Email Security for Solicitors: Stopping Conveyancing Payment Fraud

Good email security for solicitors combines three layers: SPF, DKIM and DMARC at an enforcing policy so nobody can send email from your exact domain, multi-factor authentication on every mailbox so accounts can't be quietly taken over, and a firm rule that bank details are never changed by email and are always verified through a separate, known phone number.

Law firms hold client money, deal in large sums at predictable moments and communicate mostly by email. That combination makes them a natural target. Conveyancing is the obvious example: a buyer sends their deposit or completion funds on a known day, often under time pressure, and a single convincing email with "updated" bank details can redirect the lot. This guide explains how the fraud works, what the regulators say, and the technical and human controls that make your firm a much harder target.

AI Automation for Law Firms, Explained Step by Step · 3:08 Subscribe

How email payment fraud hits law firms

The SRA calls it email modification fraud. Criminals intercept or imitate messages between a firm and its clients, then persuade someone to send money to a different account. According to the SRA's Risk Outlook report on information security and cybercrime, published in June 2022, phishing and email modification frauds make up half of all the cybercrime reports it receives, and over 80 percent of the cybercrime reports it received in 2021 involved email.

There are three common patterns:

1. The firm is impersonated. The client receives an email that appears to come from their solicitor saying the firm's bank details have changed. It may come from your real domain (if it isn't protected), from a lookalike domain such as smith-law.co.uk instead of smithlaw.co.uk, or from a genuine mailbox that has been hacked.
2. The client is impersonated. The firm receives an email that appears to come from a seller asking for sale proceeds to go to a new account.
3. Another party is impersonated. An estate agent, lender, broker or the other side's solicitor appears to send new payment instructions.

The attacker has often been reading a compromised mailbox for weeks, so the fake email can quote the right property address, matter reference and completion date. That's why spotting fakes by tone alone doesn't work.

What the SRA expects

The SRA's cybersecurity advice for firms, based on its 2020 thematic review, found email modification fraud to be the most common type of cyberattack among the firms it visited. Its practical advice includes:

• Tell clients that you would never change your bank details by email.
• Use safeguards such as a password, identification, or verbal or written confirmation before transferring funds.
• Have clear protocols for when to report cyber incidents to the SRA, the ICO, the police reporting service and the NCSC.
• Report any loss of client money to the SRA.

The SRA Accounts Rules require any client money improperly withdrawn to be replaced promptly, so a successful diversion from your client account is a direct cost to the firm, on top of the reputational damage. The SRA also publishes scam alerts when criminals clone a firm's identity. It's worth checking periodically whether your own firm has appeared there.

The technical layer: SPF, DKIM and DMARC

These three DNS records decide whether receiving mail servers trust email claiming to come from your domain.

The NCSC's email security and anti-spoofing guidance recommends starting DMARC at p=none to collect reports, then moving to quarantine and finally reject once every legitimate sender passes. A p=none policy on its own only monitors. It doesn't stop a single spoofed email.

A sensible rollout for a law firm

1. List every service that sends email as your domain. Microsoft 365 or Google Workspace, your case management system, client portal, e-signature tool, accounts package, marketing platform and any website forms.
2. Fix SPF. Include each sender, keep under the 10 DNS lookup limit, and end with -all or ~all. Check it with the free SPF checker.
3. Turn on DKIM for each sender. Most platforms give you CNAME or TXT records to add. Send a test message and confirm the DKIM signature passes.
4. Publish DMARC at p=none with a reporting address. Build the record with the DMARC record generator.
5. Read the reports for a few weeks. Look for legitimate services that fail and fix them.
6. Move to p=quarantine, then p=reject. Confirm the live policy with the DMARC checker.
7. Protect domains you don't send from. Old firm names, merged-practice domains and defensive registrations should have an SPF record of v=spf1 -all and a DMARC policy of p=reject, so they can't be used for fraud either.

Our guide to stopping email spoofing of your domain walks through each record in more detail, and DMARC explained covers the policy options and reports.

What DMARC can't do

It's important to be honest about the limits. DMARC at reject stops criminals using your exact domain. It does nothing about:

• Lookalike domains. A fraudster can register a domain one character away from yours and set up perfect SPF, DKIM and DMARC for it. Consider registering the obvious variants of your domain yourself, and teach staff and clients to read the full address, not just the display name.
• Compromised mailboxes. If a criminal logs into a real staff or client mailbox, their emails are genuinely from that account and pass every check.
• The other side's weak setup. Your clients, agents and the other side's solicitors may have no DMARC at all.

That's why the technical layer has to be backed by account security and process.

Locking down mailboxes

Most payment diversions start with someone's mailbox being accessed, either at the firm or at the client.

