In this guide · 8 sections
- 01How payment-instruction fraud hits law firms
- 02A call-back protocol for changed bank details
- 03Make your firm's email harder to spoof
- 04Stop mailbox takeovers with MFA and access control
- 05Backups, devices and the rest of the Law Society guide
- 06Train staff on the scenarios they will actually see
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Never act on bank details received by email alone. Verify every new or changed payment instruction by phone, using a number from the file, not the email. Then make spoofing harder with DMARC on your domain, MFA on every mailbox, tight matter-file access and tested backups.
How payment-instruction fraud hits law firms
The SPF Mid-Year Scam and Cybercrime Brief 2026 reports that business email compromise cases rose 67.9% to 262 and losses rose 193.1% to S$57.3 million in the first half of 2026. Our summary of the 1H 2026 scam statistics puts that in context.
For a law practice, the fraud usually takes one of three forms:
- Spoofed firm email to a client: 'Please note our client account details have changed' sent to a buyer just before completion, from a lookalike or spoofed address.
- Spoofed client or counterparty email to the firm: a 'client' asks for sale proceeds or a settlement sum to go to a new account.
- Hijacked mailbox: an attacker who has phished a lawyer or secretary reads real threads, waits for a payment, then replies in the same thread with new bank details, often hiding replies with inbox rules.
A call-back protocol for changed bank details
The Law Society's Guide to Cybersecurity for Law Practices (March 2020) advises that if an email appears suspicious, the practice should verify the sender and the contents through an out-of-band method, such as a telephone call, and not rely on the displayed name. Turn that into a written rule for every matter that moves money.
Treat any new or changed bank details as unverified
This includes details in an email, a PDF letter or a WhatsApp message, even from a known contact.
Call back on a number already on the file
Use the number from the engagement letter or earlier correspondence, never one in the email that asked for the change.
Confirm account name, number and bank by voice
Read the details back and confirm the reason for the change. Note who you spoke to, when, and the number called.
Require a second person to approve
A partner or the accounts lead signs off on any payment to new details, separate from the person who handled the email.
Pause if anything feels rushed
Pressure to pay today, secrecy or 'the partner is in court' are classic signs. A short delay costs far less than a misdirected completion.
Put the mirror image in your engagement letter and email footer: 'We will never change our bank details by email. Call us on the number in this letter before transferring money.' That protects clients from spoofed emails in your name.
Make your firm's email harder to spoof
Three DNS records decide whether others can send mail that looks like it came from your exact domain: SPF, DKIM and DMARC. With DMARC at 'quarantine' or 'reject', receiving servers are far more likely to block a message that pretends to be from your domain. Our SPF, DKIM and DMARC guide walks through setting them up without breaking legitimate mail.
- Publish DMARC and move to quarantine or reject once reports show your real mail passes
- Turn on an external sender warning so staff see when a 'client' email comes from outside
- Enable impersonation protection for partners and the accounts team
- Watch for lookalike domains (an extra letter, -sg added, .com instead of .com.sg) and warn clients about them
DMARC does not stop lookalike domains or a genuinely hijacked mailbox, which is why the call-back rule comes first.
Stop mailbox takeovers with MFA and access control
Many payment frauds start with a phished password. The Law Society guide lists multi-factor authentication among the common access controls and asks practices to decide authentication methods based on the risk to individuals if data is breached. For a law firm handling client money, that means MFA on every mailbox and remote login.
| Control | What it stops | Where to set it |
|---|---|---|
| MFA on all email accounts | Logins with stolen passwords | Microsoft 365 or Google Workspace admin |
| Block legacy sign-in | Old protocols that bypass MFA | Email admin security settings |
| Alert on new inbox forwarding rules | Attackers hiding replies | Security alerts in your email admin |
| Matter files limited by team | One phished account exposing every client | SharePoint, Google Drive or your DMS |
| Leaver accounts closed on the last day | Former staff or their devices keeping access | Admin console and offboarding checklist |
Client confidentiality also matters here. The Law Society guide points out that firms hold client data and their own precedents, and that access should be limited to the relevant people.
Backups, devices and the rest of the Law Society guide
Payment fraud is the most expensive risk, but the Law Society guide also covers the basics that protect against ransomware and data loss. It splits measures into 'good practice' and 'enhanced practice', and its recommendations include:
Law practice cybersecurity basics
If you want an external benchmark, CSA's Cyber Essentials mark covers similar ground and is designed for smaller organisations.
Train staff on the scenarios they will actually see
Generic phishing training helps, but law firm staff need practice on the specific moments that cost money: the completion-day email with new details, the urgent request from a 'partner' travelling overseas, the invoice from a 'barrister' or valuer with a changed account. Run through your call-back rule with secretaries, conveyancing clerks and accounts staff, not just lawyers.
If you take online payments from clients, our guide to law firm online payments and the client account covers the Solicitors' Accounts Rules side. For what your website may say about the firm, see the law firm website publicity rules.
Do it yourself or get help?
The call-back rule and engagement-letter wording cost nothing and can start this week. The technical controls, DMARC, MFA, alerting and file permissions, are where a small practice benefits from a one-off setup. This guide is general information, not legal or regulatory advice.
Our Email Threat Protection (S$290) turns on impersonation protection, safe links, external sender banners and rules for payment-change scams. Microsoft 365 / Google Security Lockdown (S$590) enforces MFA, blocks legacy sign-in and sets sharing rules, and Security Awareness Training (S$390) gives staff short lessons on Singapore scams with completion tracking. If an incident has already happened, start with what to do when business email is hacked.
Frequently asked questions
A strict call-back rule. Treat every new or changed bank detail as unverified and confirm it by phone using a number already on file, not one in the email, with a second person approving the payment. The Law Society's cybersecurity guide recommends verifying suspicious emails through an out-of-band method such as a telephone call.
The Law Society describes its Guide to Cybersecurity for Law Practices, published in March 2020, as guidance, with good practice and enhanced practice measures. Firms remain subject to their confidentiality duties and the PDPA's protection obligation, so the guide is a practical benchmark for what reasonable security looks like for a law practice.
DMARC set to quarantine or reject stops scammers sending mail from your exact domain, because receiving servers can tell the message did not come from you. It does not stop lookalike domains or emails from a mailbox that has really been hacked, so combine it with MFA, staff training and a call-back rule.
State in the engagement letter and email footer that the firm will never change its bank details by email, and that clients should call the firm on a number from the letter before transferring money. Repeat it before completions or settlements. Clients who know the rule are much less likely to pay a fraudster.
Ask the client to contact their bank immediately to try to recall the payment, and both of you should make a police report. Then check whether your own mailbox was compromised: look for unknown sign-ins and forwarding rules, reset passwords and enforce MFA. Consider whether PDPA breach notification applies if client data was exposed.