A Texas solo law practice found someone else signed in as its attorney and running a payment scam in his name.
The firm's hosted business mailbox showed no alerts, no lockouts and no malware. Then a client was asked to pay an invoice a new way and checked with the firm first. We proved from the mail routing that the attorney's account had been taken over, traced the sender to a data center in Germany, and locked the attacker out before any money moved.
The Challenge
The firm ran on a single hosted business mailbox. On paper everything looked fine. There were no security alerts, no account lockouts and no malware on any machine, so nothing suggested anyone but the attorney was using the account.
A solo practice carries the same duties as a large firm. Client conversations are protected by attorney-client confidentiality, and client funds come with trust-account obligations. A payment sent to the wrong account, on the firm's word, is a problem for the client and for the practice. Firms like this are exactly who our cybersecurity for law firms work is built for.
Then a client was asked to send an invoice payment a new way, and checked with the firm before paying. The attorney looked closer and found a draft he never wrote and a thread he never sent. The firm had to know fast if that payment instruction came from the attorney or from an imposter.
No warning signs
The mailbox raised no alerts, no lockouts and no malware, so the account looked healthy right up until a client asked a question.
The right address, the wrong sender
The payment instruction arrived from the attorney's real address, so on the surface there was no way to tell it apart from his own mail.
A client payment on the line
A client was ready to pay an invoice under the new instruction, so the firm needed an answer before that money moved.
What We Found
We compared the genuine and fraudulent messages side by side, read the full routing headers of each, reviewed the mailbox for anything the attorney had not set up himself, and ran a dark web breach check on his address.
The mail routing gave it away
Every genuine message in the thread came from the firm's own mail server. The fraudulent replies displayed the attorney's real address, but their routing pointed to a different server, which we traced by IP to a data center in Germany. The Message-ID, which should stay constant through a thread, was replaced mid-thread.
Combined, those signs proved the messages were sent from outside the firm's mail system. The "attorney" replies asking for a new way to pay were fraud.
The fraud was hidden from the attorney
The fraudulent thread was filtered so it would not appear in the attorney's inbox, and a draft he never wrote had been left in the account.
Filters and drafts are not something an outsider can create by faking an address. They are the sign of someone holding working credentials and signed in to the mailbox itself.
The credentials were already exposed
A dark web breach check found the attorney's address in 6 historical data breaches, and 2 of those breaches exposed passwords.
Exposed passwords are the likely way in. An attacker does not need to break anything when a working password is already in circulation.
Someone was signed in as the attorney
This was not a spoofed address. Someone was signed in to the mailbox as the attorney and running a payment scam in his name, asking a client to pay an invoice a new way.
Three independent forensic tells proved account takeover. The fraudulent replies were routed through an outside server traced to a data center in Germany, with the Message-ID replaced mid-thread. The messages carried injected formatting. And the signature block that appears on every genuine message was missing.
The scam failed because the client paused on an unusual payment instruction and the firm called us. The lesson applies to every practice that handles client money. A reply from the right address is not proof the right person sent it.
How the genuine and fraudulent messages differed
| Signal | Genuine messages | Fraudulent replies |
|---|---|---|
| Sending mail server | The firm's own server | Outside server traced to a German data center |
| Message-ID chain | Consistent | Replaced mid-thread |
| Signature block | Present | Missing |
What We Delivered
Once the attorney called, we proved what had happened from the message headers, then locked the attacker out of the account for the firm and closed the way they got in, all within five days.
Email forensic analysis
Compared the genuine and fraudulent threads and their full routing headers to prove the replies came from outside the firm's mail system and trace them to a data center in Germany. See our digital forensics service for details.
Attacker locked out
We locked the attacker out for the firm. We reset the credentials, removed the hidden filter and the rogue draft, and enabled two-factor authentication on the mailbox. See our business email compromise response service for details.
Dark web exposure review
Checked the attorney's address against known breach data, found it in 6 historical breaches with 2 exposing passwords, and identified the likely way in. See our dark web monitoring service for details.
Report walkthrough
Walked the firm through our report, sign by sign, so the attorney and his staff can recognize and handle this kind of attack themselves in the future.
Results
All numbers come from the forensic review of the firm's email threads and the dark web breach check on the attorney's address.
The client paused on the new payment instruction and the payment never reached the criminal.
The attorney's address appeared in 6 historical breaches, 2 of which exposed passwords.
Outside routing with a replaced Message-ID, injected formatting, and a missing signature block proved the account was taken over.
Two-factor authentication now protects the mailbox, so a leaked password alone no longer gets anyone in.
Timeline
From a client's question about a changed payment instruction to a locked-down mailbox in five days.
A client flags a changed payment instruction
A client is asked to send an invoice payment a new way and checks with the firm before paying.
The attorney finds what he did not write
The attorney finds a draft he never wrote and a thread he never sent, and calls us.
Takeover proven
Routing and header analysis proves the account was taken over and traces the fraudulent replies to a data center in Germany.
Attacker locked out
We reset the credentials, remove the hidden filter and the rogue draft, and enable two-factor authentication.
Protected going forward
The firm moves to unique passwords with ongoing dark web monitoring, and has been walked through our report so the team knows the signs to watch for.
Services Applied in This Engagement
This engagement combined business email compromise response, email forensics, and dark web exposure review to prove an account takeover and shut it down before any money moved.
Business Email Compromise Response
Rapid response when a mailbox is taken over and a payment scam is already in motion.
Learn moreDigital Forensics & Breach Investigation
Routing and header analysis that proves who really sent a message and where it came from.
Learn moreDark Web Monitoring
Find out when your team's addresses and passwords turn up in breach data, before an attacker uses them.
Learn moreWould Your Firm Know If Someone Else Was Signed In As You?
An account takeover raises no alarms. The attacker reads your mail, hides their own, and asks your clients to pay a new way from your real address. We prove what happened, lock them out, and close the way they got in.
We work with law firms, solo attorneys and professional practices. Start with a free consultation, or call 512-518-4408.