Overwatch Technology logo: castle wall, shield and sights

Blog · Law firms

How law firms stop wire fraud before a settlement disappears

Overwatch Technology · · 6 min read

Stop wire fraud before a settlement disappears

The settlement is reached. The release is signed. The client is waiting on the wire. Then an email arrives with “updated” account instructions, from an address that looks exactly like yours, and the money goes somewhere it can't come back from.

This is business email compromise (BEC), and it isn't rare. The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints in 2025, up from 21,442 the year before, with reported losses of just over $3 billion. Only investment fraud cost Americans more.

Law firms are a favorite target, and it isn't because firms are careless. It's because of what firms do.

Why law firms get picked

  • Large, predictable payments. Settlements, trust disbursements and closing funds move in big amounts, on schedules that can be read from a docket or an email thread.
  • Trust is the business. Clients expect instructions to come from their lawyer by email, and they act on them.
  • Busy people under deadlines. The week a case resolves is the week nobody has time to pick up the phone and double-check.

How the attack actually unfolds

It almost never starts with malware. It starts with a password.

  1. A credential is stolen. A paralegal or attorney signs in to a convincing fake Microsoft 365 page, often reached from what looks like a court notice or a shared document.
  2. The intruder hides. A quiet mailbox rule moves anything containing words like “wire,” “settlement” or “trust” into a folder nobody opens.
  3. They read, for weeks. They learn the case, the parties, the carrier, how the firm writes, and roughly when money will move.
  4. They strike at the right moment. A message with new payment instructions goes to the client or the other side, from the real mailbox or from a domain one letter off.
  5. The money moves fast. Funds are usually transferred onward within hours.

Nothing in that sequence trips an antivirus alert. That's why the defenses below are mostly about sign-ins, mailbox behavior and process, not software you install once.

What the ethics rules expect

For a law firm, this isn't only an IT problem. The ABA Model Rules (adopted in some form in every state) touch it in several places:

  • Competence (Rule 1.1, Comment 8): keeping up with the benefits and risks of the technology you use.
  • Confidentiality (Rule 1.6(c)): reasonable efforts to prevent unauthorized access to client information.
  • Safekeeping property (Rule 1.15): client funds carry the strictest duties in the rules.
  • Supervision (Rules 5.1 and 5.3): responsibility for staff and for outside vendors who touch client data.

ABA Formal Opinion 477R addresses securing client communications, and Formal Opinion 483 covers a lawyer's duties after a data breach, including monitoring for one and telling clients when it happens. Check your own state's version; the direction is the same everywhere.

Six controls that stop it

  1. Multi-factor sign-in for everyone, partners included. Use Microsoft Authenticator number matching or a security key, and block sign-ins from places your firm doesn't work. This shuts down most of step one.
  2. Alerts on mailbox rules and forwarding. A new rule that hides messages about wires is a near-certain sign of compromise. Someone should be told within minutes, not discover it at the audit.
  3. A call-back rule with no exceptions. Any new or changed payment instruction is confirmed by phone at a number already on file, never a number in the email. Write it down. Train it. Follow it when the partner is in a hurry.
  4. Tell clients up front. Put it in the engagement letter and in your email signature: “We will never change wire instructions by email. Call us at the number you already have before sending funds.”
  5. Protect your domain. Enforce DMARC so others can't send as your domain, tag external email, and watch for look-alike domains being registered.
  6. Two people for outbound wires. Trust account disbursements need a second approver who checks the instructions against the file, not against the email.

If it happens anyway

  • Call your bank immediately and ask them to recall the wire. Hours matter.
  • File a report at ic3.gov with the transaction details.
  • Call your cyber insurance carrier before you hire anyone; most policies require it.
  • Preserve the evidence: mailbox audit logs, sign-in logs and the messages themselves. Don't wipe the account.
  • Work through your notification duties to the client and, where required, to others under your state's rules and breach laws.

The firms that recover money are the ones that notice in hours, not weeks. Every control above is really about shortening that window.

Sources