# Email protection for law firms, priced per domain

URL: https://iblockspam.com/solutions/law-firms
Last updated: 2026-10-09

> Email filtering for law firms: block phishing, spoofing and wire-fraud lures before they reach lawyers. Personal quarantines and per-domain pricing.

Filter phishing, spoofed senders and malicious attachments before they reach your lawyers and staff. Every person gets a personal quarantine, and the price stays the same whether you have five lawyers or fifty.

A law firm needs email filtering that stops phishing, spoofed senders and malicious attachments before they reach lawyers and staff. It also needs clear quarantine controls and a payment-verification process that email can't override. iBlockSpam filters mail at the MX level, in front of the platform you already use, for one price per domain.

## Why law firms are targeted

Law firms hold client confidences, run client money through trust accounts and send payment instructions by email. That makes them useful to criminals in two ways: as a source of information and as a route to money.

Business email compromise (BEC) is the main financial threat. The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025 ([IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). The same report describes a 2025 case in which home buyers received an email impersonating their attorneys and wired more than $449,000 to a criminal's account. An earlier IC3 alert lists real estate attorneys among the targets of BEC in property transactions and explains the method: criminals get into one participant's email, watch the deal and time a request to change payment details ([IC3 PSA I-060923-PSA](https://www.ic3.gov/PSA/2023/PSA230609)).

### Common attacks on firms

- **Changed payment instructions.** A message that appears to come from a client, a lender or opposing counsel says the receiving account has changed. Our guide to [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) shows how these requests are built.
- **Impersonation of clients and opposing counsel.** Criminals register [lookalike domains](https://iblockspam.com/blog/lookalike-domain-phishing) one character away from the real one, or spoof the display name.
- **Credential phishing.** Fake document-sharing or e-filing notices lead to sign-in pages that steal passwords. Some put the link in a [QR code](https://iblockspam.com/blog/qr-code-phishing-quishing), which is harder to inspect.
- **Malicious attachments.** Invoices, "engagement letters" and court documents that carry macros or malware.

## What the professional guidance says

The ABA Standing Committee on Ethics and Professional Responsibility has addressed email security in two formal opinions ([ABA formal ethics opinions](https://www.americanbar.org/groups/professional_responsibility/publications/ethics_opinions/)):

- **Formal Opinion 477R (2017)** says a lawyer generally may send client information over the internet after making reasonable efforts to prevent unauthorized access. What counts as reasonable depends on factors such as the sensitivity of the information and the cost and difficulty of safeguards. It also says lawyers must train staff in reasonably secure electronic communication.
- **Formal Opinion 483 (2018)** says lawyers must make reasonable efforts to monitor their technology for breaches, and must notify clients when a breach involves, or is substantially likely to involve, material client information.

These opinions are advisory. Your own jurisdiction's rules control. This page isn't legal advice, and iBlockSpam doesn't make any firm compliant with any rule. Filtering is one safeguard among several you might choose.

## What iBlockSpam does for a firm

### Filtering before mail reaches anyone

Your MX records point to our filtering servers. Inbound mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace, [Exchange Server](https://iblockspam.com/platforms/exchange-server) or your hosted server. Advanced settings add attachment-type filters, a Microsoft Office macro filter, geographic filters and custom domain rules. If you're deciding whether you need a gateway at all, compare it with [Defender for Office 365](https://iblockspam.com/compare/defender-for-office-365-vs-email-gateway) or [Google Workspace's built-in protection](https://iblockspam.com/compare/google-workspace-built-in-vs-gateway).

### Quarantine for each lawyer, oversight for the office

- A **personal quarantine** for every user, with digests hourly, daily, on a chosen weekday or on a custom schedule. A lawyer waiting for a filing receipt can find and release it without calling IT.
- A **shared quarantine** so an administrator can review held mail for the whole domain.
- **Approved and blocked sender lists** that can require sender verification, so a spoofed message claiming to be from an approved client doesn't skip the checks. See [allow and block lists](https://iblockspam.com/features/allow-block-lists).

Learn more about [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests).

### Records and resilience

You can search 30 days of message history to answer "did that email arrive?" If your mail server is down, mail is held for up to 5 days and then delivered. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect and daily on Protect Plus.

## A verification process filtering can't replace

Filtering lowers the volume of fraud that reaches inboxes. The control that stops a fraudulent payment is a process. These steps follow FBI guidance to verify account changes through a secondary channel:

1. **Tell clients at intake** that your firm will never change payment instructions by email.
2. **Call to confirm any new or changed instructions** using a phone number from the file, never one in the message. The CFPB gives home buyers the same advice: confirm closing details only by phone, with numbers saved in advance ([CFPB: Beware of mortgage closing scams](https://files.consumerfinance.gov/f/documents/cfpb_mortgages-scams_one-pager.pdf)).
3. **Require a second person** to approve outgoing trust account wires.
4. **Check the sender's full address**, not just the display name, especially on a phone.
5. **If money has gone, act at once.** Ask your bank to recall the wire and file a complaint at [ic3.gov](https://www.ic3.gov). The IC3's Recovery Asset Team can ask the receiving bank to freeze funds.

