Law Firm Email Spoofing: How Criminals Impersonate Attorneys to Steal Client Payments

A client receives an email that appears to come from the attorney handling their matter. It references a real settlement, includes a familiar signature, and asks them to send money to an updated account. The client pays. The attorney never sent the message. The money has gone to a criminal.

Direct answer: Law firm email spoofing is the impersonation of an attorney or legal organization through a misleading sender name, forged domain, or lookalike email address. Criminals use it to divert retainers, settlements, trust-account disbursements, and closing funds. A related attack, business email compromise (BEC), may use a genuinely compromised mailbox rather than a forged sender. The most important payment safeguard is independent verification of new or changed instructions using a previously established contact method. Email authentication, account security, training, and documented approvals provide additional layers—not a guarantee against fraud.

If money has already been sent: Contact the originating bank's fraud team immediately, request a recall or reversal and coordination with the receiving bank, preserve messages and transfer records, and report the incident at FBI IC3. Do not wait for a complete technical investigation before calling the bank. Recovery is not guaranteed.

This guide is for managing partners, attorneys, legal administrators, finance teams, and clients paying a law firm. It explains both the technical attack and the payment workflow that makes it succeed. It is educational cybersecurity information, not legal advice. Examples are illustrative, not reports of actual Attorney Armor client incidents. Sources include the FBI, CISA, FTC, Microsoft, and ABA.

What is law firm email spoofing?

Spoofing manipulates the apparent identity of a sender. An email may use an attorney's name above an unrelated address, claim to come from the firm's exact domain, or originate from a nearly identical domain registered by a criminal.

The mechanism matters. A forged sender may call for stronger domain authentication. A lookalike domain calls for impersonation detection and payment verification. A compromised account requires account containment and investigation into what was accessed. Calling every fraudulent message a spoofed email can conceal the actual problem.

BEC is the broader fraud category. The FBI describes business email compromise as a scam targeting legitimate payments through social engineering or computer intrusion. A BEC message does not need malware, a fake login page, or even a link. A plain-text request to change bank details can be enough.

Why criminals impersonate attorneys

Legal work combines trusted relationships with consequential transactions. Clients expect payment deadlines. Finance staff expect invoices. Closing participants expect urgent coordination. A criminal does not need to understand an entire case; knowing who is paying whom and when may be sufficient.

Targets include real estate purchase funds, personal injury settlements, estate distributions, corporate transaction payments, legal fees, and vendor invoices. Trust-account funds deserve particularly careful controls, but operating-account payments are vulnerable too.

Matter details increase credibility. Attackers may learn names and timing from public information, stolen correspondence, or a compromised client, title company, vendor, or opposing counsel account. Accurate information is therefore not proof that the sender can authorize a payment.

The FBI's BEC safety guidance describes requests appearing to come from known sources. The law-firm-specific risk is the authority clients associate with an attorney—not a claim that every firm experiences the same attack rate.

How an attorney-impersonation payment scam unfolds

Stage 1: Identify a transaction and a trusted person

The attacker identifies an attorney, client, employee, or counterparty connected to a payment. A compromised mailbox may reveal the amount, invoice format, matter references, and language participants normally use. Without mailbox access, a plausible pretext and copied signature may still be persuasive.

Stage 2: Create a convincing sender identity

The attacker uses a familiar display name, lookalike address, forged sender, or genuine compromised account. A message may contain a recognizable logo, disclaimer, phone number, and thread history. None independently authenticates the person issuing the instruction.

Stage 3: Introduce a payment change

The request claims the usual account is unavailable, a portal has changed, or a wire must be completed before a deadline. The dangerous instruction is the new destination: an account, payment link, or recipient controlled by the criminal or an intermediary.

Stage 4: Discourage independent verification

The sender says the attorney is in court, demands confidentiality, discourages calls, or supplies a supposedly direct verification number. A second fraudulent message or convincing phone call can reinforce the story. Verification is not independent when the attacker supplies the channel used to verify it.

