Legal secretaries sit on the exact surface that email fraud targets: trust money instructions, conveyancing timelines, client bank details and documents that create urgency by their nature. When a fraudster needs someone to move money under deadline pressure, a legal secretary is the person they try to reach. This guide covers the attacks aimed at that desk in 2026, the training that measurably reduces them, and the cadence that makes the habits stick.
TL;DR
- Law firms are directly targeted: the Legal Practitioners Liability Committee issued an alert in August 2025 about fake solicitor websites that copy a firm's design, branding, text and even staff details.
- Payment redirection scams cost Australians A$224 million in reported losses in 2022, and property transactions remain a prime lure.
- The habit that matters most is out-of-band verification: a known phone number, never the details in the email itself.
- Training for legal secretaries should cover six modules: phishing, payment and invoice fraud, credential handling, remote access scams, client data handling and incident reporting.
- A monthly cadence with phishing simulations and per-learner reporting makes the programme measurable, not aspirational.
Why legal secretaries are a target
Three things converge on the role. First, money moves on instruction: a secretary who receives an email amending a client's bank details is one click away from a six-figure transfer. Second, deadlines are real - a conveyance that misses settlement can collapse - so urgency is normal and urgency as a red flag gets trained out. Third, law firms hold exactly the documents scammers reuse for impersonation: letterheads, staff names, file structures, even the wording of past emails.
The Australian Competition and Consumer Commission's Targeting Scams 2024 report counted 494,732 scam reports in 2024 with combined reported losses above A$2.03 billion (Targeting Scams 2024). Payment redirection - the scam most relevant to a legal practice - accounted for A$224 million of reported losses in 2022 and remains a standing threat to conveyancing (Law Society Journal, on the ACCC's Targeting Scams report).
The four attacks aimed at your desk
1. Conveyancing payment redirection. The scammer watches or intercepts the email thread near settlement, then sends an email amending the vendor's or the firm's bank details. The email is formatted exactly like the thread and often arrives from an address differing by one character. The tell is not the email - it is any change to payment instructions received by email.
2. Fake solicitor websites and firm impersonation. The LPLC's August 2025 alert describes cybercriminals registering lookalike domains and building near-identical copies of real law firm sites, replicating design, branding, text and staff details (LPLC cybercrime alert, August 2025). Clients searching for the firm can land on the fake site and transact with the scammer. Law societies have separately reported a significant escalation in scammers calling, emailing and messaging lawyers and staff while impersonating banks and clients (Law Society of Tasmania).
3. Invoice and executive fraud. A partner emails asking for an urgent payment, or a supplier invoices with new details. The request is plausible because both happen legitimately every week. The control is the same as for conveyancing: verify out of band, with a number you already had.
4. Credential and document theft. Phishing aimed at legal staff dangles a real-looking court notice, a filing deadline or a shared deposition link. Credentials stolen here unlock client files, trust account correspondence and everything an attacker needs for the next impersonation.
What training should cover
A programme for legal secretaries should hit six modules:
- Phishing and smishing fundamentals. The 2026 red flags: sender lookalikes, mismatched links, urgency, unexpected attachments. Short, story-based lessons in security awareness training beat annual compliance slides on every measure.
- Payment and invoice fraud. The two-person rule for bank detail changes, verbal verification on a known number, and what to do the moment a change request arrives.
- Credential hygiene. Unique passwords, MFA on email and the practice management system, and why a shared login is a professional-conduct problem, not just a security one.
- Remote access scams. The caller who says they are IT and needs screen access now. The habit: hang up and call back on a known internal number.
- Client data handling. What may leave the firm, over which channel, and what a suspected breach triggers - which is a report, not a conversation in the tea room.
- Incident reporting. Who to tell, how fast, and the assurance that a false alarm costs nothing while a silence costs everything.
The cadence that works
- Monthly, not annually. A 10-15 minute lesson a month keeps the behaviours warm; a single annual session decays before settlement season.
- Simulate monthly. Phishing simulations with lures matched to the role - amended bank details, a court notice, a partner email - measure whether the training changed anything. Anyone who clicks is auto-enrolled in a short remediation module the same day.
- Report per learner. Human risk reporting turns completions, quiz results and phishing clicks into one score per person, which is also the evidence an insurer or a client's security questionnaire will ask for.
- Rehearse the money email. Once a quarter, run the amended-bank-details scenario as a simulation or a tabletop drill. The muscle that matters is stopping before acting, and muscles need reps.
What to do next
Run a security gap assessment to see where the practice stands against the frameworks that touch it - Essential Eight, cyber insurance requirements, client security questionnaires. It tells you whether the next dollar belongs in training or in a technical fix, and it turns an uneasy feeling into a list.
FAQ
Do legal secretaries need different training from other staff? The fundamentals are the same; the lures are not. Payment redirection, fake court notices and client impersonation should dominate the simulation calendar, or the training never touches the fraud the practice actually faces.
Isn't an annual compliance course enough? No. Fraud campaigns adapt monthly and an annual lesson decays within weeks. Monthly short lessons with monthly simulations is the cadence that measurably reduces clicks.
What is the single most important habit? Out-of-band verification: any change to payment instructions or an urgent request for money is confirmed by phone on a number you already had - never one from the email itself.
Does this training help with cyber insurance? Yes. Insurers increasingly ask for evidence of regular awareness training and phishing simulations. Per-learner reports answer that request directly.
Who should own the programme in a small firm? One named owner - often practice manager - with the reporting automated. A programme without an owner is a library nobody opens.
One last thing
The LPLC alert is worth printing and pinning up, not because its advice is novel but because it is dated August 2025: the fake-solicitor playbook is current, aimed at firms exactly like yours, and the secretary who verifies by phone is the control that beats it.