AegisAI Perspectives · 113
A fake wire instruction email at a law firm asks for a last-minute switch to a new account, from an address one letter off, with a new number to call.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
The warning signs of a fake wire instruction email at a law firm are a last-minute switch to a new account or payment method11, and a sender address one letter off the real one9. Business email compromise losses reported to the FBI reached $3,046,598,558 in 20251. AegisAI agents check every payment request against the sender's history17. Check each sign below, then verify by phone.
Print these six checks and put them next to every person who releases client funds.
Short on time? Watch the explainer, or book a demo.
A call proves nothing when the attacker supplies the number. The North Carolina State Bar reports a firm with two-level authentication that was still defrauded, because the attackers emailed and called to confirm the instructions themselves8. The fix is that the lawyer starts the call, to the number in the client file.
The State Bar of California advises verifying new wiring instructions through an existing client contact, ideally in person or by video conference14. The FBI suggests secondary channels or two-factor authentication to verify account changes6. Write into the firm's policy who places the call and which number they use.
Any matter where the firm sends or receives money by email instruction carries it. The State Bar of California says scammers who reach emailed wiring instructions replace them, and banks often deny liability, which places the burden on attorneys13. That covers settlement payouts and client refunds, plus trust account disbursements and closings.
In one 2025 case, home buyers received an email impersonating their attorneys and wired over $449,0004. The guide to real estate wire fraud emails at law firms covers that case in depth. List every matter type at your firm that pays out by wire, and apply the same check to each one.
Run these steps on every instruction in order. Stop at the first one that fails.
Name the firm's bank and the last digits of its account in the engagement letter, and have parties agree in writing to call before wiring anywhere else12.
Treat a new account or payment method as a red flag.
Compare the address with the client file, character by character, and note a first contact tip.
The lawyer starts the call, to the number in the client file only.
Use an existing client contact, in person or by video.
Note who called, which number they used and when, on the matter file.
Call the bank at once and request a recall3. The IC3 Recovery Asset Team froze $679,013,183 in 2025, a 58% success rate2.
The email security overview for law firms places these steps among the firm's wider controls. Add the seven steps to the trust accounting procedure this month.
Each row is a warning sign, the check a person runs and where an email layer helps.
| Warning sign | Check a person runs | Built-in Microsoft 365 | AegisAI |
|---|---|---|---|
| Changed bank details | Confirm on verified contact details | Not covered in the Microsoft pages used here | Flags a request to change bank details21 |
| First-time sender | Treat as a stop on payment emails | First contact safety tip | Flags a first email from this sender |
| Lookalike domain | Compare with the client file | Domain can still pass authentication | Checks the request against the sender's history |
| Reply path | Reply only to the address on file | Not covered in the Microsoft pages used here | Flags a reply-to that differs from the sender |
| Confirming call | Lawyer calls the file number | Not an email control | No edge. The call stays with your lawyer |
The last row gives an email tool no edge, because the call happens outside email. Score your firm on every row, then use the demo request page to test rows 1 to 4 on your own mail.
AegisAI agents check every payment request against the sender's history. They read the thread the way an analyst would: the sender's history, the change being asked for, and where the reply goes18. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it19. A firm can run it in monitoring mode on live mail with no MX change, then turn on removal20.
Illustrative example, figures are fictional. Carver and Wells LLP (fictional) is about to pay a $310,000 personal injury settlement from its trust account. At 16:05 on a Thursday the paralegal gets an email that looks like it comes from the client, asking for the funds to go to a new account. The address swaps one letter of the client's domain, and the email gives a new phone number. Step 4 sends the lawyer to the number in the client file. The client never sent the email, and the funds stay in trust.
Run this scenario with every person who releases client funds, and time how long each step takes.
Track three numbers from the first day.
Review all three on day 30, and find out why for any changed instruction without a callback.
A last-minute change of account or payment method, a sender address one character off, a first-time sender, a new phone number in the email, and a request timed just before funding.
No. An impersonated domain can be registered with its own authentication records, so it passes its own checks. Compare the address with the client file.
Only when the lawyer starts the call, to the number in the client file. Attackers have emailed and called to confirm their own instructions.
The State Bar of California says banks often deny liability, which places the burden on attorneys. Put the bank details in the engagement letter to prevent the change.
Call the bank at once and request a recall. The FBI's IC3 recorded $3,046,598,558 in business email compromise losses in 2025, and its Recovery Asset Team froze $679,013,183 that year.
