Business Email Compromise and Wire Fraud at Professional Firms: How It Happens and How to Stop It

Rule versions and reports described: Idaho Rules of Professional Conduct 1.1 Comment [8], 1.4, 1.6(c), 1.15 and 5.3 (Idaho State Bar text current as of March 9, 2026, read Oct. 28, 2026); Idaho Bar Commission Rules Section XIII (Trust Accounts) and Section VI (Client Assistance Fund) (current as of March 9, 2026); Idaho Code 28-4-610 (Idaho's version of UCC Article 4A, section 4A-202, added 1991) and Idaho Code 28-51-104 to 28-51-107 (breach notice), read Oct. 28, 2026; FTC Safeguards Rule, 16 CFR 314.2(m) and 314.4(j) (notification requirement effective May 13, 2024); FBI Internet Crime Complaint Center annual reports for 2019, 2021, 2024 and 2025 (the 2025 report was released in April 2026); FBI public service announcements I-091124-PSA (Sept. 11, 2024), I-100824-PSA (Oct. 8, 2024) and I-120324-PSA (Dec. 3, 2024); FinCEN advisories FIN-2016-A003 and FIN-2019-A005; Verizon 2025 Data Breach Investigations Report; Google and Yahoo bulk sender rules in force since February 2024; SPF (RFC 7208), DKIM (RFC 6376) and DMARC (RFC 9989, published May 19, 2026, which replaced RFC 7489). Every figure is labeled with its report year. Rules, reports and bank practices change; check the regulator's current text and your bank's current agreement before relying on any point.

A paralegal at a small firm opens an email from the title company on a Thursday afternoon. The closing is Friday. The message is in the same thread as the last ten, uses the escrow officer's name and signature block, and says the title company's bank is being audited, so the seller's proceeds should go to a new account. A PDF with the new routing and account numbers is attached. The tone is polite and a little hurried. Nothing in it looks wrong.

That is the whole crime, and it costs professional firms and their clients billions of dollars a year. No malware needs to run on the paralegal's computer. No vault is cracked. Someone read the thread, waited for the right moment, and changed one number. The defense is just as plain: a firm rule that nobody sends money to new or changed bank details until a person at the firm calls the escrow officer at the number the firm already had and hears her confirm it, and a second person signs off.

This lesson is about that crime and the controls that stop it, written for lawyers, paralegals and office managers, CPAs, enrolled agents, tax preparers and bookkeepers, financial advisers, insurance agents, engineers, architects and consultants, the IT providers who serve them, and the clients who send them money. It is the longest lesson in the module because this is where most of the money is lost. It describes how the frauds work only so staff can recognize them, and spends most of its length on prevention and response.

It builds on lessons elsewhere on this site that you may want first. For the general pattern behind scams aimed at any small business, the callback and dual-approval tools and a scam-by-scam table, see Scams Aimed at Businesses. For SPF, DKIM and DMARC setup and hidden forwarding rules in a small office, see Secure Email and Secure Browsing. For the scams that reach people at home, including fake checks and voice clones, see Common Scams Explained. For building a training program and the sign-in controls behind it, see People, Policies and Training and Identity, Access and Device Control. This lesson does not repeat those; it goes deeper on what is different when the business is a professional firm holding other people's money and trust.

Inside this module, the professional duties behind all of this are in lesson 1, Competence, Confidentiality and Supervision; trust and escrow account rules are in lesson 3, Trust Accounts and Client Money; the Safeguards Rule and IRS duties of tax and accounting firms are in lesson 4; and incident response plans and breach notice are in lesson 5.

The numbers: what the FBI and others count

Most public numbers on BEC come from the FBI's Internet Crime Complaint Center (IC3), which takes complaints from victims at ic3.gov and publishes an annual report. Two cautions apply to every IC3 figure. First, the numbers count only what victims chose to report, so they are a floor, not a census. Second, IC3 reports "adjusted" losses after its analysts review complaints, so a figure in one year's report can differ slightly from the same year as shown in a later report. This lesson labels each figure with the report it came from.

The IC3 2025 report (released April 2026)

The FBI's Internet Crime Report 2025 counted 1,008,597 complaints and $20.877 billion in reported losses, a 26 percent increase in losses from 2024, with an average loss of $20,699. IC3 now receives "almost 3,000 complaints per day."¹

• BEC in 2025: 24,768 complaints and $3,046,598,558 in losses. Only investment fraud ($8,648,617,756) caused more reported loss.¹
• How the money moved: in the report's chart of the ways BEC complainants reported losing money, wire transfer or ACH made up 86 percent.¹ BEC is a bank-transfer crime, which is why bank-side controls matter so much later in this lesson.
• Real estate fraud, a separate IC3 category that overlaps with closing scams, drew 12,368 complaints and $275,110,419 in losses in 2025.¹
• Older victims: complainants age 60 and over reported 4,566 BEC complaints and $568,048,472 in BEC losses in 2025, according to the report's table of crime types reported by people 60 and over.¹ Retired clients selling a house or receiving an estate distribution are a real target group for professional firms.
• Artificial intelligence: IC3 tagged 22,364 complaints in 2025 as "AI Related," with adjusted losses of $893,346,472 across all crime types. On BEC specifically, the report says chat tools can "quickly create official-sounding emails mimicking a company's CEO" and that voice cloning can be used to request wire payments, and that "In 2025, businesses reported losses over $30 million to BEC scams involving AI."¹

IC3 defines BEC as "a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments," carried out "by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques."¹ Note that the definition is no longer limited to email. A call, a text or a video meeting can be the channel.

A simple division puts the 2025 average at about $123,005 per BEC complaint ($3,046,598,558 divided by 24,768). That is our arithmetic, not an IC3 figure, and an average is pulled up by a few very large losses. The typical case is smaller, as the Verizon figure below shows, but still large enough to wipe out a small firm's operating account or a family's home equity.

The IC3 2024 report and the trend

The IC3 report for 2024 (released April 2025) counted 859,532 complaints and $16.6 billion in losses, "a 33 percent increase from 2023," with an average reported loss of $19,372. BEC drew 21,442 complaints and $2,770,151,146 in losses. The same report showed BEC at 21,489 complaints and $2,946,830,270 for 2023, and 21,832 complaints and $2,742,354,049 for 2022.³ Real estate fraud losses in that report were $173,586,820 for 2024, $145,243,348 for 2023 and $396,932,821 for 2022.³

Going further back, the IC3 report for 2021 listed BEC losses of $2,395,953,296 for 2021, $1,866,642,107 for 2020 and $1,776,549,688 for 2019, with 19,954 BEC complaints in 2021.⁴ The 2019 report itself gave the same $1,776,549,688 figure and 23,775 complaints for 2019.⁵ Put together, reported BEC losses grew from about $1.78 billion in 2019 to about $3.05 billion in 2025, while the number of complaints stayed in a band of roughly 20,000 to 25,000 a year. Fewer people are not being fooled; the average theft is getting bigger.

