A law firm's wire instructions, and the email that nearly changed them
A client's hijacked mailbox asked a paralegal to update the bank details for a settlement. She phoned to check. The firm then asked us what happens the day nobody phones.
This shows the kind of work we do. It is not a client engagement, and the business in it is invented.
- 1person caught by the third phishing round, down from four in the first
- 6 wksto reach a DMARC reject policy without bouncing real mail
- 1 ruleon the closing checklist: wire changes are confirmed by phone, to a number on file
Where it started
The problem
The request came from the client's real address. Their mailbox had been taken over a week earlier, and the message read like every other one they'd sent.
The paralegal called the client anyway, because something in the phrasing bothered her. That was luck, and the partners knew it.
What changed
What we did
The domain had SPF and nothing else. We added DKIM and DMARC and moved to a reject policy over six weeks, reading the reports as we went so no legitimate mail got caught.
DMARC wouldn't have stopped this one, though, because the message came from a genuine account. So filtering now banners in red any outside email that mentions changing bank details.
The bigger change was a rule, not a tool. Wire changes are confirmed by phone, to a number already on file and never one taken from the email. It's on the closing checklist, and every member of staff sat a short session on it.
Quarterly phishing simulations followed, built around fake court notices and document-share links, because that's what actually lands in a law firm's inbox. The first round caught four people. The third caught one.
Built with
- Microsoft 365
- Defender for Office 365
- DMARC
- KnowBe4
Services in this job
Email Security & Phishing Defense
Bad attachments, spam and fake logins, blocked
Security Awareness Training
Simulated phishing, short lessons
Got a job like this one?
Tell us what's slow, fragile or stuck.
We'll tell you whether it's work we should be doing and what it would involve. Every quote is written for the job in front of us.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you