Business Email Compromise for Law Firms: The Four Details That Give a Wire-Fraud Email Away

Firms we talk to after an email compromise tend to start in the same place. Someone got into a mailbox, and a partner wants to know what was read. The harder question comes next: did any money move?

The money at risk is often the client’s. Closing funds, settlement proceeds and estate distributions pass through your trust account, and business email compromise (BEC) exists to redirect payments like those.

Sometimes the criminals use your own mailbox to send the request. Sometimes they pose as your firm and email your client instead.

BEC is the part of law firm cybersecurity that ends at the bank. This guide follows one wire-fraud email from the inbox to the wire to the aftermath, names the four details that give it away, and shows why the most familiar one can vanish when the mailbox is real.

In the firms we support, what stops the wire is a phone call on a number you already have.

What Is Business Email Compromise?

Business email compromise is a payment fraud: criminals take over or imitate an email account, then use it to send instructions that move money to an account they control.

How the FBI Defines Business Email Compromise

The FBI’s Internet Crime Complaint Center (IC3) defines BEC in its 2025 IC3 Annual Report as a scam carried out “by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds.”

How Big Is the BEC Problem? (2025 Figures)

The FBI’s 2025 IC3 Annual Report counted 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025. Both figures rose from 2024, when IC3 recorded 21,442 complaints and $2,770,151,146 in losses.

Is Business Email Compromise the Same as Phishing?

Phishing is often how criminals get into a mailbox, and BEC is the payment fraud they run once they’re in, or once they can pass as someone you trust. That’s why the email that asks for the money often carries no link or attachment for a filter to catch.

Both are among the cybersecurity threats facing law firms, and BEC is the one that ends in a wire.

How Does a BEC Attack Reach a Law Firm’s Money?

A BEC attack reaches your firm’s money through the email threads that already carry payment instructions, and it comes from one of two directions: through your own mailbox, or by impersonating your firm to your client.

Either way, the attacker follows the three stages in the U.S. Secret Service’s guide to business email compromise: surveillance, impersonation and fraudulent instructions.

A small firm faces the same odds as a large one, because the attack takes one mailbox and one wire.

When Your Firm’s Own Mailbox Is the Way In

When an attacker controls a real firm mailbox, the target is whoever releases the wire. The instruction arrives from a real colleague’s address, inside a thread the person releasing the money already knows.

The address, the signature and the matter are all real, so nothing looks wrong, and your firm sends the money itself.

When Criminals Pretend to Be Your Firm

Criminals also impersonate a law firm to its own clients. The 2025 IC3 Annual Report describes clients who “were closing on a home when they received an email impersonating their legitimate attorneys,” then sent a wire for over $449,000.

In this direction the criminal can work without any access to your systems, using your firm’s name and the closing date to move your client’s money.

What Is the First Stage of a BEC Attack?

The first stage is surveillance: the attacker gets into or imitates a mailbox, then watches the thread to learn who pays whom, and when. The Secret Service sets out the three stages in this order:

By the third stage, the attacker knows your closing date, your bank and the names everyone uses in the thread.

What Are the Four Details That Give a Wire-Fraud Email Away?

Four details give a wire-fraud email away, and you can see all of them in one ordinary-looking message. The sample below is the kind of email that reaches a firm before a closing: a reply from the closing team, new bank details and a deadline.

1. The Sender Is Almost Right

The sender is almost right when the address is one character off the real one, or a familiar display name sits over an address you don’t recognize. The Secret Service warns that scammers “may use fake email addresses that look legitimate.”

In North Carolina’s 2015 Formal Ethics Opinion 6, the hacker’s spoofed address imitated the realtor’s or the seller’s, and “only one letter is different.”

2. The Bank Details Change, with a Reason

The bank details change, with a reason, when new wire instructions arrive with an explanation attached: an audit, a problem at the bank, a new account.

The Secret Service names this tactic, warning that scammers “may claim audits or bad checks to justify new payment instructions.” Any change to wire instructions, however well explained, is a reason to call before you send.

3. It’s Urgent, and No One Can Be Reached

It’s urgent, and no one can be reached, when the email pushes for the money before today’s closing and the sender says they can’t take a call. The Secret Service describes scammers who “may claim to be ‘unreachable’ and pressure the victim to pay quickly.”

4. It Arrives in a Real Thread, Right on Time

It arrives in a real thread, right on time, when the request is a reply inside an ongoing conversation, sent just before a closing, settlement or disbursement.

That’s the Secret Service’s impersonation stage, where scammers “pose as trusted contacts in ongoing conversations.” The IC3 closing case fits the pattern: the email reached the clients while they were closing on a home.

Which Details Disappear When the Mailbox Is Really Compromised?

The first detail disappears when the attacker is inside your real mailbox, because the email comes from the right address. The other three still show, as the comparison below sets out.

The people releasing wires are busy lawyers and staff working fast, and a convincing email from a colleague’s real address gets acted on. So your firm needs a step at the wire that works even when the email is perfect.

Which Controls Stop the Wire Even When the Email Is Perfect?

A call-back on a number from your own file stops the wire even when the email is perfect, because the attacker controls the email and not the phone at the other end.

