Law Firm Wire Transfer Fraud: How Fake Escrow Instructions Steal Six-Figure Client Payments

Two days before closing, a buyer receives an email that appears to come from the closing attorney. The message references the correct property, the correct closing date, and the correct amount. It explains that the escrow account has "changed for audit reasons" and attaches updated wiring instructions on what looks like firm letterhead. The buyer wires the down payment. The firm never sent the message, and the funds land in an account controlled by criminals.

Direct answer: Law firm wire transfer fraud occurs when criminals send fake escrow, settlement, or payment instructions that appear to come from a law firm, title company, or client, so that funds are wired to an account the criminal controls. It usually starts with business email compromise (BEC): a hacked mailbox, a spoofed sender, or a lookalike domain. The most effective safeguard is a firm rule that wiring instructions are never accepted or changed by email alone and must be confirmed by calling a known, previously verified phone number. Technical controls such as multi-factor authentication and DMARC reduce risk but do not replace verification.

If a fraudulent wire was just sent: Call the sending bank's fraud department immediately and ask for a recall and contact with the receiving bank. Then file a complaint at FBI IC3 with transaction details. Speed matters: the first hours give the best chance of freezing funds. Recovery is never guaranteed.

This guide is for managing partners, real estate and settlement attorneys, paralegals, legal administrators, bookkeepers, and clients sending money to a law firm. It is educational cybersecurity information, not legal advice. Examples are illustrative composites, not reports of Attorney Armor client incidents.

Why law firms are prime targets for wire fraud

Law firms routinely move large sums on predictable timelines. Real estate closings, personal injury settlements, estate distributions, and corporate transactions all involve:

• Large, single payments. A residential down payment or settlement disbursement is often six figures.
• Known deadlines. Closing dates create urgency that criminals exploit.
• Many parties. Buyers, sellers, lenders, title agents, brokers, and attorneys all exchange email, which multiplies the number of mailboxes an attacker can compromise.
• Wires that are hard to reverse. Unlike card payments, wire transfers settle quickly and are difficult to recall once funds are withdrawn or moved.

The FBI's Internet Crime Complaint Center consistently ranks business email compromise among the costliest categories of reported cybercrime, with billions of dollars in reported losses each year, and has issued repeated public warnings about real estate wire fraud. See the FBI IC3 annual reports for current figures.

How fake escrow instruction scams work

Most attacks follow a recognizable pattern.

1. Access or impersonation. The attacker phishes a mailbox at the law firm, the title company, the real estate agent, or the client. Alternatively, they register a lookalike domain (for example, swapping one letter in the firm's name) or forge the display name. 2. Quiet monitoring. With mailbox access, criminals read threads for weeks, learning the closing date, amounts, participants, and writing style. They often create inbox rules that hide or forward replies. 3. Timing. Shortly before funds are due, the attacker sends "updated" wiring instructions, frequently as a PDF that copies the firm's letterhead. 4. Pressure. The message stresses urgency and discourages phone calls: "I'm in depositions all day, please just wire today to avoid delaying closing." 5. Cash-out. Funds go to a mule account and are quickly moved onward, sometimes overseas or into cryptocurrency. 6. Discovery. The fraud surfaces when the real recipient reports that no money arrived, often a day or more later.

Common variations law firms should know

Note that the firm itself can be the victim. When a criminal impersonates a client and asks the firm to send proceeds to a "new account," the loss can come out of trust funds the firm is obligated to protect.

Warning signs of fraudulent wiring instructions

Train attorneys, staff, and clients to treat any of these as a stop signal:

• Wiring instructions that are new or changed, especially close to a deadline.
• A request to keep the change confidential or avoid phone calls.
• A sender domain that is slightly different from the usual one.
• A reply-to address that differs from the sender address.
• An account name that does not match the firm, title company, or client.
• A beneficiary bank in a different state or country than expected.
• Unusual grammar, tone, or signature changes from a familiar contact.
• Attachments that request login credentials to "view" the instructions.

The core control: out-of-band verification

The single most important rule: no wire is sent to new or changed instructions without verbal confirmation through a phone number obtained independently of the request.

