Stopping Wire Fraud: Email Security for Law Firms and Title Companies
It usually starts with an email that looks completely normal. The sender name is right, the signature block is right, the file number is right. It says the wiring instructions for Friday's closing have changed, or that a settlement disbursement should go to a new account. The only thing wrong is the bank account number.
That's business email compromise (BEC), and law firms and title companies are some of its favorite targets. They move large sums by wire, on deadlines, for clients who trust what arrives in their inbox. This post explains how these scams work and the email security and wire procedures that stop most of them, written for small and mid-size firms in Lubbock and across West Texas.
How big the problem is
The FBI's Internet Crime Complaint Center (IC3) received 24,768 business email compromise complaints in 2025, according to its 2025 Internet Crime Report. BEC ranked second among all crime types by reported losses, behind only investment fraud. The same report logged 12,368 real estate fraud complaints, up from 9,359 the year before.
How the scam actually works
BEC isn't one trick. It's usually one of three:
A spoofed or lookalike address. The email comes from something like a domain with one letter changed, or uses your firm's display name with an outside address behind it. On a phone, where only the name shows, it's easy to miss.
A hijacked real mailbox. An attorney, paralegal, closer, real estate agent or lender falls for a fake Microsoft 365 login page. The attacker signs in, reads the mailbox quietly for days or weeks, learns which deals are closing, and then sends the fake instructions from the real account.
Hidden mailbox rules. Once inside, attackers often create rules that forward messages to an outside address or move replies out of the inbox, so the real owner never sees the client asking, "Is this new account correct?"
The attacker doesn't have to break into your firm at all. If the buyer's agent, the lender or the client gets compromised, the fake instructions can still carry your firm's name.
The procedure that stops most wire fraud
Technology helps, but the single most effective control is a phone call. The Texas Land Title Association's wire fraud guidance for title companies lays out practices that work just as well for law firms handling settlements, trust account transfers and real estate closings:
Set the contact list at the start. Record every party's verified phone numbers and email addresses when the file opens. Don't use a phone number that shows up later in a new email signature until it's been checked against the original.
Tell clients up front. Explain early, by phone or in person, that your wire instructions will not change by email, and that they should call a number they already have before sending money.
Verify every wire by phone. Confirm wiring instructions with a call to the number on file, never the number in the email that delivered the instructions.
Treat last-minute changes as fraud until proven otherwise. Changes right before closing are a classic warning sign. Some firms accept changes to disbursement instructions only in person.
Use a second approver. Have someone other than the person who received the instructions confirm the verification was done and documented before the wire is released.
Confirm receipt. After funds go out, call the recipient on the verified number to confirm they arrived.
The FBI's BEC guidance says the same thing in short form: use a secondary channel to verify any request to change account information.
The email security that backs it up
A written procedure catches the fraud that reaches the inbox. Good email security keeps more of it from getting there, and makes it harder for anyone to hijack your accounts or impersonate your domain.
Multifactor authentication on every mailbox. A stolen password alone shouldn't be enough to sign in. Block older sign-in methods that skip MFA, and give admin accounts the strongest protection.
Risky sign-in alerts and mailbox rule checks. Alerts on sign-ins from unusual places, plus regular checks for forwarding rules to outside addresses, catch takeovers that would otherwise go unnoticed.
SPF, DKIM and DMARC. These DNS records tell other mail servers which systems are allowed to send email for your domain. With DMARC moved toward enforcement, spoofed email claiming to be from your firm is far more likely to be rejected.
Advanced filtering and impersonation warnings. Filters that catch phishing links and malicious attachments, and banners that flag outside senders and lookalike domains, give staff a second look before they act.
Encrypted email for sensitive documents. Settlement statements, account numbers and client records shouldn't travel as ordinary attachments.
Our business email security services cover each of these, and most of the account protections live in your Microsoft 365 setup, so it's worth checking which ones are actually turned on.
The ethics side for Texas attorneys
For lawyers, this is more than an IT question. Since February 2019, Comment 8 to Rule 1.01 of the Texas Disciplinary Rules of Professional Conduct has said competence includes keeping up with "the benefits and risks associated with relevant technology," per the Supreme Court of Texas order. ABA Formal Opinion 477R adds that lawyers should make reasonable efforts to secure client communications, with stronger measures like encryption when the information is more sensitive. And ABA Formal Opinion 483 says that when a breach involves material client information, lawyers have a duty to notify affected clients.
None of that requires an attorney to become a security expert, but it does mean asking the right questions and having someone qualified handle the technical side.
If a wire has already gone out
Speed matters more than anything else. The FBI's guidance is to:
Call your bank immediately. Ask the originating bank to recall or reverse the wire and contact the receiving bank.
File a complaint at ic3.gov. Include the full banking details for both sides of the transfer. FinCEN notes it has had greater success recovering funds when the fraud is reported to law enforcement within 24 hours.
Preserve the evidence. Don't delete the fraudulent emails. Keep the messages, headers, invoices and transaction records.
Secure the mailbox. Reset passwords, turn on MFA, remove any suspicious forwarding rules and review recent sign-ins. Then figure out whose account was actually compromised.
Call your insurer. Many cyber policies have notice requirements and specific steps to follow. Our cyber insurance and compliance help can help you understand the email and MFA questions carriers ask before and after a claim.
A quick checklist for West Texas firms
Whether you're a two-attorney office in Levelland, a title company in Amarillo, or a firm handling oil and gas closings in Midland-Odessa, run through these questions:
Does every mailbox, including partners and part-time staff, have MFA turned on?
Do you have a written rule that wire instructions are verified by phone using a number on file?
Does a second person sign off before a wire is released?
Are SPF, DKIM and DMARC set up for your domain, and is DMARC moving toward enforcement?
Does anyone check for outside forwarding rules and risky sign-ins?
Do your clients hear, at the start of every matter, that your wire instructions will never change by email?
If any answer is "I'm not sure," that's the place to start.
Help for Lubbock and West Texas law firms and title companies
Double Technologies provides law firm IT support and cybersecurity for attorneys, title companies and their staff in Lubbock and across West Texas, with 30 years of combined experience. We set up and manage email security, MFA and Microsoft 365, help you put a simple wire verification procedure in writing, and monitor for suspicious activity with SIEM and IDS/IPS.
Want a second set of eyes on your email and wire procedures? Call us at (806) 319-8521. We can come to you in Lubbock, Amarillo, Abilene, Midland-Odessa and the South Plains towns in between. We're available Monday through Friday from 8 AM to 7 PM and Saturday from 9 AM to 5 PM Central.
This article is general information and isn't legal advice. Talk with your attorney or ethics counsel about how professional conduct rules apply to your firm.
Comments