Business email compromise remains a major source of financial loss reported to the FBI's Internet Crime Complaint Center, and law firms are attractive targets because they routinely move large sums for clients. The pattern is familiar: an attacker gains access to or impersonates an email account, watches a transaction approach closing, and sends new wire instructions at just the right moment.
The most reliable defense does not depend on spotting a perfect fake. It is a procedure: verify every payment instruction by a second channel, every time. Below is how to write one that people will follow.
Why technology alone is not enough
Email filtering, MFA and monitoring reduce the odds that an attacker gets in. But a criminal who simply registers a lookalike domain, or who compromises a client's or title company's email rather than yours, can still send convincing instructions. A verification step breaks the attack no matter how the message was created.
The core rule
No wire instruction is accepted, changed or acted on until it has been verified by phone using a number obtained independently of the email that contained the instruction.
Everything below supports that single rule.
Writing the procedure
1. Define what triggers verification
- Any new wire instruction
- Any change to existing instructions, however small
- Any request to send funds to a different account, bank or person
- Any urgent request from a partner, client or third party to move money
2. Collect verified contact numbers early
At the start of the matter, record a phone number for each party who will receive or send funds, taken from a trusted source such as an engagement letter, an in-person meeting or the party's own website. Store it in the matter file. That way, no one needs to look up a number while a fraudster waits.
3. Make the call
- Call the stored number, not a number in the email or its signature.
- Speak to a person you know, or confirm identity with a question that cannot be answered from the email thread.
- Read back the account number, bank name and amount.
- Record the date, time, who you spoke to and who made the call.
4. Require two people
For disbursements over a threshold your partners choose, require a second person to review and approve. The person who verifies should be different from the person who releases the funds where staffing allows.
5. Treat urgency as a warning sign
Pressure to act immediately, requests for secrecy, or reasons the person cannot be reached by phone are classic indicators. Give staff explicit permission, from the partners, to slow down any payment without fear of criticism.
6. Warn clients up front
Send a plain-language notice at the start of each matter, and again before closing, explaining that your firm will never change wiring instructions by email, and that clients should call to verify any change. Many firms add the warning to the email signature of staff handling closings.
Handle the bank side
- Ask your bank about additional protections such as dual authorization, positive pay for checks and call-back rules for wires.
- Know the bank's fraud contact so that you can reach them outside business hours.
If you suspect a fraudulent transfer
Time is critical. The FBI has described that prompt reporting gives the best chance to recover funds.
- Call your bank immediately and ask them to initiate a recall of the wire.
- Notify your managing partner and your cyber and crime insurance carriers per policy terms.
- File a report with the FBI's IC3 and notify local law enforcement.
- Preserve emails and logs, and have your IT provider look for a compromised mailbox or forwarding rules.
- Consult ethics counsel about client communication duties.
Test your people
Run short simulated scenarios, such as an email asking to change instructions two days before closing. Make sure staff follow the call-back procedure and reward them when they do.
Review the procedure regularly
Revisit it after any near miss, staffing change or new payment channel. A written procedure that sits in a binder does nothing; one rehearsed quarterly does.
How Counsel Cyber supports you
We help firms combine email security, mailbox monitoring and written verification procedures into a layered defense against wire fraud. We can review your current process and training materials on request.