October is Cybersecurity Awareness Month
October is Cybersecurity Awareness Month. But unlike previous years, when updating your software, strengthening your passwords and watching for phishing emails were enough, this year’s warnings are on Generative AI.
Generative AI makes fraud more convincing and easier to personalize.
A scammer can use it to write polished, matter-specific emails, clone a lawyer’s or client’s voice, or stage a video call that appears to confirm new payment instructions. But AI is often only one part of the scheme: a criminal may also have compromised an email account and be monitoring a real settlement or closing thread. The FBI cautions that not every business email compromise involves AI.
The risk is already showing up in U.S. reports. The FBI’s annual report, published in 2026 for 2025 complaints, recorded 22,364 complaints that referenced AI and more than $893 million in adjusted losses. It separately reported over $30 million in business email compromise losses involving AI. Those figures depend on what victims reported and identified as AI-related, so they may undercount AI’s role.
For a law practice, the key safeguards are procedural:
Never rely on email, caller ID, a familiar voice, or a video call to authenticate wire instructions. Independently call a number already on file or look it up through a reliable source—not a number in the new message.
Cyber professionals recommend one simple fix for families to fight elder fraud, which accounted for $353 million in 2025 among adults 60 and older: agree on a private family code word, in person, never shared digitally, that a scammer’s cloned voice could not possibly know. If your family hasn’t talked through what you’d do if a call like this came in, it may be worth ten minutes at your next gathering.
Treat every new or changed instruction as high risk. Require a second person to approve significant transfers and build in a delay for unusual requests. A brief pause can expose inconsistencies that urgency is meant to obscure.
Set the protocol with clients and opposing counsel before funds are due. Tell them how your firm will confirm instructions, and that a change sent by email alone will not be accepted. ABA guidance likewise recommends independent verification of every wire request.
Make the process work for a solo or mobile practice. For example, don’t approve trust-account wires from a phone, and don’t let one person both initiate and approve a sensitive transfer.
If a wire has gone out, call the sending bank immediately and request a recall or freeze, then report the incident to the FBI’s Internet Crime Complaint Center. Preserve the emails, headers, messages, and call details. The FBI says speed matters in its recovery process.
Do not wait until a wire fraud loss to find out whether your insurance responds. If your firm handles real estate closings or regularly holds/wires funds for clients or third parties and you do not have a cyber liability policy, contact AIM today as we can obtain a policy for you from the top markets writing cyber liability insurance.
AI doesn’t change a lawyer’s underlying professional duties. Confidentiality, competence, and supervision obligations still apply; the ABA’s guidance emphasizes reasonable safeguards and independent verification. Specific obligations and trust-account rules depend on the jurisdiction.