Stage 5: Move funds and conceal evidence

After payment, money may move onward. If a mailbox is compromised, forwarding and inbox rules can monitor replies or hide warnings. The absence of a suspicious message in the inbox does not prove the account was never involved.

Illustrative example: settlement funds redirected

A client expects a settlement payment. A message appears in existing correspondence and says the receiving account must be updated. It knows the matter name and timing. Staff copy the new details into the payment system. A second approver approves without checking where the instructions came from.

The failure is not simply an overlooked typo. The workflow lets email change a destination without independent confirmation. Two approvals do not help when both rely on the same unverified source.

In a safer workflow, payment pauses. Staff call using a number already recorded and previously verified in the matter file. They confirm the beneficiary and destination through the approved process, document confirmation, and obtain an independent review before release. A failed callback leaves the payment on hold, even when the deadline is inconvenient.

Warning signs of attorney email spoofing

• New bank details: The beneficiary, account, routing information, payment link, or payment method changes.
• Urgency: An unexplained deadline or threat that the transaction will fail unless payment happens now.
• Address mismatch: The full sender or Reply-To address differs from the established contact.
• New channel: The sender moves the conversation to a personal mailbox or provides a new phone number.
• Avoided verification: Instructions discourage calls or bypass routine approval.
• Secrecy: The request must be concealed from people who normally approve payments.
• Altered invoice: Payment details differ from a previously verified document while everything else looks familiar.
• Account anomalies: Unexplained sent messages, deleted replies, sign-ins, delegates, or forwarding rules.

Good grammar is not a safety signal. Attackers can copy correspondence or use writing tools to produce convincing language. Likewise, a message without an email-security warning banner is not automatically safe. Familiar content and a familiar name are context, not authentication.

The payment-verification process every firm should document

Core rule: Email alone must not authorize a new or changed payment destination. Apply it to partners and executives as well as junior staff. Exceptions based on someone's status are exactly what impersonators exploit.

Establish trusted contacts before money is due

At intake or transaction setup, record authorized payment contacts and independently verify a contact method. Explain the process before the urgent stage. A number copied from an unverified signature block is not a trusted callback number.

Verify outside the requesting message

Call a previously verified number from the firm's records or use another established secure process. Do not use the phone number, link, QR code, or verification portal supplied in the change request. If the trusted person is unavailable, keep payment paused and escalate through the agreed procedure.

Confirm the destination, not just permission to pay

Verify recipient identity, the reason for the change, and the specific destination through the approved secure channel. A generic yes, please pay does not verify an account number. Avoid exposing sensitive payment or client information in unnecessary email exchanges.

Separate verification from release approval

An independent approver reviews the verification evidence and destination—not merely that someone entered the transaction. Set documented thresholds appropriate to the firm. No universal dollar threshold suits every practice; small test payments can also be fraudulent.

Keep an audit record and escalation path

Record who verified the instructions, the trusted channel, time, approved destination, and release approver. Protect these as sensitive financial records. Specify what happens when information conflicts, the attorney is unavailable, or a deadline approaches. Reward stopping an unsafe payment instead of treating it as poor client service.

What clients should do before paying an attorney

Clients are part of the control environment. A firm can secure its own accounts while a client or counterparty remains vulnerable. Give clients payment-fraud guidance in plain language and repeat it before a significant transfer.

• Compare the full address with previously verified correspondence.
• Treat new or changed payment instructions as unverified.
• Call the firm using a number already known to be genuine, not one in the message.
• Confirm the actual payment destination through the established process.
• Stop if someone discourages calls, demands secrecy, or changes the method unexpectedly.
• Report questionable requests promptly, even if no money was sent.

Example client notice to adapt: "Do not rely on email alone for new or changed payment instructions. Before sending money, contact our office using the verified phone number already in your records and follow our payment-verification process. Do not use a phone number or link supplied in a payment-change email. If anything seems unusual, pause payment and contact us."

