Business email compromise hits Dallas law firms where the money moves, on settlement disbursements, trust deposits, retainers, and closing payoffs. A good IT provider blocks fake login pages, stolen sessions, lookalike senders, and hidden forwarding rules. The costliest message often comes from a real, hijacked mailbox that passes every filter, though, and only a written callback rule and bank controls close that gap. Our page on IT services for law firms in Dallas covers the full support model.
Business email compromise at a Dallas law firm is wire fraud that runs through email, where an attacker hijacks or imitates a mailbox around the trust account and changes where settlement, retainer, or closing money gets sent. Filters catch part of it. Procedure catches the rest.
Here’s my nightmare version. A bookkeeper gets an email from a client’s controller the afternoon before a settlement disbursement goes out. New bank, new account number, apologies for the late change. The thread is real. So is the signature block. Even the address is real, because the attacker is writing from inside the controller’s actual mailbox, and every check your email system runs comes back clean.
I run operations at Uprite, so the procedures our engineers follow when a firm calls about a strange wire are mine to write and mine to fix. My view is blunt. Filters are half the answer. The other half sits in your accounting procedures, your bank portal, and one phone call nobody at the firm is allowed to skip.
Texas sees plenty of it. The FBI’s Internet Crime Complaint Center counted 2,253 business email compromise victims in Texas in 2025, with $304,318,015 in reported losses. That’s about $135,072 per victim, above the national figure of roughly $123,006 per complaint in the IC3 2025 annual report. Not small money.
Dallas has its own file. FBI Dallas ran a victim notice for one BEC scheme that lists the moves in plain words, unauthorized forwarding rules, display names that mimic real senders, and altered wiring instructions. The man behind it, Kolade Akinwale Ojelade, was sentenced to more than 26 years for conning prospective homeowners out of down payments.
What is business email compromise at a law firm?
Business email compromise is a payment fraud in which an attacker uses a hijacked or imitated email account to persuade someone to send money to an account the attacker controls. At a law firm, the targets are payments that move through the trust and operating accounts, and the emails that tell people where to send them. You’ll also hear it called trust account fraud, attorney email spoofing, or plain law firm phishing, and it’s the same scheme aimed at the same money.
Regulators saw it early. FinCEN’s 2016 advisory on business email compromise already included a legal services scenario built around wires out of attorney trust and escrow accounts. Little has changed since. The targets got better researched.
What firms underestimate is direction. The fraud doesn’t only pull money out of your trust account. It also redirects money headed into it, and money moving between other people in your matter, where your filters never see a single message.
| Payment | Who the attacker pretends to be | Who sends the money | Where it usually breaks |
|---|---|---|---|
| Settlement disbursement out of trust | The client, or the client’s controller | Your firm | A bookkeeper or paralegal acting on an emailed change |
| Settlement funding into trust | Your firm, writing to the defendant or the carrier | Opposing counsel or the insurer | Their payment team trusting a lookalike of your address |
| Retainer or flat fee from a new client | Your firm, writing to the client | The client | A client who never received your wire details on paper |
| Real estate closing or loan payoff | The title company, the lender, or the attorney | The buyer, the seller, or your firm | Payoff figures and instructions sent as attachments |
| Expert, court reporter, or vendor invoice | A real vendor | Your firm, from the operating account | Accounts payable updating bank details by email |
| Payroll direct deposit | An attorney or a staff member | Your firm, through payroll | Deposit details changed on an email request |
Row 2 is the one people forget. The State Bar of Texas described a case where a significant settlement almost turned into $10 million stolen. Opposing counsel got an email from an address very similar to the attorney’s own, asking for the rest of a confidential eight-figure settlement to be wired. Firm filters never saw it. It went to the other side.
IC3 logged the mirror image. In August 2025, home buyers received an email impersonating their own attorneys and wired more than $449,000 on it. That one ended well, because the IC3 Recovery Asset Team froze the full amount. Plenty don’t.
How does a BEC attack get past a Dallas firm’s email?