The FBI's "$55 Billion Scam" warning

Every year or so the FBI publishes a public service announcement that totals BEC losses across all the years it has tracked. The September 11, 2024 edition, "Business Email Compromise: The $55 Billion Scam" (Alert Number I-091124-PSA), counted an exposed dollar loss of $55,499,915,582 in 305,033 domestic and international incidents between October 2013 and December 2023. For the United States alone it counted 158,436 victims and $20,089,561,364 in exposed loss.⁶ "Exposed" loss in these PSAs includes attempted and actual losses, so it is larger than the annual report figures and should not be added to them. Earlier editions carried the titles "The $50 Billion Scam" (June 9, 2023) and "The $43 Billion Scam" (May 4, 2022).⁷⁸

The PSA's defensive tips are worth posting near every person who touches payments: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information"; "Verify the email address used to send emails, especially when using a mobile or handheld device"; "Be alert to hyperlinks that may contain misspellings of the actual domain name"; and "Refrain from supplying login credentials or personal identifiable information (PII) of any sort via email."⁶

The Verizon 2025 Data Breach Investigations Report

Verizon's annual Data Breach Investigations Report (DBIR) is built from breach and incident data from many contributors. The 2025 edition covers incidents from November 1, 2023 to October 31, 2024. It found that the human element, such as a person clicking a link, being tricked or making an error, was involved in about 60 percent of breaches, and that breaches involving a third party doubled from 15 percent to 30 percent.⁹

On BEC, the DBIR says "the median amount of money extracted from victims has become relatively consistent and has settled around the $50,000 mark," based on about 19,000 complaints, and that wire transfers made up "approximately 88% of all BEC proceeds."⁹ The median is the middle case: half of victims lost more, half less. For a solo practice or a three-person tax office, a $50,000 loss is a payroll, a quarter's rent, or a client's down payment.

One caution: the DBIR also says that "In 2024 alone, according to the FBI IC3, more than $6.3 billion was transferred as part of these scams."⁹ That figure does not match the IC3 annual report's 2024 BEC loss of $2,770,151,146 and appears to measure something different, perhaps including transfers handled through the Recovery Asset Team or international data. Use the IC3 annual report number as the official count.

FinCEN advisories and the Rapid Response Program

The Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that collects suspicious activity reports (SARs) from banks, has warned financial institutions about this fraud since 2016. Its first advisory, FIN-2016-A003, "Advisory to Financial Institutions on E-mail Compromise Fraud Schemes," was issued September 6, 2016.¹⁰ Its updated advisory, FIN-2019-A005, "Updated Advisory on Email Compromise Fraud Schemes Targeting Vulnerable Business Processes," issued July 16, 2019, reported "over $9 billion in possible losses affecting U.S. financial institutions and their customers since 2016," and growth from "just under 500 reports per month (averaging $110 million monthly ...) in 2016 to over 1,100 monthly reports (averaging over $300 million monthly ...) in 2018."¹¹ The 2019 advisory asked banks to use the terms "BEC FRAUD" and "EAC FRAUD" (email account compromise) in their SARs, and it found manufacturing and construction the most targeted sector, at 25 percent of BEC cases.¹¹

The 2019 advisory's title names the real weakness: "vulnerable business processes." BEC does not mainly exploit software. It exploits a process that lets one person change where money goes based on one message. That is a finding a professional firm can act on without buying anything.

FinCEN also runs the Rapid Response Program (RRP), which works with the FBI and foreign financial intelligence units to try to freeze money sent overseas. A February 11, 2022 FinCEN fact sheet (FIN-2022-FCT1) said: "Since the RRP's inception in 2015, the program has facilitated the recovery of more than $1.1 billion for U.S. victims."¹² Victims do not usually contact FinCEN directly; the path into the program runs through a complaint to the FBI and the victim's bank, which is why the first-hour steps later in this lesson start there.

Idaho in the IC3 numbers

In the IC3 report for 2025, Idaho residents filed 4,479 complaints (37th among the states and territories by count) and reported $88,725,284 in losses (38th).¹ In the report for 2024, Idaho had 3,081 complaints (38th) and $63,035,342 in losses.³ That is a rise of about 45 percent in complaints and about 41 percent in losses in one year, by our arithmetic from the two reports. IC3's state tables cover all internet crime, not BEC alone, and this lesson does not have a verified Idaho BEC-only figure for 2025.

Idaho's professional community sees the same schemes. The Idaho State Bar's scam alerts page has warned members about phishing that impersonated the bar's executive director (December 2, 2025), phishing impersonating bar staff asking members to confirm "preferences for secure communications" (June 24, 2025), an email posing "as a District Bar Officer requesting money" (May 14, 2025), and, most directly on point, an April 22, 2024 alert that "scammers are sending Dropbox links via email with the eventual goal of getting wire transfers for settlement funds."¹³

How BEC works, described for recognition

This section describes the schemes the way the FBI, FinCEN and the IRS describe them in their public warnings, so that staff can spot them. It gives no instructions for carrying them out. IC3's 2019 report summarized how the crime has changed: in 2013 the scams "routinely began with the hacking or spoofing of the email accounts of chief executive officers or chief financial officers," and over the years they "evolved to include compromise of personal emails, compromise of vendor emails, spoofed lawyer email accounts, requests for W-2 information, the targeting of the real estate sector, and fraudulent requests for large amounts of gift cards."⁵ By 2021, IC3 reported that criminals were also using virtual meeting platforms and "deep fake" audio to pose as executives.⁴ Every variety below is still in use.

Two roads in: account takeover and impersonation

Almost every BEC begins one of two ways, and the difference matters for both prevention and response.

Account takeover (FinCEN's "email account compromise") means the criminal has the real password, or a stolen sign-in session, for a real mailbox: the firm's, a client's, a title company's, a vendor's. Messages then come from the genuine address, in the genuine thread, with the genuine signature. Spam filters and sender checks pass them because they are, technically, real. The usual way in is a credential phishing page like the one in the photo above, a password reused from another breached site, or a fake sign-in page that also captures the one-time code. The IRS has warned tax professionals about exactly this: in its "new client" warning, a scammer posing as a prospective client sends a malicious link or attachment, and may get "the preparer's email address, password and possibly other information," then "use that tax professional's hacked email account to target clients."¹⁴

Impersonation means the criminal has no access to anyone's mailbox and instead pretends. Three common forms:

• Display name spoofing: the sender's name shows as "Maria Lopez, Title Officer," but the address behind it is a free webmail account. On a phone, many mail apps show only the name, which is why the FBI's tip says to verify the address "especially when using a mobile or handheld device."⁶
• Look-alike domains: the criminal registers a domain one character off from the real one, swapping a letter, adding a hyphen, changing ".com" to ".co," or using a letter that looks like another (a capital I for a lowercase l). The FBI's tip to watch for "hyperlinks that may contain misspellings of the actual domain name" applies to sender addresses too.⁶
• Direct spoofing of the real domain in the From line. This is the form that SPF, DKIM and DMARC, covered below, are designed to stop, and it works only when the real domain's owner has not set a DMARC policy that tells receivers to reject failures.

Account takeover is the more dangerous of the two because the messages are real and the thread history is real. It also creates a second problem impersonation does not: the criminal could read everything in that mailbox, which can make it a data breach as well as a fraud (see the first-week steps below and lesson 5).

The quiet watcher: forwarding and inbox rules

Once inside a mailbox, criminals often set up rules so they can watch without being noticed. The Sixth Circuit's opinion in Beau Townsend Ford Lincoln v. Don Hinds Ford describes a hacker who controlled a car dealership sales manager's email with forwarding rules and then sent fake wire instructions; the buyer wired $736,225 to a Texas account and the money vanished.² The rules are the tell, and they are something an administrator can find and alert on.

