Email security for law firms: threats, ethics duties and a checklist

A law firm's inbox is where client confidences, settlement figures and trust account instructions meet. That makes it attractive to criminals who want either the information or the money. This guide covers the email threats specific to law firms, what ABA Formal Opinions 477R and 483 expect, and a checklist for a managing partner or office administrator.

This is general information, not legal advice. Your state's rules of professional conduct and ethics opinions control, so check them and talk to ethics counsel about your own facts.

Why are law firms targeted by email attacks?

Law firms are targeted because a single mailbox can expose confidential client information and redirect client money. The ABA said so directly in Formal Opinion 477R: firms "obtain, store and use highly sensitive information about their clients while at times utilizing safeguards to shield that information that may be inferior to those deployed by the client." It adds that the information a firm holds is "more likely to be of interest to a hacker and likely less voluminous than that held by the client."

The money side is just as important. Business email compromise (BEC) is fraud in which a criminal impersonates or takes over a trusted email account to redirect a payment. The FBI's IC3 recorded $55,499,915,582 in exposed losses from BEC worldwide between October 2013 and December 2023 (IC3 PSA I-091124-PSA). Law firms sit in the middle of settlements, real estate closings, escrow releases and retainer refunds, so they're both a target and a channel.

What email threats do law firms actually face?

Law firms face general phishing plus schemes built around how legal work moves money and documents:

Fake payment instructions and hijacked threads

The most expensive email in a law office is a message that changes where money goes. Sometimes it comes from a lookalike domain, such as smithlaw-group.com instead of smithlawgroup.com. Sometimes it comes from the real mailbox of a client, lender or opposing counsel that has been hacked, which is called email thread hijacking. A hijacked message passes every technical check because it really did come from that account. Here is an example of a message to stop and verify:

Example: "Hi Karen, our client has asked that the settlement funds go to their business account instead. Updated wire details attached. We need this out today so the release can be signed. Thanks, Mark."

The FBI's first tip for BEC is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). In practice that means a call to a number you already have in the file. For closings specifically, see real estate wire fraud and fake closing instructions, and for the general pattern, email thread hijacking.

Counterfeit checks from fake clients

A fake-client scheme uses email to set up a trust account loss. The Washington State Bar Association's scam notices describe the usual version: a prospective client asks the firm to collect a debt, the "debtor" agrees to pay quickly and sends what appears to be a valid cashier's check, and the firm deposits it and wires the money on. When the check is reversed, "the trust account is charged back the value of the check." WSBA notes these clients tend to prefer written correspondence, and advises waiting for checks to clear.

Phishing that leads to mailbox takeover

Most mailbox takeovers start with a fake sign-in page disguised as a shared document, e-filing confirmation or court notice. Once inside, attackers add rules that forward or hide mail so they can watch a matter for weeks. See malicious inbox rules and signs your email account is compromised.

Criminals pretending to be your firm

In August 2025 the FBI warned of fictitious law firms that contact fraud victims offering to recover their money, including through "impersonation of actual lawyers and/or legitimate law firms" and documents with a "legitimate law firm insignia or letterhead" (IC3 PSA I-081325-PSA).

What does ABA Formal Opinion 477R require for email?

ABA Formal Opinion 477R says a lawyer generally may send client information over the internet, including by unencrypted email, if the lawyer "has undertaken reasonable efforts to prevent inadvertent or unauthorized access." It updated the ABA's 1999 opinion on email (99-413) and ties email security to three Model Rules:

• Rule 1.1, Comment [8]: a lawyer should keep abreast of "the benefits and risks associated with relevant technology."
• Rule 1.6(c): "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."
• Rule 1.4: when highly sensitive information is involved, the lawyer should explain the risks to the client and agree on how to communicate.

It doesn't list required products. What counts as reasonable "is not susceptible to a hard and fast rule" and depends on factors in Comment [18] to Rule 1.6, including the sensitivity of the information, the likelihood of disclosure without added safeguards, and the cost and difficulty of those safeguards. It also warns that a lawyer "may be required to take special security precautions" when a client agreement or the law requires it, or when the information needs a higher degree of security.

The opinion then offers seven considerations. Here's how each maps to email:

The opinion warns lawyers to be cautious when a client uses a device or email account a third party can access. In a footnote, it also cites a Texas ethics opinion listing situations where a lawyer should consider encryption or another precaution, including sending highly sensitive information, emailing an account the client shares with others, or emailing a client when a third person, "such as a spouse in a divorce case," may know the password. For the encryption options themselves, see email encryption types for business.

