Phishing and BEC at Major UK Law Firms: Lessons from Hill Dickinson and the Legal Sector
Business email compromise (BEC) — where attackers impersonate senior partners or finance staff to redirect client payments or authorise fraudulent transfers — is one of the highest-value attack types targeting UK law firms. Major commercial firms, including Hill Dickinson and others operating in conveyancing and commercial property, have faced sophisticated BEC campaigns where attackers compromised or spoofed email accounts to redirect six-figure sums. Unlike ransomware, which announces itself through system disruption, BEC attacks are often discovered only when the legitimate payment fails to arrive. By then, the funds are gone.
Business email compromise (BEC) costs UK law firms tens of millions annually — UK Finance reports it as the fastest-growing financial fraud type in the professional services sector.
How BEC Attacks Target Law Firms
BEC against law firms operates through several distinct attack patterns:
- Account compromise: attacker obtains genuine credentials for a partner or fee earner email account, monitors correspondence, and at the right moment intervenes to redirect a payment
- Domain spoofing: attacker registers a near-identical domain (hilldickinson.co vs hilldickinson.co.uk) and uses it to impersonate the firm to clients
- Supplier impersonation: attacker impersonates a supplier or barrister and requests a change to bank details for upcoming payment
- Client impersonation: attacker intercepts communications and impersonates the client, redirecting completion funds or settlement proceeds
- Internal impersonation: attacker impersonates a senior partner to finance staff, authorising an urgent wire transfer
The Technical Controls That Prevent BEC
BEC is one of the most preventable attack types — every effective control is well-understood and straightforward to implement:
- DMARC, DKIM, and SPF: email authentication standards that prevent domain spoofing — if your firm's domain has DMARC enforcement in place, attackers cannot send email that appears to come from your domain
- Multi-factor authentication: prevents account compromise by requiring a second factor even when credentials are stolen
- Email filtering: modern gateways detect impersonation patterns, suspicious reply-to addresses, and lookalike domain indicators
- Verified callback procedure: the single most effective process control — any request to change bank details must be verified by telephone to a known, pre-existing number before acting
Process Controls That Eliminate the Attack Vectors
Technical controls alone are insufficient — BEC specifically exploits the human element. Process controls must sit alongside technical defences:
- Four-eyes principle for all payments above a threshold: no single person can authorise a payment exceeding the firm's defined limit
- Bank detail change protocol: written policy requiring telephone verification using a pre-existing number for any bank detail change — no exceptions
- Client onboarding communication: informing every client in writing at outset that you will never change bank details by email
- Staff training: regular phishing simulation exercises and scenario-based training specifically covering BEC patterns
- Impersonation awareness: training fee earners to scrutinise reply-to addresses, domain names, and payment requests made with artificial urgency
When BEC Succeeds: Recovery and Reporting
When a BEC attack results in a misdirected payment, immediate action determines how much of the money can be recovered:
- Contact your bank immediately using the fraud hotline — banks have 24/7 fraud teams and can sometimes recall payments if caught quickly
- Contact the receiving bank's fraud team directly if you can identify it — Faster Payments can sometimes be reversed
- Report to Action Fraud immediately — obtaining a crime reference number supports insurance claims
- Notify professional indemnity insurer — BEC losses may be covered under PI or cyber policies
- Notify the SRA if client money has been misdirected — this is a mandatory notification
- Notify affected clients and consider your GDPR obligations if personal data was involved in the attack
Frequently Asked Questions
Is our firm liable if a BEC attack causes a client to lose money?
It depends on the circumstances. If the firm's systems were compromised or the firm sent incorrect bank details, there is likely professional liability. If the client was deceived by an attacker impersonating the firm via a spoofed email and the firm had DMARC enforcement in place, the position is more complex. Professional indemnity insurance typically covers these scenarios, but coverage depends on whether adequate security controls were in place. The SRA will investigate whether the firm's controls were adequate.
What is DMARC and does our firm need it?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that allows your firm to publish a policy specifying how email receivers should treat messages that fail authentication from your domain. In practice, DMARC enforcement prevents attackers from sending emails that appear to come from your firm's domain. Every law firm should have DMARC in place — it is free to implement, prevents domain spoofing BEC attacks, and is increasingly expected by cyber insurers as a basic control.
How do we verify that a caller is actually our client before disclosing matter information?
Establish a verification procedure at client onboarding: capture security questions or a pass-phrase that the client sets at first meeting. For all subsequent calls, verify against this information before discussing the matter. Do not rely on caller ID, which can be spoofed. For high-value transactions like completions, establish a direct-dial number for the specific client contact and call them — never call back on a number provided in the suspicious call.
Protect your firm from BEC and phishing — speak to us
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.