Microsoft's documentation for its cloud email describes the two ways mail can be forwarded automatically: users can set up inbox rules that forward messages outside the organization "deliberately or as a result of a compromised account," and administrators can configure mailbox forwarding (also called SMTP forwarding).¹⁵ Other patterns investigators look for after a takeover, described here so staff and IT providers recognize them:

• A rule that forwards copies of all mail, or mail containing words like "invoice," "wire," "closing" or "payment," to an outside address.
• A rule that moves replies from a particular client or vendor into an obscure folder such as RSS Feeds, Archive or Conversation History, or marks them read, so the real account holder never sees the victim's "did you get my payment?" email.
• A rule that deletes bounce messages or security alerts.
• New sign-ins from an unfamiliar country, a hosting provider, or two places at once, and new devices or apps registered to the account.

The payment-instruction change

The most common BEC at professional firms is a change of payment instructions. The criminal waits for a payment that is already expected, then sends a message, apparently from the party who will receive the money, giving new bank details. Typical stories: the bank is being audited, the old account is frozen, the company changed banks at year-end, "our accountant asked us to use our other account," or "please use the attached updated wire letter." The new instructions often come with urgency (the deal closes today) and a request to reply only by email because the sender is "in meetings." The infographic below traces a typical case and marks where each control could have stopped it.

Two points about the switch help staff resist it. First, a legitimate business almost never changes its bank account in the last days before a closing or a large payment, and when it does, it expects you to call. Second, the request to keep things in email is itself the warning sign: a criminal who controls a mailbox cannot answer the real person's desk phone.

Fake new clients and counterfeit checks

Some schemes do not imitate anyone the firm already knows. Instead the criminal becomes a client. On October 8, 2024, the FBI issued a public service announcement aimed at law firms, "Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme" (I-100824-PSA). In the scheme, a fake creditor hires a firm to collect a debt, a fake debtor quickly "pays" with a counterfeit cashier's check, and the firm is asked to wire the money, minus its fee, out of its trust account before the check is discovered to be bad. The FBI's advice: "Be suspicious of requests or pressure to take action quickly," hold funds until the check fully clears, verify by phone, call the bank at once to recall a wire, and report to ic3.gov.¹⁶

The American Bar Association's Formal Opinion 515 (March 5, 2025) uses the same scheme as an example: a collections "client" in which both the supposed creditor and the supposed debtor are fake parties whose aim is to get lawyers to deposit fraudulent checks into their client trust accounts and then wire out funds. The opinion concludes that a lawyer who is the victim of a crime by a client or prospective client may disclose information to the appropriate authority to seek an investigation, and notes that a scammer with no intent to form a real client relationship was owed no duty at all.¹⁷ For Idaho firms, the trust account consequences are serious: under Idaho Bar Commission Rule 1307, the bank must report to the bar's disciplinary office any properly payable instrument presented against a trust account with insufficient funds, and a counterfeit check that drains the account can trigger that report automatically.¹⁸ Lesson 3 covers the trust account rules in detail.

Warning signs that appear again and again in these schemes: a new client found you online with no referral, is located overseas or far away, wants to move fast, pays a retainer or settlement by cashier's check or a check larger than expected, and asks for the excess or the net to be wired, often to a third country. Accounting and tax firms see a version of the same thing: the IRS "Dirty Dozen" list for 2026 (IR-2026-30, March 5, 2026) warns that tax professionals "remain targets of 'new client' or 'document request' emails," with warning signs including "mismatched or unfamiliar sender addresses," unexpected requests for sensitive data and urgent payment demands.¹⁹

Payroll diversion

IC3 described this scheme in its 2019 report: "a company's human resources or payroll department receives an email appearing to be from an employee requesting to update their direct deposit information for the current pay period," and "The new direct deposit information generally routes to a pre-paid card account."⁵ Professional firms are hit twice: once as employers, and again if they run payroll for clients, as many accounting and bookkeeping firms do. A payroll provider that accepts a direct deposit change by email for a client's employee has handed a criminal that employee's paycheck. The control is the same as for vendors: a change to bank details is confirmed through a channel the requester did not choose, such as the employee confirming in person or through an authenticated payroll portal, and a confirmation notice goes to the old contact information so the real employee sees it.

Gift-card requests

The "are you at your desk?" message from a partner, managing shareholder or office manager asks a staff member to buy gift cards for clients or staff and send photos of the card numbers. IC3 has listed "fraudulent requests for large amounts of gift cards" among BEC variations since at least its 2019 report.⁵ It works in professional firms because junior staff are trained to do what senior people ask, quickly and without fuss. The fix is a standing statement from the top, repeated in training, that no one at the firm will ever ask for gift cards, wire transfers or bank changes by text or email without a live conversation. The general version of this scam is covered in Scams Aimed at Businesses.

Vendor impersonation and fake invoices

Firms pay vendors: court reporters, expert witnesses, software providers, IT companies, landlords, copier leases, process servers. A criminal who takes over a vendor's mailbox can send a real-looking invoice from the real address with a new remittance account. One who only imitates the vendor sends a "past due" invoice from a look-alike domain. FinCEN's 2019 advisory describes this as fraud aimed at "vulnerable business processes" such as supplier payment and invoice systems.¹¹ The protection is a vendor master file that only a designated person can change, and only after a callback to the vendor's number already on file.

Deepfake voice and video requests

Voice cloning and live video fakes are no longer hypothetical. The best documented case involved Arup, the British design and engineering firm. According to CNN's May 16, 2024 report, a finance worker in Arup's Hong Kong office first suspected a phishing email from the UK office asking for a secret transaction, then set his doubts aside after a video call with people who appeared to be the chief financial officer and other staff; Hong Kong police said they were all deepfake re-creations. He sent HK$200 million, about US$25.6 million, in 15 transactions. Arup told CNN "we can confirm that fake voices and images were used" and that "none of our internal systems were compromised."²⁰ Arup is an engineering and design firm: a professional services firm, like the readers of this module.

The FBI's December 3, 2024 PSA, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud" (I-120324-PSA), warns that criminals "generate videos for real time video chats with alleged company executives" and use AI-generated audio to impersonate people and ask for payments. Its advice applies directly to a firm: verify a caller by hanging up and calling a number you find yourself, and agree on a secret word or phrase in advance.²¹ The IC3 2025 report counted more than $30 million in BEC losses involving AI that businesses reported in 2025.¹ That is a small share of the $3.05 billion total, but it is the share most likely to grow, and it defeats one old piece of advice: "if you hear their voice, it's them." A voice is no longer proof. A callback to a number you already had still is.

Signs staff can spot

The moments criminals aim at in a professional firm

BEC is a crime of timing. A criminal who has been reading a mailbox does not send fake instructions at random; he waits until money is about to move and people are busy. Professional firms have predictable moments like that, and knowing them lets a firm put its strongest controls exactly where they are needed.

Real estate and settlement closings

Closings bring together several parties who mostly know each other by email: buyer, seller, two agents, a lender, a title or escrow company, and often a closing attorney. Large sums move on a fixed date, wiring instructions are routinely emailed, and everyone is in a hurry. IC3's separate real estate category recorded $275,110,419 in losses in 2025.¹ The Idaho State Bar's April 2024 alert about Dropbox links aimed at "getting wire transfers for settlement funds" shows the same pattern reaching litigation settlements.¹³

Two court decisions show how differently these cases can turn out for the firm in the middle. In Otto v. Catrow Law, PLLC (W. Va. 2020), buyers lost $266,069 after a scammer, using an email address different from their real estate agent's, sent fake instructions; the Supreme Court of Appeals of West Virginia affirmed summary judgment for the closing law firm because the buyers could not show it breached a duty.²² In McCabe v. Talero (N.Y. Sup. Ct. Queens County, March 31, 2025), the buyers' own attorney's email was hacked and they wired about $171,000 to an impostor; the court denied the buyers summary judgment, finding triable issues on whether the attorney should have warned them sooner and on the buyers' own negligence, since the firm's emails had told them to verify wire instructions by phone.²³ The warning in the firm's emails did not end the case, but it mattered. That is the reason for the client notice sample later in this lesson.

