Phishing Protection Services for Law Firms: UK Guide

Phishing protection services for law firms are the combination of email security tools, domain authentication, access controls, staff awareness and incident response that stops fraudulent emails reaching fee earners, or limits the damage when one does. No single product does this. The firms that cope best treat phishing as a process problem as well as a technology problem.

Law firms are attractive targets because they hold client money, move large sums at predictable moments (completions, settlements) and exchange sensitive documents by email. The Solicitors Regulation Authority (SRA) states that email modification fraud, where a criminal redirects a payment by impersonating a party, is the most common cyberattack its firms experience. See the SRA cyber security advice for the detail.

This guide is written for managing partners, COLPs, practice managers and IT leads at UK firms. It explains what each layer does, how to compare providers, what to do when something gets through, and how to sequence the work. The position is as at October 2026, checked against the NCSC guidance on phishing attacks, the SRA and the ICO. If you want the wider context for your sector, our page on IT support for law firms covers how we work with practices.

What are phishing protection services for law firms?

Phishing protection services for law firms are managed or self-run controls that detect, block, report and respond to deceptive messages aimed at your people, clients and bank details. They cover the whole journey of a malicious message, from the moment it is sent to the moment it is reported or acted on.

A typical service bundles several parts:

• Inbound email filtering that scans links, attachments and sender behaviour.
• Domain protection through SPF, DKIM and DMARC so your own domain cannot be spoofed.
• Identity protection such as multi-factor authentication and conditional access.
• Awareness training and a simple way to report suspicious email.
• Monitoring and response so a compromised mailbox is spotted and contained quickly.

The NCSC guidance on phishing attacks frames the same idea as four layers: make it hard for attackers to reach users, help users spot and report phishing, limit the impact of messages that get through, and respond quickly to incidents. Use that structure when you assess any provider.

Why are law firms such a target for phishing?

Law firms are targeted because a single successful email can redirect a large client payment. Criminals know when money is due to move and often watch a transaction for some time before intervening.

The SRA cyber security advice describes successful attacks as usually targeted rather than mass mailings, with fraudsters building trust over several exchanges before redirecting payment. It also notes that a vishing (voice phishing) victim lost a significant sum after repeated fake payment retries, which shows that email is not the only route.

Several features of legal work raise the risk:

• Public websites list fee earners, roles and sometimes live matters, which gives criminals material for convincing messages.
• Conveyancing and probate involve third parties (agents, lenders, other firms) whose email you cannot control.
• Time pressure around completion encourages quick decisions.
• Client money rules mean a loss must be replaced immediately and reported.

The SRA also publishes its own warnings. In one reported case, the Law Gazette report described fake emails sent from a lookalike domain claiming a complaint had been made against a firm and intended to deliver malware. The lesson is that even regulator-branded messages need checking against the real domain.

How does phishing reach solicitors, and what does it look like?

Phishing reaches solicitors through email, text, phone and increasingly collaboration tools, and it usually imitates someone the recipient already deals with. The common patterns are below.

Our general explainer, what phishing is, with types and examples, covers the wider categories if you want to share a plain-language primer with fee earners.

What layers of email security do law firms need?

Law firms need at least five technical layers working together: filtering, domain authentication, identity protection, device hygiene and monitoring. If you remove one, the others carry more load than they should.

Is the filtering built into Microsoft 365 enough?

The built-in protection is a baseline, not a finish line. According to Microsoft Learn overview of Defender for Office 365, anti-phishing protection against spoofing is built in for cloud mailboxes, while Safe Links, Safe Attachments and user and domain impersonation protection sit in Defender for Office 365 Plan 1, with attack simulation training and deeper investigation in Plan 2. Plan 1 is included in some subscriptions such as Microsoft 365 Business Premium and is also sold as an add-on. Check exactly what your licences include before buying anything additional.

When is a third-party email security gateway worth it?

A third-party filter can add value where you want a second detection engine, per-user quarantine controls, or consistent protection across mixed mail platforms. It can also add cost, mail-routing complexity and another console to monitor. Decide on evidence: ask your provider to compare what your current tools miss against what the extra layer would catch, using your own mail flow.

What should sit behind the filter?

• Multi-factor authentication for every user, with stronger methods for partners and finance staff.
• Patched devices and restricted administrator rights, so a click has limited consequences. Our managed EDR service is one way to monitor endpoints for what filters miss.
• Logging and alerting on suspicious sign-ins and new mailbox forwarding rules.

Six layers that work together to reduce phishing risk in a UK law firm.

How do DMARC, SPF and DKIM protect a law firm's domain?

SPF, DKIM and DMARC are three DNS-based standards that let receiving mail servers check whether an email claiming to come from your domain is legitimately authorised. DMARC ties them together and tells receivers what to do with failures.

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a cryptographic signature to outgoing messages.
• DMARC sets a policy (none, quarantine or reject) and sends reports so you can see who is sending as you.

The NCSC guidance on phishing attacks recommends DMARC with SPF and DKIM so attackers cannot send email that appears to come from your domain, and notes it also helps your legitimate email reach inboxes. The SRA advice likewise asks firms to consider DMARC.

DMARC protects clients from emails pretending to be you. It does nothing about lookalike domains such as a one-letter variation, so it complements rather than replaces filtering and staff vigilance.

How can a firm stop payment diversion and client account fraud?

A firm stops payment diversion mainly through process: no bank detail change is actioned on email alone, and every change is confirmed by a second channel using contact details you already held. Technology reduces the number of fraudulent emails; process stops the one that arrives anyway.

