Wire fraud & social engineering: a prevention guide for law firms

Why law firms are a prime target

Real estate closings, settlement distributions, IOLTA disbursements, and M&A escrow releases all involve wire transfers that attackers can divert with a single forged email. The FBI's Internet Crime Complaint Center consistently lists BEC as one of the most costly cybercrime categories, and legal services regularly appear in the top targeted industries because a firm's wires are large, time-sensitive, and trusted by both sides of a transaction.

The three attack patterns that hit law firms

• Partner impersonation. Attacker spoofs or compromises a partner's mailbox and instructs an associate or paralegal to wire funds "urgently" before closing.
• Wire instruction swap. Attacker sits in an existing real estate or settlement thread and sends "updated" wiring instructions just before funding.
• Vendor & opposing counsel impersonation. Attacker poses as a known vendor, court reporter, or opposing counsel with a malicious invoice or document link that harvests credentials.

How the attack typically unfolds

1. Initial access through a phished associate's Microsoft 365 or Google Workspace credentials.
2. Silent inbox monitoring and mail rules that hide replies from the legitimate user.
3. Selective reply-spoofing on an in-progress matter, often from a lookalike domain.
4. Wire instructions altered to a mule account, then quickly chained out of reach.

Controls that stop it

Most law firm BEC losses are preventable with a small, layered set of controls:

• Phishing-resistant MFA on every email, VPN, and practice-management login — security keys or platform authenticators, not SMS.
• DMARC at p=reject with aligned SPF and DKIM so attackers can't spoof your firm's domain from outside.
• External-sender banners and lookalike-domain alerts in the email gateway so spoofed messages don't blend into matter threads.
• Out-of-band wire verification — a documented policy that every wire instruction (and every change) is confirmed by phone to a known number, never to the number in the email.
• Inbox-rule monitoring to detect the hiding-reply rules attackers create after compromising an account.
• Quarterly phishing simulations targeted at the real scenarios above, with coaching for staff that handle wires.

If a wire is already in motion

1. Call the originating bank's fraud line within the first 24 hours and request a SWIFT recall or domestic Financial Fraud Kill Chain action.
2. File an IC3 report at ic3.gov and notify your local FBI field office.
3. Engage your cyber insurance carrier — most policies require notification inside 48–72 hours.
4. Preserve email headers, mail rules, sign-in logs, and the actual fraudulent message.

How Attorney Armor helps

Attorney Armor continuously checks your firm's exposure to the conditions BEC attackers depend on: email authentication (SPF/DKIM/DMARC) misconfigurations, exposed credentials in breach corpuses, lookalike domains, and unmonitored MFA gaps. Findings ship with attorney-readable explanations and remediation steps so your IT vendor — or your in-house team — can close them quickly.

Questions about a live incident? Contact our security team.