The four controls below cover what Microsoft 365 can’t, and each one is something you can put in writing this week.

Call Back on a Number You Already Have

Call back on a number from your firm’s own file, never one from the email, before any wire leaves. That’s the step North Carolina’s 2015 opinion faulted the lawyer for skipping, and it’s the Secret Service’s advice: “Verify payment requests by calling known contacts before sending money.”

Record who you called, the number you used and the time, and keep that note in the matter file.

Warn Clients in Writing Before They Send Funds

Warn clients in writing at engagement, and again before closing, and tell them to confirm any wire instructions by phone with your office. North Carolina’s 2020 Formal Ethics Opinion 5 held that a letter at the outset with that warning and instruction will “reasonably minimize the risks associated with the transfer of funds” in a real property transaction.

ABA Formal Opinion 477R makes a related point about email itself: a lawyer “should warn the client about the risk of sending or receiving electronic communications” on an account a third party has, or may gain, access to.

Never Change Wire Instructions by Email, and Say So

Tell clients in writing that your firm never changes wire instructions by email. Once that’s in the engagement letter, any email that changes them is a reason to stop and call, whoever it seems to come from.

Require Two People to Release Trust Funds

Require a second person to approve every wire from the trust account, so one convincing email can’t move client funds on its own. The second approver checks one thing: that the call-back happened, on a number from the file. In a small firm, that can be the partner on the matter and the bookkeeper, as long as one person never does both.

For closing wires, your bank’s own call-back and verification services, and dedicated wire-verification services, fit the payment step better than anything an IT provider does. Ask your bank what it offers before your next closing.

Put DMARC and MFA in Place First

DMARC set to reject (the email record that tells receiving servers to refuse mail faking your domain) and enforced multi-factor authentication (MFA) cut spoofing and account takeover, so put both in place first. They can’t stop an email sent from a real compromised mailbox, which is why they sit under the wire controls rather than replace them.

The settings themselves are covered in our guide to phishing controls for law firms.

What Should a Law Firm Do in the First Hour After a Fraudulent Wire?

Call your bank first. In 2025 the FBI’s Financial Fraud Kill Chain froze $679,013,183 of $1,163,919,846 in attempted theft, a 58% success rate, and the 2025 IC3 Annual Report warns that “time is of the essence.”

If you’re reading this mid-incident, start at step 1:

The IC3 closing case shows why step 2 matters: the attorneys’ own attempts to reach the receiving bank failed, and the freeze came after the clients filed with IC3, when the receiving bank reported that “the full amount was still in the account and on hold.” An IT provider is most useful at step 3, because it already holds the admin access and the sign-in logs.

If the compromised mailbox held material client confidential information, the incident may also be a data breach under ABA Formal Opinion 483, which says that in that case “a lawyer has a duty to notify the client of the breach.” Who to tell, and when, is covered in our guide to data security for law firms.

Who Pays When a Client’s Wire Is Diverted?

Whether your firm warned the client and verified the wire instructions is what North Carolina’s two bar opinions on diverted wires turn on. They’re state opinions, so read them as worked examples of how a bar weighs a lost wire.

How ABA Model Rule 1.15 Applies to a Diverted Trust Wire

ABA Model Rule 1.15 requires a lawyer to hold client property separate from the lawyer’s own, and to “promptly deliver” funds to the client or third person entitled to receive them. A diverted trust wire puts that duty in question, because the money never reached the person entitled to it. States adopt their own versions of the rule, so check yours.

What North Carolina Decided About Diverted Wires, Twice

The North Carolina State Bar has ruled twice on closing funds sent to a fraudster, and the difference between the two answers is process:

The same 2015 opinion, on a separate hack that emptied a trust account, says a lawyer who “has taken reasonable care to minimize the risks to client funds” is “not ethically obligated to replace the stolen funds.”

What Should Your Engagement Letters and Closing Packets Say About Wire Fraud?

Put the wire-fraud warning in your engagement letter and your closing packet, and keep a record of every call-back. Alaska Bar Association Ethics Opinion 2025-2, adopted April 23, 2025, says Rule 1.15 applies “with particular force in trust account transactions,” while lawyers aren’t “the guarantors of all aspects of a transaction.”

Rules vary by state, and this isn’t legal advice. Check your state bar’s opinions, and ask your carrier what it expects you to document.

Where Does Your IT Provider Fit, and Where Doesn’t It?

A managed IT provider protects the mailbox, and your firm protects the wire. Here’s how the work splits:

Whether wires get verified and clients get warned is a decision for your firm’s leadership, and it stays with them even when IT is handed to someone else.

Uptime Legal provides managed cybersecurity for law firms and managed IT. Whoever runs your IT, the call-back stays with your firm.

Make the Call-Back the Rule Before the Next Wire

Make the call-back the rule at the wire, because a wire-fraud email can come from your own compromised mailbox, where the look-alike sender disappears. The other three details still show, but a convincing email from a real colleague gets acted on.

In practice, that means a call on a number from your own file, a written warning in every engagement letter and closing packet, and a second person on every trust release. Those steps keep client funds out of a fraudster’s account, and they’re what the North Carolina and Alaska opinions weigh when a wire goes wrong.

WHAT’S NEXT

FAQ