ABA Model Rule 1.6 aligned24/7 security operations monitoringAustin, TX ยท Serving TX, AR, LA, OK & KS
(737) 325-2520
(737) 325-2520Schedule a Review

A Wire Instruction Callback Procedure That Actually Works

Callback verification stops many wire fraud attempts, but only when done correctly. Here is a step-by-step procedure for law firm trust and closing staff.

3 min readBy Counsel Cyber Team

Wire fraud against law firms usually does not require sophisticated hacking. It requires a believable email, a sense of urgency and a staff member who skips one verification step. Law firms are attractive targets because they hold large sums in trust accounts and routinely handle closings, settlements and escrow payments.

The FBI's Internet Crime Complaint Center has long warned about business email compromise and recommends verifying payment instruction changes through a separate, trusted channel. This post turns that advice into a written callback procedure your team can follow without guessing.

Why callbacks fail in practice

A callback sounds simple, but real firms make the same mistakes.

  • Calling the number in the email. If the attacker controls the email, the phone number in the signature may also be theirs.
  • Verifying only new accounts. Attackers also target changes to existing instructions.
  • Letting seniority bypass the rule. An urgent message that appears to come from a partner gets treated as the exception.
  • No record. If nobody documents the call, nobody can show it happened.

The core rule

No wire is sent, and no payment instruction is changed, until someone verifies the instructions by phone, using a number from an independent source, and records that verification.

Write that rule down, make the managing partner sign it and apply it to everyone.

Step 1: Define what triggers verification

Make the trigger broad. Verify for:

  • Any first-time wire to a new recipient.
  • Any change to bank name, account number, routing number or payee.
  • Any request to send funds to a different country or a third party.
  • Any request received by email, text or voicemail rather than in person.
  • Any request marked urgent or confidential.

For a closing, treat the title company or escrow agent's wire instructions the same way. Do not assume that a familiar sender means a safe message.

Step 2: Pick a trusted number

The phone number must come from somewhere the attacker could not have edited.

  1. Your own case file, from earlier verified contact.
  2. The recipient's official website, typed in manually, or a published directory.
  3. A number given to you in person or by a trusted party before the transaction.

Do not use the number in the email that contains the instructions, and do not reply to that email to ask whether it is legitimate.

Step 3: Conduct the call properly

A good call has a script.

  • Call and speak to a person you know, or ask for the person responsible for payments.
  • Read back the full account number and routing number, and the name on the account, rather than asking "are the instructions the same?"
  • Confirm the amount and the payee.
  • Ask a question an outsider would not know, such as the matter's file number.
  • If something feels off, stop and escalate.

Step 4: Require two people for larger amounts

Set a threshold, which your partners choose, above which a second person must independently approve the wire. Separating the person who verifies from the person who releases funds reduces the damage from any single mistake or compromised account.

Step 5: Record it

Keep a short verification record in the matter file with the date, time, number called, person spoken to, who verified and who approved. A simple form works.

Step 6: Plan for the wire that already went out

Speed matters if you suspect fraud. Make sure staff know to:

  1. Call the sending bank immediately and ask for a recall or fraud hold.
  2. Notify the managing partner and your cyber insurance carrier.
  3. Report to the FBI's IC3 and local law enforcement.
  4. Preserve emails and logs.

Put the bank's fraud contact number on a card in the accounting office. Do not search for it during a crisis.

Support the procedure with email controls

Procedures work better when technology reduces fake messages. Strong email filtering, impersonation protection, MFA on every mailbox, alerts for forwarding rules and banners that flag external senders all help. They do not replace the callback, but they reduce how often staff face a convincing forgery.

Train with realistic examples

Walk your staff through a hypothetical scenario: a closing is two days away, a message from the title company says the account has changed, and the sender asks for a quick reply. Ask what each person would do. Repeat it once a year.

Counsel Cyber helps firms write wire procedures, tune email security and train staff. If you want to compare your current practice against the steps above, we can review it with you.

More on Wire Fraud and Email Security

Wire Fraud and Email Security

Closing Day Wire Fraud: A Step-by-Step Verification Protocol

A practical callback and verification protocol for law firms handling real estate closings and settlements, designed to stop fraudulent wire instructions.

Wire Fraud and Email Security

Vendor Email Compromise: When the Fraud Comes from Someone You Trust

Attackers who break into a vendor's or client's email can send convincing payment requests to your firm. Learn how it works and how to verify without delay.

Wire Fraud and Email Security

Spotting a Compromised Mailbox Before It Costs Your Firm Money

A hijacked email account often looks quiet at first. Learn the early warning signs, the first-hour response steps, and the settings that stop it from spreading.