Our [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) goes into more detail.

## Getting set up

Setup is an MX change plus a few platform-specific steps, guided by our setup wizard. It shows a before/after DNS comparison and the rollback steps for your domain.

1. **Check your domain** with the free [Email Health Check](https://iblockspam.com/tools/email-health-check). It reads public DNS only.
2. **Add each firm domain** and point it at the mail platform you use today.
3. **Follow the platform steps**, for example a locked-down inbound connector in Microsoft 365 or a scoped Receive connector on Exchange Server.
4. **Send test messages** and watch the first digests arrive before you tell the whole firm.

Most domains are set up in one session. That's our aim, not a promise, because DNS and platform settings vary. On Protect Plus, a person from our team runs the setup session with you. If your firm handles closings, our page for [real estate and title teams](https://iblockspam.com/solutions/real-estate) covers the client side of wire fraud, and firms that share clients with accountants can point them to our page for [accounting firms](https://iblockspam.com/solutions/accounting-firms).

## Priced per domain, not per lawyer

| | Protect | Protect Plus |
|---|---|---|
| Billed annually | $12 per domain/month ($144/year) | $19 per domain/month ($228/year) |
| Month-to-month | $15 per domain/month | $24 per domain/month |
| Mailboxes | Unlimited (count, not volume) | Unlimited (count, not volume) |
| Inbound messages included | 100,000 per domain/month | 100,000 per domain/month |
| Domain monitoring | Weekly | Daily |
| Human setup session | No | Yes |

Prices are beta pricing in USD, excluding tax. Hiring an associate doesn't change your bill. A firm with a second brand or a separate practice domain pays per domain, and domain aliases are unlimited. Compare the models in [per-domain vs per-user pricing](https://iblockspam.com/compare/per-domain-vs-per-user-pricing).

## Honest limits

- No filter catches every malicious message, and sometimes a legitimate one is held. Digests exist so people can find and release it quickly.
- Mail sent from a client's real, compromised mailbox can pass every authentication check. Payment verification is the defense.
- iBlockSpam filters inbound mail. It doesn't encrypt your outgoing client messages, replace multi-factor authentication or train your staff.
- iBlockSpam holds no SOC 2 or ISO certification. Mail is processed in the United States.

To start, run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your firm's domain, then [create your account](https://iblockspam.com/signup).

## Sources

- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3: Business Email Compromise: The $50 Billion Scam (I-060923-PSA)](https://www.ic3.gov/PSA/2023/PSA230609)
- [FBI IC3: Business Email Compromise: The $55 Billion Scam (I-091124-PSA)](https://www.ic3.gov/PSA/2024/PSA240911)
- [CFPB: Buying a home? Beware of mortgage closing scams](https://files.consumerfinance.gov/f/documents/cfpb_mortgages-scams_one-pager.pdf)
- [ABA Standing Committee on Ethics and Professional Responsibility: formal opinions, including 477R (2017) and 483 (2018)](https://www.americanbar.org/groups/professional_responsibility/publications/ethics_opinions/)

## Frequently asked questions

### Does iBlockSpam make our firm compliant with ethics rules?

No product can do that, and we don't claim to. ABA Formal Opinion 477R describes a reasonable-efforts standard that depends on your facts, and your own state's rules control. Email filtering can be one of the safeguards you choose. Whether your overall approach is reasonable is a judgment for your firm and its advisers.

### Can filtering stop wire fraud?

It reduces the number of fraudulent messages that reach people, but it can't stop all of them. A message from a client's genuine, hacked mailbox can pass every technical check. The control that stops the payment is a verification call to a phone number you already have on file before any money moves.

### Can each lawyer manage their own quarantine?

Yes. Every user has a personal quarantine and a digest email on a schedule you set, such as hourly or daily. They can review and release held mail themselves. An administrator can also review everything in the domain-wide shared quarantine.

### We use several domains. How is that priced?

Pricing is per domain, with unlimited mailboxes on each. Domain aliases are unlimited. A separate domain with its own mailboxes is priced as its own domain. Protect is $12 per domain per month billed annually (beta pricing). For IT partners managing several firms, partner terms, including pricing, are agreed individually.

### Does iBlockSpam hold SOC 2 or ISO certifications?

No, and we don't claim any. Mail is processed in the United States. Message history is kept for 30 days. Our security page and data processing terms describe how mail is handled, so you can assess them against your own obligations.

---

Source: iBlockSpam, https://iblockspam.com/solutions/law-firms (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt