A payment email can arrive in the right matter thread, use a familiar name and still contain false bank details. Before anyone transfers money, your firm needs a verification step that does not depend on that email being genuine.
The Australian Cyber Security Centre's business email compromise guidance explains how criminals use compromised accounts and lookalike addresses. It recommends a consistent process for checking payment requests and account changes. Email security helps protect the account; the firm's payment process decides whether the instruction is trusted.
Agree the callback rule before a payment is urgent
Make it clear who verifies an instruction, where they obtain the contact number and who can authorise the payment. A deadline should not turn an unverified change into an approved one.
The Law Society of NSW and Lawcover's client guidance recommends calling a known contact on a number already held. It warns against using the number in a suspicious email.
Give staff a practical sequence:
- Pause the changed instruction before releasing funds.
- Contact the intended recipient through a separately verified number.
- Confirm the payment details and record the check in the matter's approved records.
- Follow the firm's payment-authorisation process before proceeding.
Decide what happens when the usual person is absent or the recipient cannot be reached. Staff need a named person who can resolve the uncertainty without asking them to bypass the check.
Make the rule clear to clients
Explain how the firm normally provides payment instructions at the start of the matter. Tell clients how to check an unexpected request and where to find the firm's contact number independently.
Review the wording in your engagement and payment communications together. If one message asks for a callback but another treats an email reply as confirmation, the client has to choose which instruction to trust.
Know what to ask your IT provider
Ask who manages sign-in protection, checks suspicious forwarding rules and responds when a mailbox may have been accessed. Confirm how staff report the concern if email itself cannot be trusted.
The firm's payment approver still owns the decision to release funds. An IT provider can help investigate an account; that does not verify the beneficiary's bank details or approve a transaction.
If a payment or account may already be affected
Contact the bank promptly if money or bank details may be at risk, and involve the firm's responsible partner and IT contact. The ACSC's recovery guidance, reviewed in September 2026, covers account security, preserving a record of actions and notifying affected contacts. Use the firm's incident process to determine any further reporting or insurer steps.
For the wider service discussion, see managed IT for law firms. The law firm IT guide also covers access, backup and support responsibilities.