Tax season

From January to April, and again before the October extension deadline, tax and accounting firms handle a flood of new documents from clients and new clients, often by email and portal links. The IRS has warned that "cybercriminals pose as potential clients" with a malicious link or attachment they claim is their tax information.¹⁴ A takeover of a preparer's mailbox at that time gives a criminal client Social Security numbers, prior-year returns and bank account numbers for refunds, which can feed both refund fraud and BEC aimed at clients ("please send your balance due to our new account"). IRS news release IR-2024-180 (July 2, 2024) reported that, through the spring of 2024, the IRS liaison office for tax professionals "had received reports of nearly 200 tax professional data incidents" "potentially affecting up to 180,000 clients."²⁴ The IRS-specific duties of tax firms are in lesson 4.

Mergers, acquisitions and large transactions

Deal work combines large wires, confidential timing and many outside parties. The best-known intrusion into law firm deal email was about trading, not wire fraud: in December 2016 federal prosecutors in New York charged three men with using the "unlawfully obtained credentials" of law firm employees to reach law firm servers and take partners' emails about mergers, then trading on the information, with profits over $4 million. At least seven firms were targeted and two were infiltrated; attempts on the others came "on more than 100,000 occasions between March and September 2015." U.S. Attorney Preet Bharara told law firms "you are and will be targets of cyber hacking."²⁵ The lesson for BEC is the same: deal mailboxes are watched, and a closing wire on an acquisition is the largest single payment many firms ever handle. ABA Formal Opinion 477R (2017) names "mergers and acquisitions" among matters that may call for higher security.²⁶

Vendor payments, payroll and month-end

Any firm's own accounts payable is a target: invoices from experts, court reporters, software vendors and landlords; payroll changes before a pay date; quarter-end and year-end when bookkeepers are rushed. Accounting firms that pay bills or run payroll for clients carry this risk for every client at once, multiplied.

Client refunds, settlements and trust disbursements

Money flowing out of a firm to a client is attractive because the client is expected to supply bank details. A criminal in the client's mailbox (not the firm's) can send the firm "my new account" just before a settlement disbursement, an escrow refund or an unearned-retainer refund. Firms tend to treat client requests as trustworthy, and the client is often a person, not a business with an accounts payable department. The North Carolina State Bar's 2015 Formal Ethics Opinion 6 dealt with exactly this: a lawyer who wired trust funds on spoofed instructions without verifying "by calling seller at the phone number listed in Lawyer's file" was held professionally responsible to replace the money.²⁷ See the section on who bears the loss below and lesson 3.

Defenses in layers

No single control stops BEC. Multifactor sign-in does not help when the fraud comes from a look-alike domain. DMARC does nothing against a taken-over mailbox. Training fails on a tired Friday. A callback rule fails if someone skips it. The answer is layers, so that a criminal has to beat several in a row. The Idaho Rules of Professional Conduct frame this as a duty for lawyers: Rule 1.6(c) requires "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client," Comment [8] to Rule 1.1 makes understanding "the benefits and risks associated with relevant technology" part of competence, and Rule 5.3 requires reasonable measures to make sure staff and vendors act consistently with the lawyer's duties.²⁸ Comment [1] to Rule 1.15 says a lawyer "should hold property of others with the care required of a professional fiduciary."²⁸ For tax and accounting firms, the FTC Safeguards Rule's required safeguards include multifactor authentication "for any individual accessing any information system" (16 CFR 314.4(c)(5)) and security awareness training (314.4(e)), discussed in lesson 4.²⁹

Layer 1: phishing-resistant MFA and conditional access

Multifactor authentication (MFA) means signing in with something besides a password: a code, an app approval, a security key. It stops most password-only takeovers. But many forms can be phished: a fake sign-in page can ask for the code too and pass it along in real time. The joint "Phishing Guidance: Stopping the Attack Cycle at Phase One" from CISA, the NSA, the FBI and MS-ISAC (October 2023) says FIDO or PKI-based MFA is phishing resistant, and that where that is not possible, organizations should use number matching for push MFA.³⁰ FIDO is the standard behind hardware security keys and passkeys; the key or passkey checks the real website's address before it responds, so a look-alike sign-in page gets nothing useful.

For a professional firm, the practical order is: MFA on every email account with no exceptions for partners; phishing-resistant MFA (security keys or passkeys) first for the people who can move money or change payment details (the bookkeeper, the trust account signers, the office manager, the IT administrator); then everyone. Conditional access (a feature of business email platforms) adds rules about where and how sign-ins may happen, such as blocking sign-ins from countries where the firm has no staff, requiring a managed device for administrators, or requiring stronger MFA for risky sign-ins. How to choose among MFA types and when to use conditional access versus simpler security defaults is covered in Identity, Access and Device Control.

Turn off legacy authentication

Legacy (or "basic") authentication is an older way for mail programs to sign in by sending just a username and password, which skips MFA entirely. Microsoft explains that basic authentication "makes it easier for attackers to capture user credentials" and that enforcing MFA "isn't simple or, in some cases, possible when Basic authentication remains enabled." Microsoft began permanently disabling basic authentication in Exchange Online on October 1, 2022, and its documentation now says "Basic authentication is now disabled in all tenants." One exception remains: the same page says SMTP AUTH, used by devices and apps that send mail, is "currently available" with basic authentication, and Microsoft has announced that it will be turned off by default at the end of December 2026, with a final removal date to come later.³¹ Firms still running their own mail servers, using older hosted email, or connecting old scanners, copiers and practice management tools by plain username and password should ask their IT provider to find and close those paths, because a stolen password plus a legacy connection can still mean a takeover with no second factor.

Layer 2: alert on forwarding and inbox rules

Because hidden rules are how criminals watch, a firm should know the moment one is created. Microsoft's documentation says its outbound spam policy setting "Off - Forwarding is disabled" disables "any Inbox rules (users) or mailbox forwarding (admins) that redirect messages to external addresses," and its recommended settings for both standard and strict protection are to turn automatic external forwarding off.¹⁵ Other email platforms have similar controls. Ask your IT provider to confirm three things in writing:

1. Automatic forwarding to outside addresses is blocked for everyone, with named exceptions only.
2. Someone receives an alert whenever a user creates a forwarding rule or an inbox rule that moves, deletes or marks messages as read, and whenever forwarding is set on a mailbox.
3. Someone reviews unusual sign-in alerts (new country, impossible travel, new device registered) within one business day, and faster for anyone who can move money.

The small-office version of this, including how a non-technical user can look for hidden rules, is in Secure Email and Secure Browsing.

Layer 3: external-sender banners

An external-sender banner is a line that the mail system adds to the top of every message from outside the firm, such as "This message came from outside the firm. Be careful with links, attachments and payment requests." It helps against impersonation: an email that seems to be from the managing partner but carries the outside banner is a fake. It does not help when a client's or vendor's real mailbox has been taken over, because those messages are legitimately external anyway. Banners lose force when staff see them on every message, so some firms add a stronger warning only when the display name matches someone inside the firm or when the sender's domain was registered recently.