Quietly. The common pattern doesn’t need malware, a virus alert, or anything your antivirus would flag. It needs one stolen sign-in.
- A user signs in on a fake Microsoft 365 page that relays everything to the real one, password and multifactor prompt included, and the attacker keeps the session cookie that comes back.
- That session opens the mailbox. MFA already said yes, so nothing asks again.
- An inbox rule goes in. Messages mentioning wire, payoff, settlement, or the client’s name get moved to an obscure folder or forwarded out.
- Then the attacker reads for days or weeks, learning the parties, the amounts, the dates, and the exact signature blocks.
- The changed instructions arrive on the day money moves, sent from the hijacked mailbox or from a lookalike domain one letter off.
- A phone number comes with them, for verification. It’s the attacker’s.
Step 1 isn’t hypothetical. Microsoft documented an adversary-in-the-middle phishing campaign that targeted more than 10,000 organizations, and in some cases the payment fraud started within minutes of the session being stolen. Step 3 is so routine that Microsoft’s own playbook for suspicious inbox rules opens by saying malicious rules are common during business email compromise.
Step 6 hurts most. In the State Bar case, the attorney called a 713 number that had been supplied as the bank’s phone number. The scammers answered, then called back later from overseas. A callback rule that uses the number in the email isn’t a callback rule. It’s a second channel the attacker already owns.
Why doesn’t DMARC stop the most expensive version?
DMARC proves that a message claiming to come from your domain really did. That’s valuable, and every firm domain should have it set to reject, which is exactly what CISA’s joint phishing guidance tells organizations to do. It just answers a narrower question than most partners think it does.
2 gaps remain.
Lookalike domains are the first. A domain with one letter swapped is a different domain, with its own perfectly valid authentication records, and Microsoft’s anti-phishing documentation says plainly that lookalike domains can pass SPF, DKIM, and DMARC. In Benchellal v. Okonite, a buyer wired about $250,000 after a reply from okonte.com, a spoof of the seller’s real domain, and the Southern District of Texas left the loss with the buyer.
The second gap is worse. When the attacker is writing from the real, hijacked mailbox of your client, the title company, or opposing counsel, every authentication check passes, because the message genuinely came from that account. No filter on earth flags a message for being authentic.
So, my honest take. Email authentication protects other people from forgeries of your firm. Impersonation protection protects your staff from lookalikes. Neither protects anyone from a real account in the wrong hands, and that’s the case where the procedure has to carry the whole load.
Who absorbs the loss when trust money goes to a fraudster?
You know this area better than I do, so treat what follows as the operations view of a legal question. The short version is that the bank usually walks away whole and the firm usually doesn’t.
Wire transfers in Texas run under Chapter 4A of the Business and Commerce Code. Section 4A.202(a) treats a payment order as the authorized order of the sender if that person authorized it. When your bookkeeper logs in and sends the wire, even on fake instructions, the order is authorized, and the refund rules written for unauthorized orders generally don’t reach it. Section 4A.207 adds that the receiving bank may rely on the account number even when the name on the instructions doesn’t match.
The few decisions on point lean the same way. Writing about Benchellal, Vinson and Elkins noted there’s no clear consensus on these issues under Texas law, which cuts both ways. Outside Texas, the Fourth Circuit’s 2025 Studco decision left a hacked company with its loss and held that the receiving bank was liable only if it had actual knowledge of the mismatch.
Then there’s the trust account. Texas Disciplinary Rule 1.15, renumbered from 1.14 in October 2024, requires a lawyer to hold client and third-party funds separate from the firm’s own, in a trust or escrow account, with complete records kept for 5 years. If client money leaves that account on a forged instruction, the account is short and the client is still owed. Statutes don’t change that.
And a hijacked mailbox is often a data breach too. A firm inbox holds medical records, Social Security numbers, and financial statements, and the attacker had time to read them. ABA Formal Opinion 483 expects lawyers to act reasonably and promptly to stop a breach, figure out what happened, and tell current clients when their information was involved. Texas then adds its own clocks under Business and Commerce Code Section 521.053, 60 days to notify affected people and 30 days to notify the Attorney General once 250 or more Texans are involved.
