In short
- ✓Email modification fraud on completion monies is the cybercrime the SRA has warned law firms about most often.
- ✓Client money, ID documents and privileged files make even small practices a high-value target.
- ✓Multi-factor authentication, a call-back rule for bank details and Cyber Essentials close most of the gaps.
Why solicitors and law firms are targeted
Law firms handle large sums of client money, identity documents and confidential files, often agreed and moved by email under time pressure. That combination is exactly what criminals look for. The Solicitors Regulation Authority has repeatedly warned that email modification fraud, where criminals intercept or imitate emails to change bank details, is the most common cybercrime against firms, and that conveyancing funds are a frequent target.
For a high street or boutique practice in Guildford, Woking or anywhere in Surrey, the fixes are mostly practical rather than expensive: securing Microsoft 365, agreeing how bank details are confirmed, training staff for completion days and proving it all with Cyber Essentials.
The main risks
- Email modification and payment diversion on completions, client account payments and disbursements, often timed for Friday afternoons.
- Hacked Microsoft 365 mailboxes used to quietly watch transactions before sending fake bank details.
- Ransomware locking case management, document management and accounts systems.
- Personal data breaches involving ID, financial or special category data, which may need reporting to the ICO within 72 hours and considering under your SRA obligations.
- Professional indemnity insurers, lender panels and corporate clients asking more detailed questions about your cyber controls.
How I help solicitors and law firms
- Email Security & Phishing ProtectionStop criminals spoofing your firm's domain and put a bank-detail call-back procedure in place for completions.
- Microsoft 365 & Google Workspace SecurityMulti-factor authentication, alerts for suspicious sign-ins and blocks on hidden forwarding rules in fee earners' mailboxes.
- Cyber Essentials Certification SupportEvidence for insurers, lender panels and corporate clients that the core controls are in place.
- Staff Cyber Awareness TrainingShort, practical sessions for fee earners and support staff on spotting payment fraud and phishing.
- Cyber Incident ResponseFast, calm help if funds are misdirected or a mailbox is compromised, including evidence and reporting.
Cyber security checklist for solicitors and law firms
- Turn on multi-factor authentication for email, case management and online banking.
- Never accept bank detail changes by email: confirm by phone using a number already on file.
- Tell clients in your engagement letter and email footer that you will never change your bank details by email.
- Set up SPF, DKIM and DMARC so criminals can't send email as your firm.
- Block automatic forwarding of email to outside addresses and check mailboxes for forwarding rules.
- Back up case management and documents, keep a copy ransomware can't reach, and test restoring it.
- Train staff before busy completion periods and make it easy to report suspicious emails.
- Keep an incident plan that covers your bank, Report Fraud, the ICO, your insurer and your SRA obligations.
Questions
Do law firms need Cyber Essentials?
It isn't mandatory for every firm, but insurers, lender panels and corporate clients increasingly ask for it, and it's required for some government work. It's also a practical checklist for the controls that stop most attacks.
What should a law firm do after email modification fraud?
Call your bank immediately to try to stop or recall the payment, report it to Report Fraud, notify your insurer, consider your ICO and SRA reporting obligations, and have the affected mailbox checked for compromise.