• Multi-factor authentication on every account. Fee earners, support staff, partners and shared mailboxes. The NCSC's phishing guidance recommends MFA so that a stolen password alone isn't enough. Prefer an authenticator app or passkey over text messages where possible.
• Block legacy authentication. Older protocols such as basic-auth POP and IMAP can bypass MFA. In Microsoft 365 and Google Workspace, check they're switched off.
• Check forwarding and inbox rules. Attackers often add a rule that forwards or hides emails containing words like "completion" or "bank". Review rules regularly, block automatic forwarding to external addresses, and alert on new rules.
• Monitor sign-ins. Unusual locations, impossible travel and new devices are early warning signs.
• Keep devices updated. Cyber Essentials covers the basics, and the SRA noted that firms with Cyber Essentials Plus were more likely to have good policies in place.

The human layer: process beats technology

The single most effective control is a payment process that doesn't trust email at all.

For clients

• Give your bank details at the start of the matter, in the client care letter and ideally in person or through a secure portal.
• State clearly, in the letter, your email footer and on your website, that your bank details will not change during the matter and that you will never change them by email.
• Ask clients to phone you on a number they already have (from your website or engagement letter, not from an email) before sending any money.
• Suggest a small test payment before a large one, and confirm receipt by phone.
• Explain that Confirmation of Payee checks help but aren't a guarantee. The SRA describes it as further protection, while still telling firms to stay vigilant.

For staff

• Never act on new or changed bank details received by email, however senior or urgent the sender seems.
• Verify every change by calling the client on the number held on file from the start of the matter.
• Record who checked, how and when, on the matter file.
• Use a two-person sign-off for outgoing payments over a set amount.
• Treat urgency, secrecy and Friday afternoon pressure as red flags, not reasons to rush.

Training

Short, regular training works better than an annual slideshow. Use real examples of suspicious emails, show staff how to check the full sender address and the message headers, and make reporting easy and blame-free. When something looks wrong, staff can paste the headers into the free email header analyser to see which servers the message really came through and whether SPF, DKIM and DMARC passed.

A quick email security checklist for law firms

1. SPF, DKIM and DMARC published for every sending service, with DMARC at quarantine or reject.
2. Unused and old firm domains locked down with -all SPF and p=reject DMARC.
3. MFA on every mailbox, with legacy authentication disabled.
4. External auto-forwarding blocked and inbox rules reviewed.
5. Bank details given at the outset, with a written warning that they won't change.
6. Every payment change verified by phone on a known number, and recorded.
7. Two-person approval for outgoing payments above a threshold.
8. Regular phishing awareness training and a no-blame reporting culture.
9. An incident plan covering the bank, the SRA, the ICO, the police and your insurer.
10. Periodic checks of SRA scam alerts for clones of your firm.

If something goes wrong

Speed matters. If you suspect a diversion:

1. Call your bank and the receiving bank immediately to try to freeze the funds.
2. Secure the affected mailbox: reset the password, revoke sessions, remove unknown rules and check MFA settings.
3. Report it to the police through Report Fraud, which replaced Action Fraud from December 2025.
4. Notify your insurer and follow your obligations to the SRA, including reporting any loss of client money.
5. Consider whether it's a personal data breach that must be reported to the ICO within 72 hours.

Suspicious emails that haven't caused harm can be forwarded to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk.

Where Make It Flow fits

Our page of free tools for solicitors and law firms brings together the email authentication checks above, plus browser-based PDF tools that don't upload confidential documents. If you'd like help automating the routine around matters, such as onboarding checklists and status updates, Make It Flow works with law firms on workflows where solicitors stay in charge of advice, approvals and anything involving client money.

FAQ

What is email modification fraud?

It's the SRA's term for fraud where criminals intercept or imitate emails between a law firm and its clients, then persuade someone to send money to the wrong account. It often targets conveyancing, where large payments are made on predictable dates, and usually involves fake "change of bank details" messages from the firm, the client or another party.

Does DMARC stop conveyancing fraud?

DMARC at quarantine or reject stops criminals sending email from your exact domain, which removes one common route. It doesn't stop lookalike domains, hacked genuine mailboxes or weak security at the other parties. It should be combined with multi-factor authentication and a strict rule that payment details are only ever verified by phone on a known number.

What should a law firm's email footer say about fraud?

Keep it short and specific: state that the firm will never change its bank details by email, and that clients should phone a known number from the firm's website or engagement letter before sending any money. Repeat the same message in the client care letter and on the website so clients see it more than once.

Do solicitors have to report cyber attacks to the SRA?

The SRA asks firms to report losses of client money, and its guidance expects firms to have protocols for reporting cyber incidents to the SRA, ICO, police and NCSC. If personal data is affected, UK GDPR may require a report to the ICO within 72 hours. Check your reporting obligations under the SRA Codes and with your COLP.

How can I check if my law firm's domain can be spoofed?

Look up your domain's SPF, DKIM and DMARC records. If there's no DMARC record, or it's set to p=none, anyone can send email that appears to come from your exact address. Free checkers show the current records and policy in seconds, and the DMARC reports then show who is sending as your domain.

Is Microsoft 365 or Google Workspace secure enough for solicitors on its own?

Both are capable platforms, but their security depends on configuration. Turn on multi-factor authentication for every user, disable legacy authentication, block automatic forwarding to external addresses, set up DKIM signing and publish DMARC. Many firms also add sign-in alerts and a regular review of inbox rules.