SPF, DKIM and DMARC in plain terms

These three standards let receiving mail systems check whether a message that claims to come from your domain really did. In plain terms:

• SPF (Sender Policy Framework, RFC 7208, April 2014) is a public list, published in your domain's DNS records, of the servers allowed to send email for your domain.³²
• DKIM (DomainKeys Identified Mail, RFC 6376, September 2011) adds a cryptographic signature to each message so the receiver can check it came from your domain's mail system and was not altered on the way.³³
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do when a message claiming your domain fails those checks: do nothing but report ("none"), send it to spam ("quarantine") or refuse it ("reject"), and it sends you reports showing who is sending mail in your name. The current standard is RFC 9989, published May 19, 2026, which replaced the original DMARC specification, RFC 7489.³⁴

The CISA, NSA, FBI and MS-ISAC guidance tells organizations to "Enable Domain-based Message Authentication, Reporting, and Conformance (DMARC) for received emails," notes that SPF and DKIM work with DMARC, and recommends setting DMARC to "reject" for the organization's own sent email.³⁰ For a professional firm, a DMARC policy of reject on its own domain means that criminals cannot easily send mail that appears, in the From line, to come exactly from the firm's real domain. That protects the firm's clients from spoofed "please pay to our new account" messages that look like they came from the firm.

What DMARC does not do is just as important. It does nothing about a look-alike domain (the criminal owns that domain and can set it up perfectly), and nothing about a taken-over mailbox (those messages are genuinely from the domain). It is one layer, not the answer.

Google and Yahoo sender rules since 2024

The largest consumer mail services now require some of this from senders, which pushed many firms to set it up. Google's rules say: "Starting February 1, 2024, all email senders who send email to Gmail accounts must" set up SPF or DKIM, have valid forward and reverse DNS, use TLS (encryption in transit) and keep spam rates "below 0.3%." Senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC, but Google says "Your DMARC enforcement policy can be set to none."³⁵ Yahoo said "Enforcement will begin in February 2024," requires DKIM keys of 1024 bits or longer, requires a working List-Unsubscribe for bulk promotional mail (an unsubscribe "not honored in 2 days" does not meet the requirement, with that enforcement beginning June 2024), and "strongly urges" a DMARC policy.³⁶

Notice what these rules do and do not require. A small firm that sends far fewer than 5,000 messages a day to Gmail is not required by Google to have DMARC at all, and even large senders may keep DMARC at "none," which only reports and does not block. Meeting the mail providers' rules keeps your newsletters out of spam folders; it does not by itself protect your clients from spoofing. Setting DMARC to reject is the step that does, and it should be done carefully, after reports show that every legitimate service sending in your name (practice management, billing, e-signature, marketing) passes SPF or DKIM. The step-by-step rollout is in Secure Email and Secure Browsing.

Layer 4: look-alike domain monitoring

Because DMARC cannot stop look-alike domains, firms should watch for them. Several commercial services, many email security products and some domain registrars will alert you when someone registers a domain close to yours, and some will also watch for close variants of your largest clients' and title companies' domains. A firm can also buy the two or three most obvious variants of its own name (the ".co" version, the hyphenated version) so they cannot be used against it. When a look-alike is found, the firm can warn staff and clients, block it in the mail filter, and ask the registrar to take it down as abusive. None of this is expensive compared with one lost wire.

Layer 5: the payment process

This is the layer that stops the most loss, because it works no matter how the criminal got in. It has three parts.

Callback verification on a known number. Before the firm sends money to a new payee, or to an existing payee at new bank details, someone at the firm calls the requester at a phone number the firm already had from an independent source: the engagement file, a signed contract, the vendor master file, the title company's published main line, a number confirmed at an in-person meeting. Never the number in the email, the signature block of the email, the attached letter, or a number given by the person who calls you. The call should reach a person the caller knows or can identify, and the caller should read back the account details from the request and ask the person to confirm them, rather than asking "is this right?" The FBI's PSA calls this using "secondary channels"; North Carolina's 2015 FEO 6 called calling "the phone number listed in Lawyer's file" a reasonable security measure that "could have prevented the theft."⁶²⁷

Dual approval. A second person, who did not receive the request, reviews the evidence of verification and approves the payment. In a two-person office this can be the owner and the bookkeeper; in a solo office it can be a standing arrangement with the bank to call back a second authorized signer before releasing any wire over a set amount. Dual approval defeats the single tired moment and the senior person who wants to skip the rule.

A cooling-off period for bank changes. A change to a vendor's or client's bank details does not take effect for a set time (for example, two business days), and a confirmation goes to the payee at its previous, known contact information. Real businesses can plan around a two-day delay. Criminals usually cannot, because the real party will notice.

A verification is only as good as its record. The person who calls writes down the date, time, number dialed, where that number came from, who answered and what was confirmed, and keeps it with the payment file. If a loss happens anyway, that record is the firm's best evidence that it acted reasonably. The decision tree below shows the logic in one picture; Scams Aimed at Businesses has scripts for the call itself.

Layer 6: bank controls

Banks offer business customers controls that sit outside the firm's email and computers entirely, so a criminal who controls a mailbox cannot turn them off. Names vary by bank; ask your treasury or business banking contact what is available on your operating and trust or escrow accounts:

• Positive pay: the firm sends the bank a list of checks it has issued; the bank flags any check that does not match by number, amount or payee before paying it. ACH positive pay does the same for electronic debits.
• Approved payee lists or templates: outgoing wires can go only to pre-approved beneficiaries; adding a new one requires a separate approval, sometimes a waiting period.
• ACH debit blocks and filters: no one can pull money from the account by ACH unless the firm has authorized that company in advance. Many firms put a full debit block on trust and escrow accounts.
• Dual control in online banking: one person creates a wire, a different person releases it, each with their own credentials and MFA.
• Out-of-band confirmation: the bank calls a designated person at a known number before releasing a wire above a set amount, or to a new beneficiary.
• Limits and alerts: per-wire and daily limits, and text or email alerts on any outgoing wire, so a fraudulent transfer is noticed in minutes, not at month-end.

Bank controls also connect to the law on who bears a loss. Idaho has adopted UCC Article 4A, the uniform law on wire transfers ("funds transfers"), as part of Title 28, chapter 4 of the Idaho Code. Idaho Code 28-4-610, which follows UCC 4A-202, says that if a bank and its customer agree on a security procedure to verify payment orders, an order the bank accepts in good faith and in compliance with a commercially reasonable procedure can be "effective as the order of the customer, whether or not authorized."³⁷ The practical meaning: if a criminal gets into your online banking and sends a wire that passes the agreed security procedure, the loss can fall on you, which is a reason to accept the strongest procedure your bank offers. And in the far more common BEC case, where your own staff member sends the wire after being fooled, the payment order is authorized by you, so the bank generally followed your instructions. That is one more reason the payment process layer above matters more than any other.

Layer 7: training staff with the real patterns

The CISA, NSA, FBI and MS-ISAC guidance recommends that organizations "require employees to review phishing training material annually."³⁰ Annual is the floor. What works better for BEC, in our view, is short, specific training built on the real cases: show staff the actual pattern of a payment-instruction change, the IC3 counterfeit check scheme, the Idaho State Bar's Dropbox alert, the Arup video call. Train the people who touch money more often and more deeply than everyone else. Practice the callback, so it feels routine rather than rude. And make reporting safe: the person who says "I think I clicked something" in the first five minutes is protecting the firm, and if they are punished, the next person will stay quiet. How to build a fair training and phishing simulation program is in People, Policies and Training.

