Michael Bannach
The closing is Thursday at ten. On Tuesday afternoon the buyer’s attorney receives an email from the seller’s paralegal, whose name, signature block and email address are all exactly right, with updated wire instructions for the closing funds. The note explains that the seller’s firm has changed banks and apologizes for the late change. It references the property address, the closing date and the title company by name. It reads like every other email in the thread, because it was written by someone who had been reading the thread for three weeks.
The attorney forwards it to the client. The client wires the money Thursday morning. The seller’s firm calls at 11:15 to ask when the funds will arrive.
Nobody at either firm did anything their old habits would have called careless. The email came from the paralegal’s real account. It was not spoofed and it was not a lookalike domain. Her mailbox had been quietly compromised in early March, when she typed her password into a page that looked like the firm’s document system, and the person who collected it had been patient.
Why a law firm’s inbox is worth stealing
A law firm’s inbox is one of the few places where strangers move large sums on the strength of an email, and where everyone involved is too busy to call and confirm. That is the whole reason it gets targeted.
Inside the mailboxes of a firm of fifty to five hundred people are wire instructions for closings and settlements, retainer and trust account details, client financial records, privileged communications about matters that would be worth a great deal to the other side, and the occasional personnel file. Any one of those is a pretext. Clients expect a note that says “log in to the portal for the updated settlement statement,” because firms send that note every week.
The four risks we see most often at firms this size are business email compromise and wire fraud, ransomware locking matter files, lost devices with unencrypted client data, and weak vendor security in e-discovery and document platforms. The first one is the one that produces the Thursday phone call.
What was actually missing on Tuesday
Walk the scenario backward and three controls would have stopped it, at three different points. They work in layers, and many firms have only one of them.
Multi-factor authentication on every mailbox, including the paralegals’. When the paralegal typed her password into the fake page in March, MFA is what should have made that password worthless on its own. Firms often enable it for partners and skip the staff accounts, which is backward: the paralegal is the one on every closing thread.
Email protection that watches how a mailbox behaves. A compromised real account defeats every control that checks whether a sender is legitimate, because the sender is legitimate. What catches it is a layer that flags a mailbox rule created to hide replies, a login from a city the firm has never worked in, a sudden burst of forwarding, or a message to a client containing new bank details. A separate layer opens attachments in a sandbox before they reach anyone and checks links at the moment of the click, which is the layer that had a chance to catch the March page.
A firm rule that wire instructions are confirmed by phone, every time, using a number from the file and not from the email. This is a policy, not a product, and it is the control that works even when the first two fail. A firm that writes it down, trains to it, and tells clients at engagement that the firm will never change wire instructions by email alone has removed most of the value of compromising its inbox.
Three weeks inside a paralegal’s mailbox
First the attacker reads. A rule goes in that files any reply containing the words “wire,” “bank” or “confirm” into a folder the paralegal will never open. The attacker learns which matters are closing, who the counterparties are, which title company is involved and what the real instructions say.
Then they act, once, at the moment when the money is about to move and the deadline makes everyone hurry. The email goes out from the real account, replies are swept into the hidden folder, and the attacker waits.
Afterward the seller’s firm has two problems. The first is the money, and the odds of getting it back fall with every hour before the sending bank is told. The second is the mailbox, which has to be treated as a breach of every client’s confidential information it contained, with whatever notification and ethics obligations follow from that. The firm’s cyber insurance carrier will ask when MFA was enabled on that account, and will have the firm’s application in front of them when they ask. The buyer’s firm has its own problem: a client whose money is gone, and a conversation about who should have picked up the phone.
Three questions for whoever runs your IT
- Which mailboxes in the firm do not have multi-factor authentication today, including staff and shared accounts, and when will that number be zero?
- What would alert us if someone created a hidden forwarding rule in a paralegal’s mailbox or logged in from somewhere we have never been?
- Have we told every client, in writing, that we will never change wire instructions by email alone, and is that in our engagement letter?
The third question is for the managing partner as much as for the IT provider. It is the cheapest control on the list and the one least often written down.
How we handle it for law firms
Our work with law firms treats confidentiality as the product. Encryption at rest and in transit, multi-factor authentication on every account, access controls by matter, secure remote access and audit trails are the baseline, documented so the firm can answer client security questionnaires without a scramble. Email protection against business email compromise sits in front of every mailbox. Staff training uses phishing simulations built from what lands in a law firm inbox: the changed wire instructions, the portal re-login, the court notice with a link to the docket. Deadline-sensitive issues are treated as priority incidents with a direct escalation path, and maintenance is scheduled around filing dates and court calendars. We support Clio, PracticePanther, NetDocuments and Time Matters, and we coordinate with those vendors so attorneys are not the go-between.
If you want a plain read on where the firm stands, the three-minute IT and security scorecard turns your answers into a written roadmap, and the conversation after it is free. You can also read more about how we work with law firms.
