Every working day, lawyers and conveyancers log in to systems that hold identity documents, contracts of sale, trust account details and settlement instructions, and in many practices the only barrier between that information and an outsider is a password chosen months or years earlier. Multi-factor authentication for law firms is often described as an IT formality, a small inconvenience added to the start of the day, yet it addresses one of the most common ways professional practices are compromised, which is the covert use of a legitimate credential by someone who is not the legitimate user. Understanding what the control actually does, rather than simply that it is required, is what turns it from a compliance task into a genuine part of how a practice manages risk.

What does multi-factor authentication protect against?

Multi-factor authentication protects against the use of stolen or guessed passwords by requiring a second proof of identity, such as a code from an authenticator app or an approval on a registered device. Even when a password has been phished, reused or leaked, an attacker who lacks the second factor cannot complete the login.

In practice, this interrupts three common attack paths:

Phishing, where a convincing email or website captures a password that the user believes they are entering safely.
Credential reuse, where a password exposed in an unrelated breach is tried against professional systems, because many people use the same password across several accounts.
Automated password guessing, where software tests common passwords against thousands of accounts at once.

In each case the attacker holds something correct, a password, and still lacks the one thing that proves the person at the keyboard is the account holder. Microsoft has reported that multi-factor authentication can prevent more than 99 per cent of automated account compromise attempts, which is why it is widely regarded as the single most effective control available for the effort involved.

Why a login carries so much weight in legal and property work

A compromised login in a legal practice rarely stays confined to a single inbox. An attacker with access to a mailbox can observe a matter as it progresses, wait until payment instructions are exchanged, and then send altered bank details at precisely the right moment, a pattern known as business email compromise that the ACCC’s Scamwatch service has consistently identified as a significant source of losses for Australian businesses.

Practitioners also carry obligations that make access control a professional matter rather than a purely technical one. For solicitors, rule 9 of the Australian Solicitors’ Conduct Rules requires client information to be kept confidential, and Australian Privacy Principle 11 requires reasonable steps to protect personal information where the Privacy Act 1988 applies. The Office of the Australian Information Commissioner’s civil penalty proceedings against Medibank, arising from its 2022 data breach, allege that stolen credentials were used to gain access and that multi-factor authentication was not required on the relevant connection, which illustrates how the absence of a single control can become central to a regulator’s view of whether steps were reasonable.

What multi-factor authentication does not do

Multi-factor authentication reduces risk substantially, but it is not a guarantee, and the method a practice chooses matters. Codes sent by text message can be intercepted through SIM swapping, and push notifications can be approved by a fatigued user after repeated prompts, a tactic attackers use deliberately. Authenticator apps and hardware security keys offer stronger protection, and passkeys, which are designed to resist phishing, are increasingly available. The second factor is best treated as a control to be selected with care, not a box to be ticked.

Making it part of how the practice operates

The most practical starting point is email, since it is the most common route to payment fraud, followed by practice management, trust accounting and any platform used to lodge or settle transactions. Every user should be covered, including principals and administrative staff, because attackers look for the account with the least protection rather than the most valuable one. Staff should also be encouraged to report any unexpected authentication prompt immediately, as an unrequested prompt is often the first visible sign that a password has already been compromised.

Every login may seem like a routine part of the working day, but it represents a critical security checkpoint. For firms entrusted with sensitive client information, identities and financial transactions, relying on a password alone is no longer sufficient. Strengthening authentication is an essential step in protecting client trust, safeguarding sensitive information and reducing the risk of cyber threats.

About Vishal Duggal

Vishal Duggal is a technology leader with 20+ years of experience, overseeing IT & Security operations across four geographies. He partners with leadership teams to turn technology strategy into outcomes, covering cloud, infrastructure, cybersecurity, and IT service management, while leading teams through change and maximising ROI.

{{ index + 1 }}
{{ track.track_title }} {{ track.track_artist }} {{ track.album_title }} {{ track.length }}

{{list.tracks[currentTrack].track_title}}{{list.tracks[currentTrack].track_artist && typeof sonaar_music.option.show_artist_name != 'undefined' ? ' ' + sonaar_music.option.artist_separator + ' ' + list.tracks[currentTrack].track_artist:''}}

{{classes.speedRate}}X