Training also has a professional-duty side. ABA Formal Opinion 477R lists "Train Lawyers and Nonlawyer Assistants in Technology and Information Security" among its seven considerations for protecting client information, and Idaho Rule 5.3's comments say lawyers must instruct assistants "particularly regarding the obligation not to disclose information relating to representation of the client."²⁶²⁸ For tax and accounting firms, security awareness training is a required element of the FTC Safeguards Rule, 16 CFR 314.4(e).²⁹ In the ABA's 2023 Legal Technology Survey, only 34 percent of respondents reported that their firms had an incident response plan, with 19 percent of solos and of firms of 2 to 9 lawyers, as printed in the ABA's 2023 Cybersecurity TechReport.³⁸ That is a 2023 survey figure; no newer ABA cybersecurity TechReport was found.

Telling clients, in writing, before money moves

Clients are often the target, and they cannot follow a rule they do not know. Tell every client, in the engagement letter, in the first email about any transaction, in the email signature of anyone who handles money, and again a day or two before a closing or disbursement: the firm will never change its payment instructions by email, and the client should call the firm at a number they already have before sending money anywhere. The McCabe court treated the firm's written warnings as evidence on the buyers' own negligence.²³ The second sample below is wording a firm can adapt; engagement letter terms are covered in lesson 5.

When money has gone: the response playbook

Discovering a fraudulent wire is a moment of panic, and panic wastes time. The IC3 2025 report is blunt: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." It adds: "Different financial institutions have varying policies; it is important to know what assistance your financial institution will provide when attempting to recover funds," and "Regardless of the amount lost, file a complaint at www.ic3.gov. Be sure to include the full transaction details in your report."¹ Everything in this section follows from those three sentences. Decide now, before anything happens, who at the firm makes each call, and keep the bank's fraud line, your IT provider's emergency number and your insurer's claim line on paper, not only in the email system that may be compromised.

The first hour

1. Call your bank's fraud or wire department now. Not an email, not the branch's general line if a fraud line exists. Say that a wire (or ACH) was sent because of fraud and ask the bank to recall it and to contact the receiving bank immediately. Have ready: date, amount, the receiving bank, routing and account numbers, the wire reference number, and the name on the receiving account. Ask what indemnification or hold-harmless documents the bank needs and sign them quickly; the IC3 report mentions them for a reason.¹ Write down the name of every person you speak with and the time.
2. File a complaint at ic3.gov. Include the full transaction details: amount, date, sending and receiving banks, account numbers, and any second transfer you know about. IC3's Recovery Asset Team uses complaints to start the Financial Fraud Kill Chain with the receiving bank, and the report says it can expand requests to "second hop" transactions if that information is provided.¹
3. Contact the FBI. For Idaho, the FBI's Salt Lake City Field Office covers the state through resident agencies in Boise, Coeur d'Alene, Lewiston and Pocatello; the field office's listed phone is (801) 579-1400.³⁹ If the amount is large or the money went overseas, say so; international recalls go through the FBI and FinCEN's Rapid Response channel.¹¹²
4. Preserve the evidence before anyone cleans up. Do not delete the fraudulent messages. Save them with full headers (the technical routing information each mail program can show or export), keep the attachments, and ask your IT provider to preserve sign-in logs, audit logs and mailbox rule history for every affected account. Cloud email platforms keep these logs for limited periods, so preservation should start the same day. Screenshots alone are not enough.
5. Lock out the criminal. If the firm's mailbox may be compromised: reset the password, sign the account out of all sessions, remove unknown MFA methods and devices, and review app consents. Then check for and record, before removing, any forwarding settings and inbox rules on that mailbox and any others the person can access. Removing a rule without documenting it destroys evidence.
6. Warn the real parties by phone. Call the client, title company, vendor or other party whose instructions were faked, at a known number, so they stop any further payments and check their own mailbox. If it was their mailbox that was taken over, they need to know at once.
7. Stop further payments in the same matter or to the same account. Ask the bank to block the fraudulent beneficiary on all your accounts.

BEC first hour checklist (print this)

Keep this table, with names and numbers filled in, printed in the office and on paper at home for the people on it.

How the Financial Fraud Kill Chain works

The Financial Fraud Kill Chain (FFKC) is the FBI's process for asking banks to freeze money that victims sent because of fraud. IC3's Recovery Asset Team (RAT), "Established in 2018," "streamlines communications with financial institutions and FBI field offices to assist in the freezing of funds for victims of fraudulent domestic and international transactions." For domestic transfers, the RAT contacts the receiving bank and can follow "second hop" transactions to other accounts if the victim provides that information. For international transfers, it coordinates with FinCEN's Rapid Response Team, FBI legal attaché offices and foreign law enforcement.¹

The results, by report year:

• 2025: 3,900 incidents; $1,163,919,846 in attempted theft; $679,013,183 frozen; a "58% Success Rate." Domestic: 3,574 incidents and $507,042,623 frozen. International: 326 incidents and $171,970,560 frozen. IC3 noted that in the past most FFKC incidents were BEC, but in 2025 it saw a rise in tech support and account takeover cases.¹
• 2024: 3,020 complaints; $848.4 million in attempted theft; $469.1 million frozen domestically and $92.5 million internationally; a "66% Success Rate." "Most Financial Fraud Kill Chain incidents initiated by the IC3 RAT are Business Email Compromise (BEC)."³
• 2021: the RAT initiated the FFKC on 1,726 domestic BEC complaints with potential losses of $443,448,237 and placed holds on about $329 million, a 74 percent success rate.⁴

Read those success rates carefully. They measure the share of money frozen among cases the RAT took up, and "frozen" is not the same as returned to the victim. They say nothing about the many victims who reported too late or not at all. What they do show is that a prompt report makes recovery possible. IC3's reports say to act immediately; neither the 2024 nor the 2025 report text gives a fixed deadline after which the FFKC will not act, so do not wait to see whether a time limit applies to you. Every hour gives the criminal time to move the money again, and the 2025 report notes that account takeover cases can involve "upwards of 50 or more transactions to different recipient accounts at multiple banks happening simultaneously."¹

The first day

• Follow up with the bank in writing (from a clean account), confirming the recall request, and ask for the receiving bank's response.
• Scope the compromise. With your IT provider or a qualified incident response firm, find out how the criminal got in, which mailboxes were accessed, for how long, what rules were created, and what was read, sent or downloaded. Check every account that shares a password or device with the first one.
• Look for other pending payments the criminal may also have redirected, and contact every party in active transactions handled through the affected mailbox.
• Notify your insurer under the notice terms of your cyber and crime policies. Read the policy's notice and vendor terms now, before an incident; a missed notice step can put coverage at risk.
• For trust or escrow money, check the account balance and records right away. A shortfall in a lawyer trust account raises duties under Idaho Rule 1.15 and the Idaho Bar Commission Rules, covered in lesson 3.²⁸¹⁸
• Tax professionals: if client data may have been taken, the IRS says to contact the local IRS liaison office for tax professionals, which notifies IRS Criminal Investigation ("Speed is critical"), and to report to states through the Federation of Tax Administrators.⁴⁰ Details are in lesson 4.

