An email arrives during a busy afternoon: a vendor has changed banks, a client needs a payment redirected, or a familiar contact sends revised instructions. The thread looks normal. The request feels urgent.
That is exactly when an Orlando law firm needs a process that does not depend on whether a message “looks right.” Payment instructions deserve independent verification even when the sender’s name is familiar and the message appears inside an existing conversation.
The FBI describes business email compromise as fraud involving apparently legitimate requests from known sources. Attackers may imitate an address or gain access to real correspondence. FBI business email compromise guidance
The following workflow is a practical starting point for firm administrators and IT providers. It does not replace your firm’s legal, banking, trust-account or professional-responsibility procedures.
1. Define which changes stop the payment process
Write down the events that require additional verification. Examples include a new beneficiary, a changed account number, an unexpected payment method or an instruction to bypass the usual approver.
Give staff explicit permission to pause. A deadline should trigger escalation to the responsible partner or manager—not an exception invented by the person handling the payment.
The important question is not “Does this email sound convincing?” It is “Has this change passed our approved verification process?”
2. Verify through a contact route you already trust
Do not reply to the questionable email and treat the response as independent confirmation. Do not use a new phone number supplied in the same message.
Use a previously established contact record or independently verified channel. The FBI recommends confirming payment requests and changes to account information in person or by phone and warns against relying on contact details provided by a potential scammer. FBI prevention guidance
Your firm should decide who may approve changes, what must be confirmed and how the confirmation is recorded. A familiar voice alone should not override the established process or an unresolved discrepancy.
3. Keep verification and approval visible
A lightweight record can prevent confusion between “someone checked” and “the change was approved.” For each changed instruction, record:
- The matter or vendor reference, using your firm’s approved information-handling process.
- The nature of the requested change.
- The trusted contact route used to verify it.
- Who verified it, who approved it and when.
- Any discrepancy and how it was resolved.
Avoid placing full bank details in an ordinary help-desk ticket or broadly shared spreadsheet. Store supporting records in the authorized location with appropriate access.
Where your firm uses separate preparer and approver roles, make sure the second person can see the verification evidence—not merely the final amount.
4. Make the procedure work away from the office
A control that works only when everyone is at their desk is likely to break during travel, hearings or remote work. Decide in advance what happens if the usual approver is unavailable.
Identify a backup approver, an approved communication method and a clear rule for unresolved changes. Test a fictional scenario in a staff meeting: a payment must go out, the account has changed, and the responsible attorney cannot immediately be reached. The useful result is a shared answer about escalation, not a faster way to bypass the check.
5. Give IT a defined role
Payment authorization belongs to the firm’s authorized people. IT support helps protect and investigate the systems carrying those instructions.
Ask your provider how your current service covers account protection, suspicious-message reporting and investigation of possible mailbox access. Multi-factor authentication is an important safeguard, but it should not be presented as proof that every email or payment request is genuine. The business verification process still matters.
Agree on a reporting route staff can use without interacting further with the suspicious message. Also decide who coordinates with the firm’s leadership, financial institution and advisers if an incident is suspected.
If a payment may already have gone to the wrong destination
Treat the situation as urgent. The FBI advises contacting your financial institution immediately and reporting business email compromise to the Internet Crime Complaint Center. Preserve the relevant messages and transaction details for the people handling the response; do not assume a recovery is guaranteed. FBI reporting guidance
Turn a checklist into a repeatable routine
For a firm serving Orlando or Kissimmee clients, the most useful next step is to review one recent payment-change request. Was the contact route independent? Was approval documented? Did everyone know what to do when something did not match?
Then put the agreed process where staff can find it and rehearse it with a harmless example. A clear, usable process is better than a policy that exists only in a folder.
Discuss the technology behind your firm’s workflow
Explore law firm IT services in Orlando or contact CMIT Solutions West Orlando & Kissimmee to discuss email security and IT support needs. You can also ask about the Free Vulnerability Report and what it covers.
Do not include confidential matter information, bank details or passwords in the public contact form. A technical report does not replace payment controls or guarantee protection against fraud.
