Phishing and email fraud aimed at law firms: signs to watch and habits that help

The attacker may copy a client, a colleague, a vendor or another party in a transaction. Sometimes the message comes from a real mailbox the attacker has taken over, so the address looks right.

Urgency is the usual lever: a closing date, a court deadline or a partner who cannot talk right now.

Public agencies describe business email compromise as a scam that targets businesses and individuals who make transfers of funds, often through a compromised or lookalike account. We use none of their loss figures, because we have not verified them in a form we can cite here.

The advice from the agencies is consistent: be suspicious of unsolicited requests, check an unexpected request through a second channel you already trust, and report quickly. For a payment change, that means calling a number you already have, not one printed in the message.

• Treat any change to payment or wire instructions as unverified until someone calls the person on a number the firm already had
• Write a short procedure for outgoing payments and require two people to approve any new payee or changed instructions
• Verify new contacts before sharing documents or account details, and be careful with links and attachments in unexpected messages
• Open services by typing the address or using a saved bookmark, not by following a link in an email
• Make it easy and blame-free to report a suspicious message, and answer quickly so staff keep reporting
• Turn on a second sign-in step and ask your email provider about email authentication settings that make spoofing harder
• Check mailbox rules and forwarding settings from time to time, since attackers sometimes add a rule to copy or hide messages

• A sender address that is close to a real one, with a letter changed or left out
• A request that is urgent, secret or asks you to skip the usual process
• New payment details, a new account or a change of bank for a payment that was already agreed
• A reply-to address that differs from the sender, or a conversation that suddenly moves to another address
• An unexpected attachment, a link to a sign-in page or a request to approve a sign-in you did not start
• A message that mixes real details with an odd tone, odd timing or a request the person would not normally make

• Whether the written procedure names who calls, which number they use and where they note the call
• Whether the people who actually send payments have been told about the procedure, not only the partners
• What staff do the moment they notice a mistake: who they tell, in what order, and whether the bank is on that list
• Whether your attorney has said who must be told after an incident, because notice duties are a legal question
• Whether the firm can reach its bank, and report to the FBI's Internet Crime Complaint Center, without searching for the details in a crisis