Disclaimer: This is purely general information, not legal advice.
Let’s look at this scenario: It’s Thursday afternoon. The closing is set for Friday morning, and an email from the title company arrives with updated wiring instructions. The same logo, same signature block, same friendly “let us know if you have questions.” Nothing looks strange or calls for alarm, and that’s exactly what makes wire fraud work.
Criminals don’t need to break into your trust account. They just need someone to send the money to the wrong place, politely and on schedule. Here’s how law firm wire fraud prevention actually works.
How Does Wire Fraud Target Law Firms?
Large sums, firm deadlines, and lots of emails. The trust account usually isn’t the weak point. The conversation around it is.
- Real estate closings. Lenders, agents, title companies, and clients all email about the same transaction, which gives real estate closing wire fraud plenty of room to hide.
- Settlements. The funds clear, and a request to “send my share to my new account” sounds reasonable.
- Retainers. Small, frequent, and routine. Routine is exactly the point.
What does the FBI call the scam where criminals spoof a trusted sender or break into a real mailbox to redirect a payment?
The FBI calls this business email compromise, or BEC. A criminal either spoofs a trusted sender or breaks into a real mailbox and reads along until money is about to move. Then, late in the game, the instructions “change.”
Here’s what many firms miss: the compromised inbox often isn’t yours. It might be your client’s or the title company’s, so stopping business email compromise at a law firm requires technology and process.
What Are the Warning Signs?
- Urgent changes to banking details, especially in the middle of a transaction.
- Lookalike domains. @cedarbendtitIe.com instead of @cedarbendtitle.com. (Were you able to tell that was an uppercase “i” instead of a lowercase “L” in the word “title” on the first domain? Probably not). One character that is usually spotted afterward, or virtually impossible to spot at all.
- Requests to skip procedure. “I’m in meetings all day, please don’t call.”
- Small mismatches, like a reply-to address that differs from the sender.
None of these are proof on their own. Together, they’re a very good reason to pick up the phone.
How Can an IT Partner Strengthen Trust Account Security?
IOLTA fraud protection starts in the inbox.
Email authentication.
SPF, DKIM, and DMARC are domain settings that tell other mail servers which systems may send email as your firm. They make spoofing your real domain much harder, though they don’t stop lookalike domains.
Impersonation protection.
Advanced filtering flags lookalike domains, mismatched display names, and first-time senders asking about payments, and “external sender” banners prompt a pause before anyone replies.
Authentication and account hygiene.
MFA on every mailbox, regular checks for suspicious forwarding rules (a favorite hiding spot for attackers), and prompt closing of former employees’ accounts.
24/7 monitoring.
A 2 a.m. sign-in from another country gets caught and locked down while it’s still a password reset, not a recall request.
Security awareness training.
Phishing simulations built on real scenarios, like a revised closing statement, help staff spot a fake request.
What Procedures Should Your Firm Follow Before a Wire Goes Out?
Technology narrows the gap. Procedure closes it.
An email arrives with new wiring instructions. Which phone number should you call to verify the change?
Before any wire leaves your trust account, and whenever payment details change, call the recipient at a number already on file, like the one in the engagement letter. Never use a number from the email asking for the change.
If the phone number came from the email, it isn’t verification. It’s a callback to the fraudster.
Next, require dual approval. One person prepares the wire, and a second confirms the call happened before releasing it. One rushed moment can’t send six figures to the wrong bank.
Finally, tell clients in your engagement letters and closing packets that your firm will never change wiring instructions by email. When a fraudster later sends them “new instructions,” that notice is what makes them call you first.
These habits also support your ethical duties. ABA Formal Opinion 477R calls for reasonable efforts to prevent unauthorized access to client information sent electronically. State rules govern, so confirm specifics with ethics counsel.
What Should You Do If Fraud Happens?
Call your bank immediately and request a recall of the funds, as the FBI advises.
File a complaint with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov as soon as possible, regardless of the amount.
Notify your insurer, IT partner, and ethics counsel. Your insurer may have reporting requirements, your IT partner closes the way in, and ethics counsel guides your obligations to clients.
And don’t delete the suspicious emails in a panic. They’re evidence.
LG Networks Can Help Protect Your Firm’s Trust Accounts
LG Networks provides IT services for law firms across Dallas-Fort Worth, including email security, MFA rollout, 24/7 monitoring, security awareness training, and compliance support. If you’re weighing managed cybersecurity services in Dallas, picture this: what would your next closing feel like if every wiring email had already been checked twice?
Take the first step. We’ve got you covered.
We can help put email and payment protections in place.
Contact Us Today →- FBI Internet Crime Complaint Center, “Business Email Compromise: The $43 Billion Scam” (public service announcement, May 2022)
- ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 477 (May 2017, revised as 477R)