What does ABA Formal Opinion 483 say about a hacked firm mailbox?

ABA Formal Opinion 483 says lawyers must make reasonable efforts to monitor for breaches, act promptly to stop one, investigate what happened, and notify affected current clients. It defines a data breach as "a data event where material client confidential information is misappropriated, destroyed or otherwise compromised," or where the lawyer's ability to perform legal services is significantly impaired. Ransomware that locks client files counts even if nothing is stolen.

The opinion's main points for email:

1. Monitor. Lawyers "must employ reasonable efforts to monitor the technology and office resources connected to the internet." For email: sign-in alerts and audit logs that someone reviews.
2. Stop the breach. When a breach "is either suspected or detected," Rule 1.1 requires the lawyer to "act reasonably and promptly to stop the breach and mitigate damage." The opinion recommends "proactively developing an incident response plan."
3. Determine what occurred. "A competent attorney must make reasonable efforts to determine what occurred during the data breach," including which files were accessed.
4. Notify current clients. The opinion says disclosure is required "if material client information was actually or reasonably suspected to have been accessed, disclosed or lost." At minimum, clients must be told there has been unauthorized access or disclosure, or that it's reasonably suspected. The notice must give "enough information for the client to make an informed decision as to what to do next."

Opinion 483 doesn't require notice to former clients as a matter of ABA ethics, but agreements and privacy laws may, and state breach notification laws apply separately. Our email security incident response plan guide gives you a template.

How do you stop wire fraud at a law firm?

A written call-back rule stops most email wire fraud. Filtering, MFA and DMARC reduce fake messages, but mail from a client's real, hacked account passes every technical check.

1. Put it in the engagement letter. Tell clients your firm will never change wiring instructions by email.
2. Verify every new or changed instruction by phone. Use a number from the file or the client's earlier correspondence, never the number in the message. Record who confirmed it and when.
3. Use two people for outgoing wires. One prepares, one approves after reading the verification note.
4. Wait for deposited funds to clear before disbursing, especially for new clients and fast-paying debtors.
5. If money has gone, act within hours. Call your bank and ask it to recall the wire, then file at ic3.gov. Our vendor invoice fraud guide covers the recovery steps.

Is Microsoft 365 or Google Workspace security enough for a law firm?

For many small and mid-size firms, Microsoft 365 or Google Workspace configured properly is a reasonable baseline: both filter spam and malware and support MFA and external sender warnings. Review Microsoft 365 preset security policies or Google Workspace advanced phishing and malware protection first.

An MX-level filter adds a separate checkpoint. MX-level filtering means your domain's MX records point to a filtering service that checks each message before your platform delivers it. It helps when phishing keeps getting through or when each lawyer should manage their own quarantine. Under 477R's seventh consideration, ask any such vendor where mail is processed and how long it's kept. iBlockSpam processes mail in the United States and keeps message history for 30 days; see our law firms page.

How do you stop criminals pretending to be your firm?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when both fail. Include your practice management, e-signature and billing services, or their mail will fail too. A DMARC record at enforcement looks like this example:

_dmarc.example-law.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-law.com"

Start at p=none, read the reports, then move to quarantine and reject. Our DMARC from none to reject guide walks through it. DMARC can't stop lookalike domains, so check which near-copies of your domain exist with the Lookalike Domain Generator and read lookalike domain phishing.

Law firm email security checklist

1. Turn on MFA for every mailbox, starting with partners, the bookkeeper and anyone who approves wires.
2. Give every lawyer and assistant their own login; no shared passwords for the front desk.
3. Adopt the wire procedure above and put the call-back rule in engagement letters.
4. Decide, at intake, when a matter needs encrypted email or a client portal, and record it (477R considerations 4 and 5).
5. Review inbox rules and external forwarding on every mailbox each quarter.
6. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
7. Review your email, filtering and archive vendors (477R consideration 7).
8. Train everyone, including nonlawyer staff, on phishing and payment fraud at least once a year.
9. Write an incident response plan that covers investigation and client notice (Opinion 483), and name ethics counsel and your insurer in it.

Next steps

• Run the free Email Health Check on your firm's domain to see your MX, SPF and DMARC setup.
• Send your wire call-back rule to every lawyer and staff member this week, and add it to new engagement letters.
• Read Formal Opinions 477R and 483 with your state's own opinions, and ask ethics counsel what applies to you.
• If you want an inbound filtering layer each lawyer can manage from a digest email, see email protection for law firms. Pricing is per domain, so adding an associate doesn't change the bill.

More threat guides are in our phishing and threats topic.