Use the notice only if the firm's real processes support it. Do not promise that the firm never sends a particular kind of message unless that is its policy. A footer warning helps, but cannot replace staff controls or independent verification.

SPF, DKIM, and DMARC: what they do and cannot do

The FTC's email-authentication guidance explains how authentication makes impersonating a business domain harder. CISA recommends SPF, DKIM, and DMARC together.

DMARC does not stop every impersonation or BEC attack. A lookalike domain can authenticate its own mail. A compromised attorney account can send authenticated mail. A familiar display name can sit above an unrelated address. Payment verification is still required after authentication improves.

Move toward enforcement without breaking legitimate mail

Have the IT or email-security provider inventory approved senders: the email platform, invoicing system, client portal, practice-management software, and other authorized tools. Configure SPF and DKIM appropriately, verify alignment, and review DMARC aggregate reports. A p=none policy requests reporting but does not request quarantine or rejection of failures.

After validating legitimate flows, plan a controlled move to p=quarantine or p=reject where appropriate. Do not copy another firm's DNS record or enforce rejection without checking approved senders. Misconfiguration can disrupt invoices and client communications. Forwarding and third-party delivery paths require careful review.

New vendors, domains, subdomains, and services change the sender inventory. A point-in-time DNS check is a useful signal, not an audit of every message or a certificate that email is secure.

Secure real attorney accounts as well as the domain

If an attacker has a valid session or real mailbox access, a DMARC change alone will not remove them. Account protections must cover identities and connected applications.

• Deploy phishing-resistant multifactor authentication where supported, especially for administrators and payment approvers.
• Review legacy authentication and unsupported access paths with the IT provider; remove bypasses where feasible.
• Restrict and monitor forwarding, delegates, shared-mailbox access, and suspicious inbox rules.
• Review third-party application permissions and unexpected OAuth grants.
• Separate administrator accounts from routine email use.
• Retain appropriate sign-in, mailbox, and administrative logs based on the firm's needs and available licensing.
• Encourage immediate reporting of unexpected MFA prompts, sign-in notices, or account-setting changes.

Microsoft's compromised-account guidance identifies unusual sent/deleted messages and unexpected rules as warning signs. Exact containment depends on the platform. A public website assessment cannot determine whether every mailbox, session, or application permission is safe.

What to do if client money has already been diverted

Contact the bank immediately

Use a verified bank contact or official fraud channel. Explain the suspected BEC transfer, provide transaction details securely, and request a recall or reversal and receiving-bank coordination. Record the case reference. FBI IC3 guidance emphasizes prompt contact with the originating institution.

Do not send an additional release fee, rely on the attacker to return funds, or delay bank contact while identifying the criminal. A recall request does not promise recovery.

Preserve evidence and report

Keep original messages with headers, attachments, transaction records, timestamps, logs, and approval evidence. Avoid deleting mail or wiping devices before qualified responders assess evidence needs. File a detailed IC3 complaint and follow applicable law-enforcement guidance. Use the internal reporting process for attempted fraud even without a completed payment.

Contain access in parallel

Contact the IT/security provider through a trusted channel. Secure affected accounts, revoke unauthorized sessions and access as appropriate, inspect rules and forwarding, and investigate sign-ins, delegates, and connected applications. A password change alone may be insufficient. Preserve evidence while stopping continued access; neither activity should wait for the entire investigation.

Assess affected matters and notification duties

Identify potentially affected clients, payments, messages, and systems. Inform designated leadership and consult incident-response counsel, ethics counsel, and the insurer as appropriate. Follow policy notice and consent requirements without assuming coverage. Avoid spreading client details through broad email chains.

Client notification, regulator reporting, contractual notice, and trust-account obligations depend on facts and applicable rules. There is no universal notification deadline for every firm. Communicate verified facts, avoid attribution speculation, and use counsel-reviewed notices where appropriate.

Attorney duties, confidentiality, and insurance

ABA Model Rule 1.1 Comment 8 addresses technology benefits and risks. Model Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to or disclosure of representation-related information. The jurisdiction's adopted rules govern.

