Law firm wire fraud has always depended on persuading someone to move money based on instructions that look legitimate. What has changed is the persuasion. A phone call that sounds exactly like a known client, an opposing counsel, or a title agent used to be proof that the request was real. It is no longer proof of anything.
It is 3:40 on a Thursday afternoon, and the settlement has just cleared.
A paralegal at a personal injury firm is preparing the disbursement. The client, a man the firm has represented for eighteen months, has been waiting weeks for this money. The check is ready to be cut from the trust account and mailed.
Her phone rings. It is the client.
“Hey, it’s Roberto. Quick favor. I’m leaving the country tonight for a family emergency and I won’t be home to get a check. Can you wire my share instead? I’ll send the details by email in a couple of minutes. Please do it today if you can.”
It is his voice. The slightly formal English. The pause before he says her name. The same apologetic tone he used when he missed an appointment last spring.
She writes it down. The email arrives, with account details at a bank she has never heard of.
The managing partner is in court. The paralegal does not want to be the person who delayed a grieving man’s money. She prepares the wire.
Roberto, meanwhile, is at home, asleep in his own bed. He has never made that call.
This Is the Same Fraud, Turned Toward the Law
An earlier article in this series described how voice cloning fraud targets accounting firms. The mechanics are identical, and so is the defense. But law firms face a version of this threat that deserves its own treatment, for three reasons.
First, law firms hold other people’s money. Trust accounts, escrow funds, settlement proceeds, and closing funds all pass through a firm’s hands, and each is a target worth far more to a criminal than the firm’s own operating account.
Second, law firms are trusted names. A message that appears to come from an attorney carries weight with clients, banks, and title companies, which makes the firm’s identity valuable to impersonate.
Third, law firms operate on deadlines that discourage hesitation. A closing window, a court-ordered disbursement date, or a settlement clearing on a Thursday afternoon all create exactly the kind of time pressure fraudsters rely on.
The Voice Is Not the Only Thing Being Faked
Voice cloning is the newest tool, but the underlying schemes are older, and the voice simply makes them more convincing.
The closing day swap. In real estate transactions, an attacker who has compromised an email account somewhere in the chain watches the thread for days or weeks. Just before closing, substitute wire instructions arrive. If the buyer or a staff member calls to verify, a cloned voice can answer and confirm the change.
The fake client. A stranger contacts the firm, claiming to be owed money from a business dispute or a foreign transaction. The firm is asked to receive funds, hold them briefly, and forward them minus its fee. The original deposit later bounces or is reversed, and the money the firm sent out is real.
The impersonated attorney. Criminals build convincing replicas of real law firms, with copied letterhead, cloned websites, and borrowed attorney names, then use them to defraud third parties. The FBI has warned specifically about fictitious law firms that impersonate real attorneys to target people who have already been defrauded once. The real attorney may never know their name was used.
The fraudulent filing. Documented cases include a fake account registered on a state court e-filing portal under a real attorney’s name and bar number, used to obtain an order disbursing surplus funds from a court registry. The attorney never filed anything.
A cloned voice makes each of these easier. It can confirm a fake wire instruction, vouch for a fake client, or lend credibility to a call from a firm that does not exist.
What the FBI Is Telling People
Federal guidance on this threat is consistent and plain. The FBI has warned that a genuine call from someone you know and an AI-generated voice clone can sound nearly identical, and that people should not rely on the voice. Its advice is to independently find a phone number and call it yourself, rather than trusting the call you received.
The FBI’s Internet Crime Complaint Center has also long identified real estate wire fraud as one of the most costly categories of business email compromise, with reported losses in the billions across all categories and Florida consistently among the states with the highest incident counts and dollar losses.
Law firms are not bystanders in these statistics. They are frequently the party moving the money.
Why Your Client’s Compromised Email Is Your Problem Too
One reason these attacks succeed is that the compromise often happens somewhere the firm does not control.
A buyer’s personal email may have been hacked months ago. A title agent’s account may be monitored by an attacker. A client’s phone number may have been used to place the call. The firm’s own systems can be perfectly secure and the fraud can still land on the firm’s desk, because the instruction arrives through a trusted channel that was already compromised.
This is why technical controls alone cannot solve the problem. The firm’s protection has to live in how it handles requests to move money, regardless of where those requests appear to come from.
The Florida Bar Dimension
Florida Bar Rule 4-1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of or access to client information, a duty discussed throughout this series. Rules governing trust accounts impose separate, strict obligations on how client and third-party funds are held and disbursed.
