Why law firms are the number one target for wire fraud

Business email compromise is not a technical attack. It is a research project followed by a well-timed email. The attacker learns who is handling a closing, when funds are due to move, and what your office's email signature looks like. Then they send an instruction that is almost right — one character different in a domain, or a reply-to that lands in a lookalike inbox.

Why the legal sector attracts it

Firms hold other people's money, work under deadlines, and communicate by email with clients who are often anxious and in a hurry. A single fraudulent wire in a real estate or estate matter can exceed a firm's annual profit. Insurers know this, which is why cyber coverage applications now ask directly about multi-factor authentication, email filtering and payment verification procedures.

The controls that actually stop it

Multi-factor authentication on every mailbox is the single highest-value control, and phishing-resistant methods are now achievable for small firms. Beyond that: external-sender banners, domain-based message authentication enforced at the gateway, mailbox rules that alert on forwarding changes, and a mandatory out-of-band callback on a known number before any wire instruction is acted on.

Test it, do not assume it

A control nobody has tested is a hope. We run simulated payment-fraud emails against firms every quarter and report who clicked, who replied, and who picked up the phone. The results are uncomfortable the first time and unremarkable by the third — which is exactly the point.