The first week and after

A wire fraud that started with a mailbox takeover is often also a data breach, because the criminal could read everything in the mailbox: client names with Social Security numbers, tax returns, account numbers, medical records, privileged advice. That raises separate notice questions, each with its own rule:

• Clients, under professional rules. ABA Formal Opinion 483 (2018) says that when a data breach involves, or has a substantial likelihood of involving, material client information, lawyers have a duty to notify clients, grounded in Rule 1.4.⁴¹ Idaho's Rule 1.4 matches the ABA rule on this point. The duty to tell a client about a loss of the client's own money is even plainer.
• Idaho residents, under Idaho's breach law. Idaho Code 28-51-105 requires a business that owns or licenses computerized personal information of Idaho residents to investigate a breach "in good faith" and, if misuse "has occurred or is reasonably likely to occur," to notify affected residents "in the most expedient time possible and without unreasonable delay." Idaho's definition of personal information covers names combined with Social Security numbers, driver's license or Idaho ID numbers, or financial account numbers with any required access code.⁴²
• The FTC, for tax and accounting firms and others covered by the Safeguards Rule. If a "notification event" (acquisition of unencrypted customer information without authorization, 16 CFR 314.2(m)) involves at least 500 consumers, the firm must notify the FTC "as soon as possible, and no later than 30 days after discovery," under 16 CFR 314.4(j), in effect since May 13, 2024.²⁹⁴³

The full notice analysis, including other states' laws and contract terms, is in lesson 5. Within the week, also hold an honest review of what failed: which control was missing or skipped, and what will change. Then change it, and train on the case, with names removed, while it is fresh.

Who bears the loss

When a criminal gets the money and it cannot be recovered, the victims often turn on each other: buyer against seller, client against firm, firm against bank. The law here is still developing, varies by state, and turns on facts. A few decisions show the pattern. The trust account detail for lawyers is in lesson 3; this is a short overview.

"The party in the best position to prevent it"

In Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018), an unpublished decision, the seller's sales manager's email was controlled through forwarding rules, the buyer wired $736,225 to the criminal's account, and each dealership said the other should bear the loss. The Sixth Circuit reversed summary judgment and sent the case back, reasoning by analogy to the UCC's impostor rules (sections 3-404 and 3-406) and agency law that the loss should fall on "the party in the best position to prevent it." It noted the district court's finding that "both parties were negligent in their business practices" and left it to the factfinder to decide which "was in the best position to prevent the fraud."² The opinion did not decide the case under UCC Article 4A, and should not be described as doing so.

In Jetcrete North America LP v. Austin Truck & Equipment, Ltd., 484 F. Supp. 3d 915 (D. Nev. Sept. 3, 2020), after a bench trial the court entered judgment for the seller, applying the same best-position-to-prevent-the-fraud approach and placing the loss on the buyer that wired funds to the impostor without verifying them.⁴⁴ This lesson's summary of Jetcrete's detailed findings rests on secondary sources, because the full opinion was not read for this lesson. An older and often-cited federal case, Arrow Truck Sales, Inc. v. Top Quality Truck & Equipment, Inc. (M.D. Fla. 2015), is described in the Sixth Circuit's Beau Townsend opinion: hackers sent the buyer "updated" wiring instructions, and after a bench trial the court found the buyer's assistant manager "was in the better position to discover the fraudulent behavior" because conflicting emails with conflicting wire instructions should have prompted him to confirm, so the buyer bore the loss. The district court's own opinion was not read for this lesson.⁴⁵

What these cases share, put plainly: courts ask who could most cheaply have stopped the fraud. A written callback verification procedure, actually followed and recorded, is therefore both a security control and the firm's best evidence in any later dispute. Its absence is the other side's best exhibit.

Professional responsibility and malpractice

North Carolina's 2015 Formal Ethics Opinion 6 is the clearest bar opinion on point. A lawyer who managed the trust account properly and was the victim of a counterfeit check or hacking need not personally replace the funds. But in the inquiry about spoofed email changing wire instructions, the lawyer "did not verify the disbursement change by calling seller at the phone number listed in Lawyer's file"; "These were reasonable security measures that, if implemented, could have prevented the theft," and the lawyer "is, therefore, professionally responsible and must replace the funds stolen by Hacker."²⁷ It is not Idaho law, and the Idaho State Bar has issued no formal opinion on cybersecurity or wire fraud; Idaho's formal ethics opinions largely stopped in the 1990s.⁴⁶ But it is a well-reasoned model that a court or disciplinary body could find persuasive.

Malpractice results are mixed and fact-driven. The Otto and McCabe cases above went in different directions on summary judgment.²²²³ In a Connecticut case reported in March 2025 by the plaintiff's lawyers, McCarter & English, a judge found a law firm negligent after a bench trial for failing to secure its email system and not following its own policies after a similar earlier incident, and awarded $90,586 plus interest; the firm's name and the docket could not be confirmed for this lesson, and the case was later reported as appealed and resolved.⁴⁷ That last fact pattern is the warning: a firm that has been targeted once and does not change its process is in the weakest position of all.

Two more Idaho-specific points. The Idaho State Bar's Client Assistance Fund pays up to $25,000 per instance for losses caused by a lawyer's "Dishonest Conduct" (Idaho Bar Commission Rules 601 and 606); a loss caused by an outside criminal with no lawyer dishonesty does not appear to fit that definition, so clients should not count on the Fund for BEC losses. That is this lesson's reading of the rule text, not a ruling.⁴⁸ And trust accounts can be abused from the other direction: a Georgia lawyer was disbarred in 2024 in a matter in which an insurer, misled by emails from a compromised account, wired $3,093,085.50 into his IOLTA account, with facts deemed admitted by default including that he was "a knowing and intentional participant," according to copies of the Supreme Court of Georgia's decision on case-law websites; the court's own copy was not checked for this lesson.⁴⁹

For accounting and tax firms, no reported decision was found in the research for this module holding a CPA or tax firm liable to a client for a BEC loss caused by the firm's compromised email. That does not mean such claims are not made; many are settled or arbitrated without a public decision.

Common mistakes

Each of these comes from a documented case or official warning cited in this lesson.

• Calling the number in the email. A callback to the number in the fraudulent message reaches the criminal. North Carolina's FEO 6 turned on the lawyer not calling "the phone number listed in Lawyer's file."²⁷
• Trusting a thread because it is real. In account takeover cases, the fake instructions arrive in a genuine thread from a genuine address. The Beau Townsend fraud ran through the seller's real sales manager's email.²
• Disbursing on an uncleared check. The FBI's 2024 PSA to law firms describes firms wiring money out of trust before a counterfeit cashier's check bounced.¹⁶ "Available" funds are not the same as a check that has finally cleared and been confirmed by the issuing bank.
• Leaving outside auto-forwarding on. Hidden forwarding rules let criminals read along for weeks; Microsoft's recommended settings turn automatic external forwarding off.¹⁵
• Stopping at DMARC "none." Google allows large senders to keep a DMARC policy of "none,"³⁵ but "none" only reports; it does not stop spoofing of your domain. Firms that set it up for deliverability and never moved toward reject have not protected their clients.
• Deleting the evidence while fixing the account. Removing malicious rules and wiping messages before exporting them leaves the firm unable to tell what was read, which matters for notice duties under Idaho Code 28-51-105 and ABA Formal Opinion 483.⁴²⁴¹
• Waiting a day to call the bank. The IC3 report says "time is of the essence."¹ Firms lose recoverable money while they investigate whether the wire was really fraudulent.
• Not changing after the first attempt. In the Connecticut case reported in 2025, the court faulted the firm for not following its own policies after a similar earlier incident.⁴⁷
• No plan. Only 34 percent of respondents in the ABA's 2023 survey said their firms had an incident response plan, and 19 percent of solos and small firms of 2 to 9 lawyers.³⁸ A one-page BEC first hour checklist is a reasonable place for a small firm to start.