Drawing on the SRA cyber security advice, a sensible control set looks like this:

• Tell clients at engagement that you will never change your bank details by email, and repeat it in completion correspondence.
• Require verbal or written confirmation, using known details, before acting on any bank detail change or releasing funds.
• Check email accounts for unexpected forwarding rules, which criminals use to watch a matter quietly.
• Check sender addresses for small variations rather than trusting the display name.
• Limit what your website reveals about live matters and internal roles.
• Train everyone, from partners to reception, to query pressured payment requests.

The SRA also notes that Confirmation of Payee helps with bank mandate fraud but does not remove the need for vigilance. Treat it as an additional check, not a substitute for call-backs.

Where payment diversion involves a compromised mailbox on the other side of the transaction, you may see nothing wrong on your own systems. That is why verification by phone, using details from an independent source, is a standing rule rather than an optional extra.

Does phishing awareness training work for solicitors?

Training helps, but only as one layer. The NCSC is explicit that nobody can spot every phishing email, so training should sit alongside technical controls and a culture where people report quickly without fear of blame.

The SRA expects training across the firm, including senior and support staff, with records kept so gaps can be identified, and content that reflects current threats and the firm's own risks. Practical ways to make it stick:

• Keep sessions short and tied to real workflows, such as completion statements and bank detail changes.
• Give fee earners, cashiers and finance staff role-specific scenarios.
• Provide a one-click report button in Outlook and acknowledge every report.
• Measure reporting rates, not only click rates.
• If you run phishing simulations, agree the approach with HR first and avoid shaming individuals.

Defender for Office 365 Plan 2 includes attack simulation training according to Microsoft Learn, and many awareness vendors offer similar features. Whichever you choose, the test is whether people report earlier and more often over time.

What should a law firm do if a phishing email is clicked?

If someone clicks, act on the assumption that credentials may be stolen: isolate, reset, review and report. Speed matters more than certainty in the first hour.

1. Contain: disconnect the device if malware is suspected, reset the password and revoke active sessions.
2. Check the mailbox: look for new forwarding rules, delegated access and sent items the user did not write.
3. Protect money: contact the bank immediately if any payment instruction may have been affected.
4. Preserve evidence: keep the original message and logs for investigators and insurers.
5. Assess data exposure: work out whether personal data was accessed.
6. Report: to the SRA where a cyber incident has succeeded, to the ICO where required, and to Action Fraud.

On timing, the ICO guidance on personal data breaches says a notifiable personal data breach must be reported without undue delay and no later than 72 hours after you become aware, and that you should document your reasoning if you decide it is not reportable. The SRA advice also asks firms to report successful attacks to it and to set out reporting protocols in policy.

Write this down before you need it. Our cyber incident response plan template is a starting point, and the NCSC advises testing the plan through exercises rather than leaving it in a drawer.

How do insurance and regulatory duties affect phishing protection?

Insurance and regulation shape both what you must do and what you can recover. Read your cover before an incident, not during one.

The SRA cyber security advice advises firms to check their professional indemnity insurance, noting that minimum terms may respond to client money losses from cybercrime up to the insured amount, and that some firms have discovered their policy did not cover cyber losses. It also notes that the SRA Account Rules require improperly withdrawn client money to be replaced immediately and reported.

Questions to put to your broker:

• Does the policy cover social engineering and payment diversion losses?
• Are there conditions such as MFA, backups or patching that must be in place?
• Does it fund forensic investigation, legal costs and notification?
• What are the notification time limits?

Insurers increasingly ask about security controls on proposal forms. Our guides to cyber insurance and Cyber Essentials explain how a recognised baseline supports both applications and client due diligence. Corporate and public sector clients often ask panel firms for evidence of controls, so documented protection has commercial value as well.

How do you choose a phishing protection provider for a law firm?

Choose a provider on evidence of legal-sector understanding, clear service boundaries and measurable outcomes, not on a feature list. Use the table below as a scoring sheet.

Ask whether the provider will work inside a managed IT support arrangement or as a standalone tool, because separating email security from the rest of IT often leaves gaps in who owns an alert. Our guide on choosing an IT support company covers general selection criteria, and a cyber security audit can establish your starting position first.

How should a law firm sequence phishing protection in 90 days?

A firm should start with the cheapest, highest-impact controls and move to the slower projects in parallel. The following is an illustrative sequence for a mid-sized practice on Microsoft 365, not a description of any specific client.

Days 1 to 30: close the obvious gaps

• Enforce MFA for all users and block legacy authentication.
• Audit existing licences to see which Defender for Office 365 features you already own and switch them on.
• Publish a payment verification rule and brief the accounts team.
• Start DMARC in monitoring mode.

Days 31 to 60: tighten detection and process

• Turn on alerts for mailbox forwarding rules and unusual sign-ins.
• Add a report-phishing button and agree who triages reports.
• Update client engagement letters with the no-bank-changes-by-email statement.
• Run first role-based training sessions for cashiers and conveyancers.

Days 61 to 90: prove it works

• Move DMARC towards quarantine, then reject once senders are clean.
• Run a tabletop exercise based on a diverted completion payment.
• Review insurance conditions against what is now in place.
• Report progress to partners with agreed measures, such as reporting rates and time to contain.

Where the firm lacks in-house capacity, Microsoft 365 support and small business cyber security services can carry the configuration and monitoring work while the firm owns the policy decisions. Our overview of cyber security best practices lists wider controls to schedule after the first 90 days.

Conclusion: what does good phishing protection look like for a law firm?

Good phishing protection services for law firms combine filtering, domain authentication, MFA, role-based training and a rehearsed response, all backed by a payment verification rule that no pressure can override. The SRA, NCSC and ICO sources cited here point the same way: layered controls, a no-blame reporting culture and quick, documented action.

Start with what you can switch on this month, measure reporting as well as clicking, and review the position at least annually. If you would like a second opinion on your current setup, speak to the NetMonkeys team.

Frequently Asked Questions (FAQs)