Security awareness training for law firms is a short, recurring programme that teaches fee earners and support staff to recognise the scams that target legal practices — above all payment redirection on client matters, which is where a single convincing email can divert client money or a settlement. Law firms are prime targets because they move large sums on deadlines, hold confidential client information, and communicate with strangers by email all day.
Why law firms are a target
- Trust money on deadlines. Settlements, deposits and disbursements move under time pressure, and a rushed payment is exactly what a payment redirection scam needs. Scamwatch describes the pattern: a scammer impersonates a client, supplier or colleague by email and provides an invoice or "updated" account details, so the money lands in the scammer's account (Scamwatch on payment redirection scams).
- Confidential information is leverage. Stolen client correspondence, discovery material or deal information can be ransomed or sold, and a breach of client confidentiality is a professional-conduct problem, not just an IT one.
- Lawyers act on instructions. A message that looks like it came from a partner or a client carries weight — which is why impersonation works so well against law firms.
- Email is the workflow. Firms live in email; a poisoned inbox is a poisoned practice.
What the training should cover
- Payment verification drills — any change of bank details or payment instructions is confirmed by phone on a known number, never by reply email. Make the callback a reflex, not a policy nobody reads.
- Phishing recognition — sender display names vs actual domains, lookalike links, urgent and confidential framing. Cyber Aware's guide to phishing simulations covers how monthly practice builds the habit.
- Client-impersonation scenarios — "the client has changed their settlement account" emails, including ones sent from a genuinely compromised client mailbox.
- Executive and partner impersonation — urgent transfer requests that appear to come from a partner.
- MFA discipline — never approve a sign-in prompt you did not trigger; push-bombing and approval fatigue are how attackers get past a stolen password.
- Confidentiality handling — where client documents may be stored and shared, and which channels are acceptable.
A six-step rollout
- Baseline. Run a gap assessment mapped to your framework (the Essential Eight, ISO 27001 or your insurer's questionnaire) before choosing content.
- Monthly microlearning. 10-15 minute sessions, one topic each — see Cyber Aware's training. Twelve short sessions beat one annual seminar because the recognition skills decay between infrequent sessions.
- Monthly simulations, weighted to your risk. Payment-instruction and partner-impersonation templates land hardest with fee earners; anyone who clicks is auto-enrolled into a short remediation course.
- Train every new starter in week one — before they touch a client matter or a trust payment.
- Measure per person, monthly. Human risk reporting gives a risk score per learner, so partners can see who needs coaching rather than a firm-wide completion percentage.
- Keep the evidence. Completion records and simulation results become the evidence pack for auditors, clients' security questionnaires and professional indemnity insurers.
Common mistakes law firms make
- Treating the annual compliance seminar as the whole programme.
- Training support staff but not fee earners — or the reverse.
- No verification habit for bank-detail changes, so the policy exists only on paper.
- Never following up after a failed simulation.
FAQ
Why do phishers target law firms specifically? Because a law firm is a one-stop target: client money moving on deadlines, confidential information worth ransoming, and a culture of acting on emailed instructions. One convincing email can reach any of the three.
How often should a law firm run training? Monthly, in 10-15 minute sessions, paired with a monthly phishing simulation. The cadence matters more than session length.
Should partners be included? They must be — partner impersonation is one of the most profitable scams against firms, and partners authorise the payments the scams aim at.
What single habit prevents the worst outcome? Callback verification. Any change to payment instructions is confirmed by phone on a number you already hold, every time, regardless of how urgent the email says it is.