyone. It's a reminder that wire fraud prevention isn't just an IT issue. It's part of protecting clients.
If a Wire Goes to the Wrong Account
Speed matters more than anything else.
- Call your bank immediately and ask them to recall the transfer.
- File a report at ic3.gov as quickly as possible.
- Preserve the emails and don't delete anything.
- Contact your cyber insurance carrier and legal counsel.
- Have the affected mailbox reviewed to find out how the attacker got in.
To see how one large scam unfolded, read the holiday scam that cost one company $60 million.
Protecting Your Firm Before the Next Settlement
Business email compromise succeeds when trust and routine meet a lack of verification. A clear process, strong email security, and staff who feel comfortable slowing down can stop most attempts.
Maise Technology helps law firms strengthen email and cybersecurity protections without adding friction to client service. When you're ready to review how your firm handles wires and mailbox security, Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice.
