Microsoft Outlook and other such email platforms allow users to set “rules,” which determine where your emails are sent and stored within your email account. For example, you could hypothetically create a rule that sends all incoming emails from the local Pizza Palace to a “Friday Night Plans” folder, bypassing your primary inbox altogether.

While such rules can make inboxes easier to manage, they can also aid bad actors in their deception. We have become aware of ongoing activity in Florida wherein cyber criminals are gaining unauthorized access to lawyers’ email accounts and then changing the rules settings so that select “sent” emails are automatically re-routed or deleted.  This means a hacker who has gained access to your email account can send fraudulent email using your real name & email address. Those sent emails are then automatically deleted from your “Sent” folder so that you never know an email has been sent! Hackers can use this simple trick to facilitate wire transfer fraud — but only if they have access to your email account. We encourage all Florida Lawyers Mutual members to immediately take the following precautions:

 

Check your rules settings. As soon as possible, check your email settings for any new or suspicious rules configurations. Instruct your law firm staff to do the same! Learn more about using rules in Microsoft Outlook and read Microsoft’s current advisory on Outlook rules attacks.

 

Change your passwords regularly. When’s the last time you changed your email password?

 

Always call to verify. Before wiring funds, always pick up the phone to call and confirm. Educate your clients, vendors, and support staff about the pervasive nature of fraudulent email-based wiring instructions.

 

Free Printable Resource for Florida Lawyers Mutual Members

Click image to access a printable, full-size, high-resolution version of the document.