A firm that loses client funds to a wire fraud faces more than a financial loss. It may face a malpractice claim, a Bar inquiry, and questions about whether it had reasonable procedures in place.
Practitioners who write about this issue make a consistent point. A documented wire verification protocol, communicated to the client in writing at the start of the engagement, followed in practice, and supported by sound technical controls, puts a firm in a far more defensible position than a firm that relied on instinct. Malpractice carriers are increasingly asking about these controls at renewal.
Documentation is not a formality here. It is the difference between “we took reasonable steps” and “we hoped it would be fine.”
A Wire Verification Protocol That Actually Works
A good protocol is short, written, and not optional. The following elements appear consistently in guidance from practitioners and law enforcement.
Tell the client at the start. At engagement, tell every client in writing how wire instructions will be communicated, who will send them, and that the firm will never change them by email or phone alone. Tell clients that if they ever receive different instructions, they should call the firm at a known number before acting.
One sender, one channel. Designate a specific person who sends wire instructions for a given matter, from the firm’s authenticated email, in a consistent format. A message from anyone else, or from a different address, is automatically suspect.
Callback to a number on file. Any instruction to send, change, or confirm a wire is verified by calling the recipient at a number already in the firm’s records, never one supplied in the message or during the call. A cloned voice can answer a call you place to a number the attacker provided. It cannot answer a number the attacker never saw.
A verification phrase for high-value matters. For significant transactions, agree on a word or question in advance that only the real parties would know.
Dual authorization for disbursements. No one person should be able to request, approve, and release funds alone. A second person reviews the verification record before the wire goes out.
A pause for any change. Changes to wire instructions, payees, or account details receive an automatic hold, even if the request claims urgency. Urgency is a symptom of the fraud, not a reason to bypass the check.
Applied to the scenario at the start, any one of these would have stopped the wire. The paralegal needed only one permission: the firm’s written authority to say “I will call you back at the number we have on file.”
Make It Easy for Staff to Say No
In many firms, the person who receives the call is the most junior person in the chain, and the person making the request sounds like a client, a partner, or a respected colleague. The pressure to comply is enormous.
A written policy changes that dynamic. When the firm’s rule is “we verify every wire change by callback, no exceptions,” the paralegal is not doubting Roberto. She is following firm procedure, one that exists to protect Roberto.
Leadership should say this out loud. Staff who pause a payment to verify it should be thanked, even if the request turns out to be genuine. A firm that punishes caution will eventually get exactly the behavior it rewarded.
Technical Controls Still Matter
Process is the primary defense against voice-based fraud, but technology supports it.
Phishing-resistant multifactor authentication, discussed earlier in this series, reduces the chance that an attacker compromises the firm’s own email and watches the matter unfold. Email security tools that flag lookalike domains and external messages impersonating internal staff catch many of the fraudulent instructions that precede or follow a call.
Logging and monitoring help the firm notice unusual activity, such as a login from an unexpected location or a new forwarding rule on a mailbox. And a tested incident response plan, including a ready contact at the firm’s bank, shortens the critical first hour after a suspected fraud.
Watch for Your Own Firm Being Impersonated
Because a law firm’s name carries trust, firms should assume someone may eventually try to borrow it.
Register obvious variations of the firm’s domain name, and monitor for newly registered lookalike domains and cloned websites. Check periodically whether the firm’s name, attorney names, or bar numbers appear on sites or filings you did not create. Tell clients plainly, in writing, which email domain and phone numbers the firm actually uses, so they have something to compare against.
If impersonation is discovered, report it to the FBI’s Internet Crime Complaint Center and your state bar, notify affected clients, and request takedown of fraudulent sites through the hosting provider and domain registrar. Our cybersecurity services include brand and domain monitoring so lookalikes surface quickly.
This kind of monitoring is a natural extension of the work your managed IT services provider already does on your email and web presence. It costs little, and it can catch a fraud aimed at your clients before one of them calls to ask why the “firm” sent a strange email.
If Funds Have Already Gone Out
Speed matters more than anything else once a fraudulent wire is suspected.
Contact the sending bank immediately and ask for an urgent recall, describing it as fraud. Ask the bank to initiate the process that law enforcement uses to freeze funds across institutions. Notify the receiving bank as well.
File a complaint with the FBI’s Internet Crime Complaint Center right away with full transaction details. Preserve the voicemail, call records, and emails.
