Wire Fraud Prevention Checklist for BC Law Firms
For a BC law firm, one fraudulent wire transfer can mean a trust shortfall, an insurance claim, a Law Society report and a damaged client relationship, all in the same week. The frustrating part is that most of these losses are preventable with a short checklist that everyone in the firm actually follows. This guide gives you that checklist, split into people, process and technology.
Why this matters now
- In August 2025, the Law Society of BC’s Lawyers Indemnity Fund warned about fraudsters breaking into firm systems, watching email conversations and sending convincing payment instructions, often from the client’s real email address.
- Canadians reported $67.9 million in losses to targeted spear-phishing scams in 2025 (Canadian Anti-Fraud Centre).
- If a breach exposes client records, Law Society Rule 10-4 requires lawyers to immediately notify the Law Society in writing (Law Society of BC).
How wire fraud against law firms actually works
- Access: a criminal steals a password from someone in the deal: your firm, the client, the other side or a lender.
- Watching: they read emails quietly for days or weeks, learning names, amounts and closing dates.
- Timing: just before funds move, they send “updated” payment instructions, often replying inside a real email thread.
- Hiding: they create mailbox rules that hide replies, so nobody notices until the money is gone.
There is often no virus and no spelling mistake. That is why antivirus alone does not stop it, and why process matters as much as technology.
The checklist: people
- ☐ Every lawyer, assistant and bookkeeper knows the firm’s verification rule (below) and that they will never be blamed for slowing a payment down to check it.
- ☐ Staff can recognize red flags: changed banking details, urgency, secrecy, a new bank or country, and requests that arrive close to a deadline.
- ☐ Short phishing refreshers happen at least quarterly, not once a year.
- ☐ Clients are told in your engagement letter that your trust account details will not change by email.
The checklist: process
- ☐ Call-back rule: any new or changed payment instructions are confirmed by phone using a number already on file, never one from the email.
- ☐ Two-person approval for outgoing trust payments above a set amount.
- ☐ A record of who verified each instruction, when and how.
- ☐ A written incident plan: who calls the bank, who calls IT, who contacts the insurer and who handles the Rule 10-4 report.
The checklist: technology
| Control | Why it matters |
|---|---|
| ☐ MFA on every mailbox | Stops most account takeovers that start the fraud |
| ☐ “External” tags on outside email | Makes fake partner or client emails stand out |
| ☐ Impersonation protection | Flags look-alike domains and display-name spoofing |
| ☐ Alerts for new forwarding and inbox rules | Catches attackers hiding their tracks |
| ☐ SPF, DKIM and DMARC on your domain | Makes it much harder to spoof your firm’s email |
| ☐ Encrypted, managed laptops and phones | A lost device does not become a records breach |
Our guide to Microsoft 365 security settings shows how to switch most of these on, and our email security service manages them for you.
If money has already been sent
- Call your bank immediately and request a recall. Minutes matter.
- Do not delete anything; preserve the emails.
- Reset the affected passwords and sign out of all sessions.
- Call your IT provider to check for hidden mailbox rules and other compromised accounts.
- Notify your insurer, report to the Canadian Anti-Fraud Centre and police, and assess your Rule 10-4 reporting obligation.
Frequently asked questions
Is wire fraud mainly a real estate problem?
Real estate closings are a common target, but any matter with a settlement, retainer refund or estate distribution can be targeted.
Does MFA alone stop wire fraud?
It stops most account takeovers, but the fraudster may be inside the client’s or another party’s mailbox. That is why the phone call-back rule is essential.
How long does it take to put these controls in place?
Most firms can implement the technology controls within a few weeks and adopt the process rules immediately.
Is your firm protected against wire fraud?
Book a free IT assessment. We will review your email security, mailbox rules and payment processes and show you exactly where the gaps are.
See how we support legal practices on our IT services for law firms page, and learn more about our cybersecurity services and managed IT across the Lower Mainland.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
