If your firm handles real estate closings, settlements, probate distributions or any transaction that moves money, you are a target for business email compromise. The FBI's Internet Crime Complaint Center has repeatedly flagged BEC as one of the costliest forms of cybercrime, and law firms are attractive because they hold large sums for short periods and communicate by email under time pressure.
The best defense is not a product. It is a rule: no wiring instructions are accepted or changed without a verbal callback to a phone number you already had on file. This post explains how to make that rule stick.
Why the Callback Works
Attackers succeed by controlling the channel. They compromise a mailbox, or spoof a domain that looks nearly identical, and then send instructions that appear to come from a real party. Every email in that conversation may look legitimate, because the attacker is in the thread.
A phone call to an independently sourced number breaks that control. The attacker cannot answer a number they do not own. It is cheap, takes two minutes and works regardless of how sophisticated the email forgery was.
Writing the Rule
Your rule should be short enough to fit on an index card.
- Any new wiring instructions, and any change to existing instructions, must be verified by phone before funds move.
- Call a number from a source you already trust, such as the engagement letter, the original intake form or a prior verified call. Never use a number from the email containing the instructions.
- Speak to a person you know, and read back the account number's last four digits and the bank name.
- Record the call in the file: who, when, which number, what was confirmed.
- A second person approves the disbursement. No one releases funds alone.
Handle the exceptions in advance
Pressure is the attacker's tool. Decide now what happens when a client says they cannot be reached, when a party claims the closing will fall apart without immediate action, or when a partner is traveling. The answer should be that the callback still happens, and the firm explains the delay to the client up front.
Strengthen the Process Around It
Warn clients early
Include a short warning in engagement letters and closing instructions: the firm will never change wiring instructions by email, and the client should call to confirm anything that looks different. Repeat it in your closing checklist.
Use secure channels for instructions
Where possible, collect banking details through a secure client portal rather than plain email. Fewer instructions in transit means fewer chances to tamper with them.
Watch for the warning signs
- A sudden change in bank, account name or account location
- Urgency or requests for secrecy
- A sender address that is slightly off, such as a swapped letter or an unusual domain
- Replies that come from a different address than the original message
- Mailbox rules that auto-forward or hide messages, which may signal a compromised account
Secure the mailboxes themselves
The callback rule is your last line of defense, not your first. Multi-factor authentication on every account, email filtering that flags lookalike domains, and alerts for new forwarding rules all reduce the odds that an attacker gets into the conversation in the first place.
What to Do If Money Has Moved
Speed matters. The FBI's guidance for BEC victims is to contact your bank immediately to request a recall of the wire, then file a report with the Internet Crime Complaint Center at ic3.gov. Contact your cyber insurer promptly and preserve the emails and logs. Rule 1.4 and the ABA's guidance on data incidents may also require prompt communication with affected clients, so involve the firm's leadership and, where appropriate, your state bar's ethics resources.
Make It Routine
The rule fails when it is optional. Put the callback on the closing checklist, train every person who touches disbursements, and test it with a simulated request a few times a year.
Counsel Cyber works with firms to build wire-fraud controls into their email security and closing workflows. If you would like us to walk through your current process, we offer a no-pressure review.