Notify the client promptly and honestly, consult your malpractice carrier about notice requirements, and consider the firm’s obligations under the Bar rules. Early, candid communication preserves trust far better than delay.
What This Means for Miami and South Florida Firms
South Florida is a high-risk environment for exactly this fraud, and several local conditions explain why.
Real estate drives much of the region’s legal work, and closings here often involve large sums, out-of-state or foreign buyers, and parties who communicate largely by phone and email. The volume of transactions makes any single unusual request easier to hide among normal ones.
Bilingual practice is common. A cloned voice can be generated in more than one language, and the code-switching that might once have signaled something odd can now sound natural.
Many clients have international ties, and last-minute requests to send funds to unfamiliar foreign accounts can sound plausible for exactly that reason.
And South Florida’s visibility, its attorneys appearing in local media, bar events, podcasts, and social video, supplies the audio an attacker needs to clone a voice.
None of this means local firms should treat every call as an attack. It means verification should be a routine, standard step, applied the same way every time, precisely because so many legitimate requests resemble fraudulent ones.
Ask Your IT Provider These Questions
Do we have a written wire verification protocol, and is it given to clients in writing at engagement?
Does every wire instruction change require a callback to a number already on file?
Is dual authorization required for trust account disbursements, so no single employee can release funds alone?
Have all staff, including paralegals and receptionists, been trained on voice cloning and impersonation fraud?
Do we have phishing-resistant authentication, lookalike domain detection, and mailbox monitoring in place?
If we suspected a fraudulent wire this afternoon, does everyone know who to call at the bank in the first hour?
If your IT provider cannot answer these clearly, your firm may be relying on instinct to catch something designed to defeat it.
The Voice Was Never the Security Control
For as long as attorneys have taken calls from clients, a recognizable voice has served as informal proof of identity. It was never meant to carry that weight, and it cannot carry it now.
The firms that stay ahead will not be the ones with the best ear. They will be the ones that decided, in advance and in writing, that no wire moves on the strength of a call alone.
ITva Technologies provides managed IT and cybersecurity services for law firms across Miami-Dade and Broward, with specific experience helping firms build and document the controls that protect client funds and satisfy the reasonable-efforts standard.
Our managed IT services include email security configuration, lookalike domain protection, and documented disbursement workflows that make verification the default.
Our cybersecurity services include phishing-resistant multifactor authentication, mailbox monitoring, staff training on impersonation fraud, and incident response planning for the first hour after a suspected wire fraud.
If your firm has never written down how it verifies a wire request, that is worth doing before the next call arrives.
Schedule a free wire fraud readiness assessment with ITva.
We will review your disbursement process, your email and authentication controls, and your staff’s readiness, and show you where a convincing call could slip through.
Because the voice on the phone will sound right.
Your firm’s process is the part that cannot be faked.
Frequently Asked Questions
Can a cloned voice really fool someone who knows the person well?
Yes. Current voice cloning tools can reproduce a person’s tone, rhythm, and speech habits from a short sample, and the FBI has warned that a real call and an AI clone can sound nearly identical. A familiar voice should be treated as a reason to verify, not a reason to skip verification.
What is the most effective defense against law firm wire fraud?
Callback verification to a phone number already in the firm’s records, combined with dual authorization for disbursements and a written protocol shared with clients at the start of the engagement. These controls do not depend on detecting a fake voice.
Why does real estate closing fraud matter so much for Florida firms?
Real estate closings involve large sums, tight deadlines, and many parties communicating by email and phone, and Florida consistently ranks among the states with the highest incident counts and dollar losses for business email compromise.
Does this affect our duties under the Florida Bar rules?
Rule 4-1.6 requires reasonable efforts to prevent unauthorized disclosure of or access to client information, and separate trust account rules govern how funds are held and disbursed. A firm that loses funds to fraud may face questions about whether it had reasonable procedures, which is why documentation of verification protocols matters.
What should we do if we send money to a fraudulent account?
Contact the sending bank immediately and request an urgent recall, notify the receiving bank, and file a complaint with the FBI’s Internet Crime Complaint Center. Preserve all voicemails, call records, and emails, and notify the client and your malpractice carrier promptly.
Can criminals impersonate our firm to defraud other people?
Yes. The FBI has warned about fictitious law firms that copy real attorneys’ names, letterhead, and websites to defraud victims. Firms should monitor for lookalike domains and report impersonation to the FBI and the state bar.