Insurance is the last question, and it’s worth asking before you need it. The ABA’s 2023 Cybersecurity TechReport found only 40% of responding firms carried cyber insurance, and 29% reported a security breach at some point. Ask your carrier in writing whether a wire your own staff sent on fake instructions is covered, under which section, and with what sublimit.
What should your IT provider block, and what can only your procedure stop?
This is the table I’d want every managing partner to read before signing with anybody, us included. It splits the work 3 ways, because a provider that claims it can stop all of this with software is selling you something.
| Control | What it stops | What it misses | Who owns it |
|---|---|---|---|
| Phishing-resistant sign-in with FIDO2 keys, passkeys, or Windows Hello, required by Conditional Access | Passwords and sessions stolen through fake login pages | An attacker already inside a counterparty’s mailbox | IT provider |
| Token protection in Conditional Access | Replay of a stolen session in the Windows, macOS, and iOS desktop apps | Outlook in a web browser, which it doesn’t cover yet | IT provider |
| Impersonation protection in Defender for Office 365 | Lookalike names and domains of partners and key clients | A real counterparty mailbox in the wrong hands | IT provider |
| DMARC at reject on every firm domain, parked ones included | Exact forgeries of your domain sent to clients and opposing counsel | Lookalike domains | IT provider |
| External forwarding off, plus alerts on new inbox rules | Copies of your mail quietly leaving the tenant | Rules that only hide mail inside the mailbox, if nobody reads the alerts | IT provider |
| Audit logs exported past 180 days | Losing the evidence when a fraud surfaces late | Prevention, since this is evidence only | IT provider and firm |
| Callback on a number already on file, never one from the email | Hijacked real mailboxes and lookalikes alike | A callback to a number the attacker supplied | Firm |
| Dual approval and a hold period in the bank portal for new payees | One rushed person sending a large wire alone | A changed instruction that both approvers accept | Firm and bank |
| A line in engagement letters saying your wire details never change by email | Clients and opposing counsel trusting a mid-matter change | People who never read it | Firm |
A few things about the Microsoft side catch firms out. Business Premium includes Defender for Office 365 Plan 1, and Microsoft’s service description confirms user and domain impersonation protection comes with Plan 1. But the default anti-phishing policy doesn’t configure impersonation protection at all. Somebody has to turn it on and name the people worth protecting, which at a law firm means every partner, the controller, and the bookkeeper.
Sign-in is the bigger lever. CISA calls phishing-resistant MFA the gold standard, and Business Premium already includes the Conditional Access needed to require it. Risk-based sign-in policies are different. They need Entra ID P2, which Business Premium doesn’t include, so ask any provider who promises them which license they’re quoting. If your firm is moving its files off an office server at the same time, our guide to law firm cloud migration in Dallas covers that project. We walk through the tenant settings themselves in our list of Microsoft 365 security settings Texas SMBs miss, and the monitoring that sits on top is part of our cybersecurity services in Dallas.
Procedure rows matter too. Keep them boring. A callback list printed once a quarter, kept outside email, with a named person who calls and a named person who approves. Boring works.
What should a Dallas firm do in the first hour, day, and month?
Speed decides recoveries. IC3’s guidance says time is of the essence, and its Recovery Asset Team ran 3,900 Financial Fraud Kill Chain cases in 2025, freezing $679,013,183, a 58% success rate. Fast calls get freezes.
- Call the sending bank’s fraud line within the hour. Ask for a recall of the wire and, as IC3’s Financial Fraud Kill Chain brochure advises, a Hold Harmless Letter or Letter of Indemnity.
- File a complaint at ic3.gov the same day, with the wire details, and keep the complaint number for your bank, your carrier, and FBI Dallas.
- Revoke every active session on the affected accounts, then reset credentials. In a January 2026 BEC write-up, Microsoft warned that password resets alone are insufficient.
- Sweep inbox rules and forwarding on every mailbox in the thread, not only the one you suspect.
