Hypothetical example: A paralegal receives an email from a familiar contact asking the firm to use different bank details for a payment connected to a matter. The message is in the existing conversation thread, uses a normal signature, and describes a real deadline. Nothing about it looks like the stereotypical phishing email. This is the kind of situation that tests law firm email security.
The paralegal is busy, but the firm has one standing rule: no changes to payment instructions based only on an email, even when the email appears to come from someone they know. A phone call to a number already on file shows that the sender never requested the change.
The attempted fraud ends there. The technical investigation may only be beginning.
This scenario is illustrative, not an IT-Emergencies client case. It shows why law firm email security requires both technical controls and reliable payment verification. It highlights the overlap of two risks that small U.S. law firms need to manage: unauthorized access to email accounts and business email compromise (BEC) that redirects money or sensitive information.
How a credible message can become a payment instruction
BEC is not limited to obviously fake domains or poorly written messages. The FBI’s Internet Crime Complaint Center explains that scams may use compromised legitimate business email accounts, impersonation, or social engineering. The objective is often to redirect a transfer of funds.
In a law firm, the harmful moment may be when staff treat a conversational email as authorization to change a bank account, share a settlement document, or disclose a confidential file. A technical defense can reduce the likelihood of compromise, but a payment-approval procedure can stop an expensive mistake even if the message arrived through a real account.
The attack path: a hypothetical process, not a real case
| Stage | What the office may observe | The defensive decision |
|---|---|---|
| 1. Suspicious access or impersonation | An unexpected sign-in, lookalike sender, or message from an account that may be compromised | Have IT review account and email evidence without assuming the sender is legitimate |
| 2. Payment or document request | “We changed banks” or “send the signed files here” inside a familiar thread | Put the requested change on hold; do not follow the message’s phone number or link |
| 3. Independent verification | Staff contact the known person through a previously verified number or approved procedure | Confirm the transaction, the recipient, and the specific instruction outside email |
| 4. Technical containment if needed | Suspicious forwarding rule, session, authentication event, or unauthorized message | Follow the documented incident process, preserve relevant evidence, and restrict access appropriately |
| 5. Recovery and communication | A questionable transfer, exposed files, or disruption to the mailbox | Coordinate banking response, technical investigation, and legally appropriate notifications |
The key point is the separation of trust. An authenticated email address can still send a malicious instruction after account compromise. Likewise, a forged sender may pass some mail authentication checks if the attacker controls a different, legitimate-looking domain.
The payment-change rule every practice should write down
A law firm that processes retainers, settlements, escrow movements, or vendor payments should specify a procedure that does not depend on a single inbox.
- Treat any change to bank or routing information as a new instruction, even if it is inside a familiar email thread.
- Call a previously verified number, not a phone number introduced in the same request. If the contact cannot be reached, pause the transaction.
- Use dual approval when appropriate for high-impact transfers. The approver should verify the recipient and reason, not merely sign off that an email arrived.
- Record verification: who confirmed the instruction, through which known channel, and when.
- Define escalation: office staff must know whom to contact immediately if a transfer has already been initiated or an account seems compromised.
A procedure that exists only in an employee handbook but has never been practiced is fragile. Test it with a harmless example during onboarding and refresh it when staff responsibilities change. The FBI/IC3 recommends secondary-channel verification of changes in account information.
Law firm email security: five controls against account takeover
The security tools below are examples of safeguards, not a complete configuration guide. The correct settings depend on the firm’s Microsoft 365 licenses, other mail services, and approved access model. A more detailed control-by-control review belongs in the separate Microsoft 365 security checklist article.
1. Strong authentication and administrator separation
Require phishing-resistant authentication where supported and appropriate, or at minimum properly configured multifactor authentication for accounts. Use dedicated administrator identities and least-privilege roles. Check whether older authentication methods or exceptions undermine the policy.
MFA reduces risk, but it does not establish that a session or device is trustworthy in every circumstance. Periodically review sign-in logs, privileged users, and account recovery methods.
2. Email authentication: SPF, DKIM, and DMARC
These complementary DNS and signing mechanisms help receiving systems evaluate whether a sender is authorized to use a domain. SPF identifies permitted sending infrastructure, DKIM signs messages, and DMARC publishes a domain policy for failed alignment and reporting.
They reduce some kinds of spoofing, but they cannot guarantee that a message from a legitimately compromised account is safe. A lookalike domain with its own properly configured email authentication can also create a convincing phishing message. Review every legitimate service that sends mail on the firm’s behalf before enforcing a strict DMARC policy.
3. Impersonation and malicious-content protection
Microsoft 365 includes basic Exchange Online Protection; advanced anti-impersonation and malicious-link or attachment features depend on the relevant Defender for Office 365 entitlements and configuration. Confirm that named partners, high-risk staff, and important correspondent domains receive the intended protection where supported.