A workable firm procedure:

1. Provide instructions at engagement. Give clients wiring instructions early in the matter, ideally in person or through a secure portal, and tell them in writing that the firm will never change them by email. 2. Use known numbers only. Verify by calling a number from the engagement letter, firm website, or prior verified records, never a number in the suspicious email. 3. Confirm specific details. Read back the bank name, routing number, and the last digits of the account number, and confirm the account holder name. 4. Require dual approval. Outgoing trust-account wires above a firm-set threshold need a second authorized person to approve. 5. Log every verification. Record who called, which number, the time, and what was confirmed. 6. Send a small test amount where practical, and confirm receipt by phone before sending the balance. 7. Hold the line under pressure. Staff must know they will never be disciplined for delaying a wire to verify it.

Include a short notice in every engagement letter, closing package, and email signature for transaction matters, for example: *"Our wiring instructions will never change by email. Before sending any funds, call our office at the number listed on our website to confirm."*

Technical controls that reduce wire fraud risk

Verification stops the payment. Technical controls make it harder for criminals to get into position.

• Multi-factor authentication on email and remote access, preferably phishing-resistant methods such as security keys.
• Email authentication: publish SPF, DKIM, and a DMARC policy moving toward enforcement (quarantine or reject). This reduces exact-domain spoofing but does not stop lookalike domains or compromised accounts.
• Lookalike domain monitoring to detect newly registered domains resembling the firm's name.
• External sender tagging so staff see warnings on mail from outside the firm.
• Mailbox rule auditing to catch hidden forwarding and deletion rules, a common sign of compromise.
• Secure client portals for sharing payment instructions instead of email attachments.
• Security awareness training with realistic phishing and wire fraud scenarios.
• Regular vulnerability assessments and penetration testing to find exposed systems and weak controls before attackers do.

What to do if a client wire is diverted

1. Call the bank immediately. The originating bank should request a recall and contact the receiving bank. Ask about the bank's fraud escalation process. 2. Report to the FBI. File at ic3.gov with amounts, dates, bank details, and the fraudulent emails. 3. Preserve evidence. Keep emails with full headers, PDFs, and transaction records. Do not delete compromised mailboxes. 4. Contain the compromise. Reset passwords, revoke sessions, remove malicious inbox rules, and review sign-in logs. 5. Notify affected parties. Warn other participants in the transaction that communications may be compromised. 6. Contact your cyber insurer promptly. Many policies have notice requirements, and social engineering or funds transfer fraud coverage may be limited by sublimits or verification conditions. 7. Assess legal duties. Consult counsel on client communication, trust-account obligations, bar reporting, and any data breach notification requirements in the relevant states.

Ethical duties: ABA rules and wire fraud

ABA Model Rule 1.1 (competence) includes understanding the benefits and risks of relevant technology. Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information. Model Rule 1.15 governs safekeeping client property, including trust funds. ABA Formal Opinion 477R addresses securing client communications, and Formal Opinion 483 addresses obligations after a data breach, including informing current clients. Check your state's version of these rules and any state bar guidance on trust-account fraud.

Cyber insurance and wire fraud

Wire fraud losses are often treated as social engineering or funds transfer fraud, which may be excluded from a base cyber policy, covered only by an endorsement, or subject to a low sublimit. Some policies require documented callback verification for coverage to apply. Review the policy wording with your broker before an incident, and keep verification logs that show your procedures were followed.

30-day wire fraud prevention plan for law firms

Week 1: Adopt a written wire verification policy, add the "instructions never change by email" notice to engagement letters and signatures, and confirm MFA on every mailbox.

Week 2: Audit mailbox forwarding rules, check SPF, DKIM, and DMARC records, and start lookalike domain monitoring.

Week 3: Train attorneys, paralegals, and bookkeeping staff on the warning signs and verification procedure. Run a tabletop exercise on a diverted closing.

Week 4: Review cyber insurance coverage for social engineering losses, document the incident response contacts (bank fraud line, insurer, IC3), and schedule an external security assessment.

Frequently asked questions

What is law firm wire transfer fraud? It is a scheme where criminals impersonate a law firm, client, or transaction party to redirect wired funds, usually by sending fake escrow or payment instructions.

Can a fraudulent wire be reversed? Sometimes, if the bank acts before funds are withdrawn. Contact your bank immediately and report to IC3. Recovery is not guaranteed.

Does DMARC stop wire fraud? No. DMARC helps prevent exact-domain spoofing, but it does not stop lookalike domains or attacks from a genuinely compromised mailbox. Verification by phone is still essential.

Who is liable when a client wire is diverted? It depends on the facts, contracts, state law, and the parties' security practices. Consult counsel; this article is not legal advice.

How should clients verify wiring instructions? Call the firm using a phone number from the engagement letter or official website, never a number in the email, and confirm details before sending money.