Guides

How wire fraud happens to law firms, and the habit that stops it

The email looks right. It continues a real thread about a real closing, it uses the names everyone has been using for weeks, and it says the wiring instructions have changed. The money goes out, and by the time anyone calls to ask where it is, it has already been moved twice. This is business email compromise, one of the largest fraud categories in the country, with over $55 billion in reported losses (FBI IC3, 2024). Law firms are prime targets because they move client money on schedules announced by email. This guide covers how the scam actually works, the one habit that stops it, what the technology can and cannot do, and what to do in the first hours if a wire already went out.

How the scam actually works

The attacker gets into the conversation one of two ways. If the firm's domain has no email authentication, they do not need to break into anything: they send mail that simply claims to be from your address, and without the records that let a receiving server reject a forgery, it lands looking legitimate. The second way is taking over a real mailbox, usually with a phished password on an account that has no second sign-in step. That version is worse, because the fraud arrives from the genuine address, inside the genuine thread.

Either way, the attacker does not strike immediately. They read. They learn who handles payments, how the firm writes, and when the closing or settlement is scheduled. The fake instruction arrives near the deadline, when everyone is busy and a quick turnaround feels normal, and it often asks for exactly that: handle it today, no need to call.

Why law firms specifically

A criminal choosing targets wants three things: money that moves by wire, moves on predictable dates, and moves based on emailed instructions. Closings, settlements, and trust-account disbursements are all three at once. A wire is also the worst possible payment to get wrong, because it is fast, final, and hard to claw back, and the money at stake usually belongs to a client. One convincing email can do what no burglar could.

The habit: verify by phone at a number you already know

Before anyone sends funds or acts on a new or changed payment instruction, someone calls the other party and confirms it by voice. That is the whole control, and done right it defeats every version of the scam above. Done right means five things. Call a number you already have on file, from your own records, a prior invoice, or the signed engagement, never a number from the email itself. Confirm the account details out loud, digit by digit, with a person you know or can identify. Never reply to the email to confirm, because if that mailbox is compromised you are confirming with the criminal. If you cannot reach a trusted contact, the payment waits. And write it down: who you called, the number, the date, and who confirmed.

I give my law firm clients a one-page version of this procedure to post wherever payments are handled, because the habit only works if it survives a busy Friday afternoon. The procedure is aligned to FBI IC3 guidance on verifying payment instructions through a known second channel.

When to stop and call

Any one of these means the payment stops until a call has happened:

• A new payee, or a first-time wire to anyone.
• Any change to existing bank, account, or routing details.
• The instruction arrived by email, whoever it appears to be from.
• A request to rush the payment or keep it quiet.
• Payment directions from a client, title company, opposing counsel, or vendor.

The louder red flags are a last-minute change to wiring instructions, a sender who will only communicate by email, a slightly misspelled or look-alike address, and a new account at a different bank. But do not wait for a red flag to feel suspicious. The well-executed versions of this scam do not look suspicious, which is why the triggers above are mechanical rather than a judgment call.

Two more controls for trust-account wires

For transfers from the trust or escrow account, firms that move client funds routinely add two controls on top of the call-back. First, two-person authorization: no single person releases a trust-account wire alone, and a second authorized person confirms the call-back happened and the details match before funds move. Second, a dollar threshold: above a figure the firm chooses, for example $50,000, a partner or owner approves in addition to the phone verification. Neither requires software. Both turn one person's bad afternoon into something the process catches.

What the technology does, and does not do

Three DNS records, SPF, DKIM, and DMARC, tell the world which servers may send email as your firm, and they are what stops the first version of the scam, the outright forgery of your address. Multi-factor sign-in on every mailbox is what stops the second version, the takeover of a real account. Advanced mail filtering catches many of the look-alike domains in between. All of this is worth doing, and the records are checkable from outside your office in about a minute, which is why they are the first thing my free Security Check looks at. You can see a sample of what that looks like.

But be clear about what the technology buys you: it reduces how often the fake email reaches an inbox. It cannot make the number zero, because the convincing versions come from genuinely compromised mailboxes at the other side of the deal, which no setting of yours controls. The call-back habit is the layer that stops the loss when a fake gets through, and it is the one layer that works against every variant.

If a wire already went out

Speed decides most of what happens next, so this is measured in hours. Call your bank immediately, ask them to recall the wire and request a freeze on the receiving account. Report it at ic3.gov right away, regardless of the amount; wires reported fast can sometimes be frozen before the money moves on. Preserve every email and delete nothing, because the thread is the evidence. And before any more payment instructions go out, have someone check whether one of your own mailboxes was compromised, because if it was, the criminal is still reading.