Review allow lists and bypass rules. Overly broad exceptions can silently weaken the controls a firm believed were protecting it.
4. Monitoring mail forwarding and suspicious inbox rules
A compromised mailbox may contain rules that move, delete, or forward messages. Microsoft specifically lists unusual forwarding and inbox rules among indicators of potential compromise. Alerting should cover inappropriate external forwarding, anomalous sign-ins, and unexplained mailbox permission changes where supported by the environment.
IT personnel need a documented procedure for investigating alerts without inadvertently deleting material that may be needed for a legal or security investigation.
5. Endpoint security and secure recovery
Account credentials are only part of the picture. A compromised workstation or stolen session may also expose email and client documents. Ensure managed devices have updates, supported endpoint protection, encryption, and a process for isolating devices when necessary.
Recovery should cover more than password reset: revoke sessions where appropriate, address persistent access mechanisms, review connected applications and delegated permissions, and validate clean access before returning to routine operations.
The moment an account appears compromised
Do not wait for absolute certainty before escalating a plausible account takeover. A suspicious payment instruction, unexpected forwarding rule, or unusual sign-in is enough to start a proportionate internal review.
For a Microsoft 365 environment, Microsoft’s incident guidance includes blocking further access when warranted, resetting credentials as part of a broader response, revoking active sessions, inspecting forwarding and inbox rules, and reviewing unauthorized activity. The sequence should be directed by someone with proper administrator permissions; preserve logs and evidence before making changes that could remove useful information, when practical and safe.
If money may have been transferred fraudulently, contact the bank or originating financial institution immediately. The FBI/IC3 notes that quick requests for recall or reversal can matter. Consider filing a complaint with IC3 and consulting appropriate legal and insurance contacts. Security incident response, client communication, and legal notification duties should be coordinated rather than guessed by a helpdesk technician.
This article does not replace a formal incident response plan or state-specific legal advice.
What the office manager owns—and what IT owns
| Decision or task | Practice leadership / office operations | IT or security owner |
|---|---|---|
| Approve payment changes | Define independent verification and sign-off thresholds | Help safeguard the systems carrying the requests |
| Recognize a suspicious instruction | Pause action, contact trusted counterpart, escalate | Collect relevant message and sign-in evidence |
| Secure accounts | Authorize emergency access changes and coordinate staff | Contain access, review sessions, rules, authentication, devices |
| Respond to possible financial loss | Contact financial institution and appropriate advisers immediately | Preserve technical records and identify related account activity |
| Communicate after an incident | Determine clients, insurers, lawyers, and other stakeholders to involve | Provide verified technical facts and recovery status |
| Prevent recurrence | Train staff and reinforce payment workflow | Tune policies, close security gaps, review exceptions |
Small firms often outsource parts of the technical column. They cannot outsource the need for a clear internal owner of payment approval and client communication.
A five-minute tabletop exercise for your next staff meeting
Use a fictional request to change payment instructions. Ask an employee to describe exactly what they would do before any money moves. Can they find the previously verified contact details? Would someone else approve the change? Who is on call if they suspect the email is malicious? Is there a simple place to record verification?
Then ask IT a second set of questions: Could you identify unexpected mailbox forwarding? Who receives risky sign-in alerts? Do you know how to revoke suspicious sessions? Where would you obtain message traces and audit evidence?
The purpose is not to score people. It is to find places where the procedure depends on memory, a single employee, or an unclear handoff.
Email security is a process, not a filter setting
Law firm email security cannot depend on filters alone. An email filtering product can be excellent and still miss a convincing message delivered through a genuine compromised account. Staff training can help and still fail under deadline pressure. The strongest practical model combines identity security, monitored email controls, a non-email method of verifying sensitive instructions, and a rehearsed incident response.
For a small practice, the immediate priority is modest: make payment and confidential-file changes independently verifiable, and make suspicious activity easy to escalate.
If you want a technical review of the controls behind that process, discuss law firm email security with IT-Emergencies. We offer remote-first IT expertise; any response scope or service coverage should be agreed before engagement.
Sources & further reading
- FBI Internet Crime Complaint Center — Business Email Compromise
- Microsoft Learn — Respond to a compromised Microsoft 365 email account
- Microsoft Learn — How email authentication works
- Microsoft Learn — Anti-phishing policies and impersonation protection
- American Bar Association — Rule 1.6 confidentiality
- ABA — Lawyer liability for wire transfer fraud
The opening story is hypothetical. Any legal, ethical, insurance, or client-notification obligations depend on the actual facts and applicable law; consult qualified counsel where needed.
© 2026 IT-Emergencies. All rights reserved.
Unauthorized copying, reproduction, or republication of this article is prohibited, except as permitted by applicable law or with prior written permission.
Original source: Law Firm Email Security: Preventing Account Takeovers and Payment Fraud