Formal Opinion 477R addresses secure client communications and circumstances requiring heightened precautions. Formal Opinion 483 discusses breach duties involving or substantially likely to involve material client information. These are Model Rule-based guidance, not a guarantee of compliance or one nationwide notification rule.

Review insurance before a loss. Ask the broker or carrier how the policy treats social engineering, fraudulent instructions, funds transfer, client funds, compromise, exclusions, sublimits, and required controls. Do not assume cyber insurance automatically reimburses a diverted settlement. Liability and coverage require fact-specific professional advice.

A practical implementation plan

Start with the payment workflow

Identify who receives instructions, changes beneficiaries, approves, and releases payments. Document independent verification. Establish trusted contacts for upcoming transfers. Give clients a clear warning and a way to reach the firm outside a questionable message.

Validate technical controls

Review approved senders, SPF/DKIM alignment, DMARC reports and policy, MFA coverage, delegates, forwarding, administration, and logs with IT. Separate public signals from checks requiring authenticated access and explicit authorization.

Exercise the process

Run a tabletop with an attorney, finance staff, client-contact team, IT provider, and whoever would call the bank. Test a payment change during a closing deadline and one apparently sent by a senior partner. Measure whether the team pauses and verifies, not just whether someone notices a typo.

Keep controls current

Assign owners for sender changes, mailbox alerts, client notices, payment exceptions, and periodic reviews. Revisit after an office expansion, email migration, software integration, payment-provider change, or staff transition. Document improvements and repeat realistic security awareness training.

For broader planning, use the 25-point law firm cybersecurity checklist and wire fraud and social engineering guide. They complement the firm's payment controls, not replace them.

Sources and further reading

• FBI IC3: Business Email Compromise — verification and incident reporting.
• FBI: BEC scams and safety — impersonation-based fraud.
• CISA: Email authentication — SPF, DKIM, and DMARC together.
• FTC: Email authentication — business-domain protection.
• Microsoft: Respond to a compromised email account — platform-specific containment and investigation.
• ABA: Formal Opinion 477R overview — securing client communications.
• ABA: Formal Opinion 483 — professional duties after a qualifying breach.

Published October 21, 2026. Guidance and product scope can change. Consult linked authorities, current engagement terms, and professional advisers for a specific incident.

Frequently asked questions

How is email spoofing different from business email compromise? Spoofing disguises the apparent sender. BEC is broader payment fraud that can involve spoofing, a lookalike domain, social engineering, or a real compromised account. Identifying the mechanism helps choose appropriate prevention and containment.

Can an impersonation email pass SPF, DKIM, and DMARC? A lookalike domain can pass its own authentication. A real compromised attorney account can also send authenticated mail. Proper DMARC alignment helps address unauthorized use of the firm's exact domain, but passing authentication does not verify a payment instruction.

What should a client do with new wire instructions? Pause payment and independently verify using a previously established, verified contact method. Do not use a number or link in the change request. Confirm the actual destination through the firm's approved process.

What is the first step after a fraudulent wire? Contact the originating bank's fraud team immediately to request a recall or reversal and receiving-bank coordination. Preserve records, report to IC3, and investigate account access in parallel. Recovery is not guaranteed.

Must an attorney notify clients after account compromise? Notification depends on affected information, facts, jurisdictional rules and law, and contracts. Opinion 483 addresses breaches involving or substantially likely to involve material client information. Consult appropriate counsel; no universal deadline applies to every incident.

Does cyber insurance cover stolen client payments? Coverage depends on the policy, endorsements, exclusions, sublimits, facts, and required controls. Social-engineering and funds-transfer coverage may differ from other cyber coverage. Ask the broker or carrier before a loss.

Can a free scan prove a law firm's email cannot be spoofed? No. A public assessment can identify some configuration signals, but cannot examine every account, prevent lookalike domains, or verify payments. Combine scoped technical review with independent verification, account security, and training.