- Export the audit records. Microsoft’s standard audit retention is 180 days, and a fraud found in month 7 has no trail left to read.
- Work out what the attacker could read, then decide on client notice under ABA Opinion 483 with your ethics counsel.
- Calendar the Texas deadlines, 30 days for the Attorney General if 250 or more Texans are affected and 60 days for the individuals.
Our engineers handle steps 3 through 5 for firms we support, ideally while a partner is still on the phone with the bank. Steps 1, 2, and 6 belong to the firm. Nobody else can.
What does closing these gaps cost a Dallas firm?
Less than one bad wire. Microsoft lists Business Premium at $22.00 per user per month, and that license already carries Defender for Office 365 Plan 1 and the Conditional Access the sign-in controls need. FIDO2 keys are a one-time hardware cost per person. Configuration is labor.
On our side, Uprite’s published pricing starts at $138 per user per month for Fully Managed IT, $91 for the Security Stack with advanced endpoint and email security, and $40 for MSSP Security Focus alongside an IT person you already have. A 10-person firm on Fully Managed pays about $1,380 a month before licensing, so the Texas average BEC loss of $135,072 would cover more than 8 years of it. If you want the full legal software stack priced next to the IT invoice, our breakdown of what Dallas law firms pay for managed IT does that line by line.
Where does Uprite fit for a Dallas firm?
We run IT and security for Texas firms from our Dallas office at 5757 Alpha Road, Suite 530, and our average response time is 5 minutes. For a firm worried about wire fraud, that means the controls in the IT provider rows above get configured, monitored, and written down, and we help you write the procedure rows, even though your people own them.
Not every firm needs that. If you already employ a security team that enforces phishing-resistant sign-in, reviews inbox rule alerts every day, and tests the callback list, you don’t need us for this, and you should keep what’s working. If you’re comparing providers instead, our ranking of Dallas legal IT providers shows who publishes what, and the wider legal and professional services page explains how we support firms across Texas.
Find out where a forged wire instruction would get through at your firm. In a free security assessment, we review your Microsoft 365 sign-in, impersonation, and forwarding settings, then walk your payment procedure with you, start to finish.
Book a Free Security AssessmentWhat Dallas attorneys ask about email and wire fraud
Is a Dallas law firm liable if a client wires money to a fraudster?
It depends on the facts, and Texas courts have not settled the question. In Benchellal v. Okonite, a Southern District of Texas court left a roughly $250,000 loss with the party who sent the wire. Ask your own counsel, and put your wire policy in every engagement letter now.
Does DMARC stop business email compromise?
Only part of it. DMARC stops exact forgeries of your domain, but Microsoft says lookalike domains can pass SPF, DKIM, and DMARC, and a hijacked real mailbox passes every check because the message is genuine.
Can the bank pull back a wire sent to a fraudster?
Sometimes, if you move fast. The FBI Recovery Asset Team froze $679,013,183 across 3,900 cases in 2025, a 58% success rate, so call the sending bank for a recall and file at ic3.gov the same day.
Do we have to tell clients after an email account is compromised?
Often, yes. ABA Formal Opinion 483 expects lawyers to notify current clients when their information was involved in a breach, and Texas Business and Commerce Code Section 521.053 sets a 60-day deadline for affected individuals and 30 days for the Attorney General when 250 or more Texans are affected.
Is multifactor authentication enough on its own?
No. Push and text codes can be relayed through a fake login page, which hands the attacker a signed-in session, so CISA recommends phishing-resistant methods such as FIDO2 security keys, and a callback rule still covers what sign-in controls cannot.
Who should we call first, the bank or the FBI?
The bank. Call the fraud line of the bank that sent the wire and ask for a recall, then file a complaint at ic3.gov within the same day so the Recovery Asset Team can contact the receiving bank.
What does it cost to harden Microsoft 365 for a 10-person firm?
Licensing runs about $220 a month at the $22.00 Business Premium list price, plus a one-time cost for security keys. Uprite Fully Managed IT starts at $138 per user per month, and MSSP Security Focus starts at $40 for firms that keep their own IT person.
