Most staff in a legal or conveyancing practice can describe a phishing email in general terms, yet far fewer can describe what one aimed at their own profession looks like on an ordinary working day. These emails rarely resemble the poorly written messages used in awareness training. They arrive in the middle of normal work, from a sender who seems plausible, and ask for something routine. As our earlier articles on property settlement scams and changed bank details explained, a compromised mailbox is often where payment redirection fraud begins, which makes the phishing email the first link in the chain.

What does a phishing email aimed at a legal practice look like?

A phishing email aimed at a legal practice usually looks like routine work rather than an obvious threat. It arrives from a plausible sender, makes a reasonable request such as opening a shared document or responding to a prospective client, and relies on the recipient entering their email credentials before pausing to question it. An alert from the Legal Practitioners’ Liability Committee (LPLC) show how this works in practice.
In October 2023, the LPLC warned that property and conveyancing practitioners in Victoria were receiving emails, including from aol and gmail addresses, written by criminals posing as prospective clients seeking help with a conveyancing transaction. Once the practice replied, a second email arrived with a link that supposedly gave access to the client’s documents. The link either contained malicious software or led to a fake site that asked for the recipient’s email address and password.

Which signs should staff look for?

The most useful habit is to focus on what the email asks the recipient to do, rather than on how polished it looks, because a message from a compromised legitimate account can appear entirely genuine. The following signs are worth pausing on.

A request to sign in to read something. A document or enquiry that requires an email address and password before it can be opened is a prompt to stop.
An unexpected message from a known sender. A familiar firm sending a file nobody requested warrants a telephone call, as its account may have been compromised.
A new contact who moves quickly to a link. A prospective client who offers documents only through a link, rather than describing the matter, fits the pattern in the LPLC alert.
Urgency or secrecy. Pressure to act quickly, or to avoid checking with colleagues, gives the recipient less time to think, which is the purpose of it.

What should staff do when a suspicious email arrives?

Staff should not click the link or open the attachment and should confirm the request with the sender by telephone using a number already held on file. Whether or not the sender confirms it, the email should be reported to the practice’s IT provider or security contact straight away, so that colleagues can be warned. The sequence is as follows.

Stop. Do not click, download or reply.
Verify. Call the apparent sender on a number from your own records, never one in the email.
Report. Tell your IT provider or security contact immediately, even if the email turns out to be genuine.
Warn. Let colleagues know what the email looked like, as the same message may have reached others.

If a link has already been clicked and credentials entered, the mailbox should be treated as compromised. The person should tell the IT provider at once, the password should be reset, and the mailbox rules and sign-in activity should be checked, because criminals with access can read correspondence for weeks before acting.

Why multi-factor authentication and no-blame reporting matter

Multi-factor authentication limits the damage when a password is stolen, because criminals who hold a username and password still cannot sign in from another device without the second factor. Equally important is a practice culture in which a person who has clicked can say so within minutes and without embarrassment, since the speed of reporting determines how much a criminal can do. This is the same lesson that separated recovered losses from permanent ones in our earlier articles.

Multi-factor authentication limits the damage when a password is stolen, because criminals who hold a username and password still face another barrier to accessing the account. Where possible, organisations should move towards phishing-resistant authentication methods such as passkeys or hardware security keys, rather than relying solely on SMS or push-based MFA.

However, technology is only part of the defence. Equally important is creating a culture in which someone who has clicked a suspicious link, entered credentials or approved an unexpected authentication request can report it within minutes and without embarrassment or fear of blame. The earlier security teams know, the faster they can revoke sessions, reset credentials, investigate activity and contain the threat.

This is the same lesson that separated recovered losses from permanent ones in our earlier articles: strong security controls matter, but rapid human response can be just as important.

In our latest webinar, The checklist trap: Why top firms build a security culture instead, cyber security leader Chirag Joshi explains why controls such as multi-factor authentication and a culture of prompt, no-blame reporting matter for practices of every size.

About Vishal Duggal

Vishal Duggal is a technology leader with 20+ years of experience, overseeing IT & Security operations across four geographies. He partners with leadership teams to turn technology strategy into outcomes, covering cloud, infrastructure, cybersecurity, and IT service management, while leading teams through change and maximising ROI.

{{ index + 1 }}
{{ track.track_title }} {{ track.track_artist }} {{ track.album_title }} {{ track.length }}

{{list.tracks[currentTrack].track_title}}{{list.tracks[currentTrack].track_artist && typeof sonaar_music.option.show_artist_name != 'undefined' ? ' ' + sonaar_music.option.artist_separator + ' ' + list.tracks[currentTrack].track_artist:''}}

{{classes.speedRate}}X