Questions people ask

What is the difference between BEC and phishing?

Phishing is a method: a message that tricks someone into clicking, signing in or opening something. BEC is a crime that often starts with phishing (to take over a mailbox) but ends with a payment or data request in a business conversation. Many BEC messages contain no link or attachment at all, which is why spam filters miss them. IC3 counts phishing and BEC as separate categories; in 2025, phishing and spoofing drew the most complaints (191,561) but far less reported loss ($215,843,126) than BEC.¹

Our email is on a major cloud service. Aren't we protected?

The provider protects its servers. Who can sign in to your mailboxes, whether MFA is enforced, whether forwarding rules are allowed and who watches the alerts are settings your firm or IT provider controls. Microsoft, for example, has turned off basic authentication for almost every Exchange Online connection,³¹ but the forwarding and alert settings described above are choices each organization makes. And no cloud provider can stop your bookkeeper from wiring money on a fake instruction.

Is a text message or phone call safer than email for payment instructions?

Only if you started the call to a number you already had. An inbound call, a text, or a voicemail can be spoofed or faked just like an email, and IC3's own definition of BEC now includes "phone numbers and virtual meeting applications."¹ The safety comes from the independent channel, not from the medium.

The client's mailbox was hacked, not ours. Is it our problem?

Often, yes. If the firm sends client money to a criminal on instructions from a hacked client mailbox without verifying, the firm may face claims and, for lawyers, trust account consequences; North Carolina's FEO 6 held the lawyer responsible in a similar situation.²⁷ If the client sends money to a criminal after a fake message that looked like it came from the firm, the client may argue the firm should have warned it or secured its systems, as in McCabe.²³ Verification and written client warnings protect both sides.

Will our insurance cover a BEC loss?

It depends entirely on the policy wording, and this lesson did not review specific policies. Firms should not assume that a cyber policy, a crime policy, or a professional liability policy covers a voluntary transfer that an employee made after being deceived. Ask your broker, in writing, which policy responds to (1) the firm's own money sent on fake instructions, (2) client or trust money sent on fake instructions, and (3) a client's claim that the firm caused its loss, and what limits, sublimits and verification conditions apply. Ask, too, whether any policy makes coverage depend on the firm having followed a verification procedure, and make sure your written procedure matches what the policy says.

We are a two-person office. How do we do dual approval?

Use the bank. Set online banking so one person initiates and the other releases, or ask the bank to call the second person at a known number before releasing any wire to a new beneficiary or above an amount you choose. A solo practitioner can ask the bank for out-of-band confirmation on every wire and use a cooling-off period for any change. The point of the second approver is a second moment of judgment, and the bank can provide it.

Should we stop emailing wire instructions altogether?

Many firms do: they deliver wire instructions only in person, through a secure client portal with MFA, or by reading them over the phone on a call the client initiates to the firm's main number. Even then, tell clients to confirm by phone before sending, because a criminal can still email them fake instructions that look like yours.

What should we tell a client who just lost money in a closing or settlement?

Tell them to call their own bank's fraud line immediately and request a recall, to file at ic3.gov with full transaction details, and to contact the FBI; then help with the facts you have, such as the real instructions and the fraudulent ones. Preserve your own records of every message in the transaction. If the fraud came through your firm's mailbox, your notice and response duties begin too (see lesson 5).

If voices can be faked, does the callback still work?

Yes, because the callback goes to a number you chose from your own records. A criminal can fake a voice on an incoming call; it is much harder to answer the real person's known phone line. Adding a code phrase for requests from firm leaders, as the FBI suggests for families, gives one more check.²¹

Hard questions

Who should bear a wire fraud loss between two innocent parties?

The case for the party that sent the money: it held the money, it could have picked up the phone, and verification is cheap. If senders bear the loss, they have the strongest reason to verify, which is where verification is easiest. Courts applying the "best position to prevent it" approach have often landed here when the sender skipped a call.⁴⁴

The case for the party whose email was compromised: the fraud ran through its system, it was in the best position to secure its own mailbox, and the sender had no way to know the real thread was poisoned. Putting the loss there rewards MFA, rule alerts and monitoring.

What the evidence shows: the leading decisions do not adopt a fixed rule. The Sixth Circuit in Beau Townsend found both parties negligent and sent the question of who was best placed to prevent the fraud back to the factfinder.² The practical result is that both sides should act as if the loss might land on them: secure your mailbox and verify every payment change.

Should banks carry more of the loss?

The case for more bank responsibility: banks see patterns no single customer can, such as a new account receiving large wires and moving them out within hours, and the receiving bank opened the mule account. A federal district court in Virginia accepted a version of this argument in Studco Building Systems v. 1st Advantage Federal Credit Union (E.D. Va. 2023), holding the receiving credit union liable under Article 4A for a loss of more than $550,000. But the Fourth Circuit reversed on March 26, 2025, holding that a receiving bank is not liable for a mismatch between the beneficiary's name and account number unless it had actual knowledge of the mismatch, and the U.S. Supreme Court declined review on October 6, 2025. That account comes from banking press and law firm reports, not the opinions themselves.

The case against: when a customer authorizes a wire, the bank did what it was told. Shifting losses to banks could raise costs for everyone, slow payments, and reduce customers' incentive to verify. Under Idaho Code 28-4-610, the law already protects a bank that follows an agreed, commercially reasonable security procedure.³⁷

What the evidence shows: the Financial Fraud Kill Chain shows that banks can freeze large sums when told quickly: $679,013,183 in 2025.¹ That supports both views: banks can help a great deal, but only if victims report immediately. For U.S. business accounts, the main loss-shifting rules today remain contract terms and UCC Article 4A, not a general bank liability rule.

Should bars and boards require cybersecurity training?

The case for: BEC losses are enormous and growing, the people who handle client money are professionals with licenses, and a short required course would reach the small firms that do least. Idaho requires three ethics credits every three years but no technology or cybersecurity credit.⁵⁰

The case against: required credits often become box-checking, technology changes faster than course approvals, and the Rules already require competence, including "the benefits and risks associated with relevant technology" (Idaho Rule 1.1, Comment [8]).²⁸ Firms that ignore the duty will not change because of one more hour of video.

What the evidence shows: evidence that mandatory continuing education reduces fraud losses is thin. What the documented cases consistently show is that the losses happen where a firm had no written verification step, or did not follow the one it had. Training aimed at the people who move money, built on real patterns, is likely to matter more than a general credit requirement.

Are callbacks and holds too much friction for clients?

The case that they are: clients want speed; closings slip when a callback cannot reach someone; a two-day hold on bank changes can annoy vendors; small firms have no spare staff.

The case that they are not: a callback takes minutes; the Verizon 2025 DBIR puts the median BEC theft at about $50,000;⁹ and the firm that explains the rule up front, in the engagement letter, usually finds clients grateful rather than annoyed.

What the evidence shows: the cost of friction is measured in minutes or a day; the cost of a single loss, in a firm's reputation, insurance, possible discipline and client relationships, is far higher. Firms can reduce friction by collecting verified phone numbers at engagement and by telling clients early, so the call is expected.

Where to go next

• FBI Internet Crime Complaint Center (IC3): Where to file a complaint after a fraudulent wire or attempted BEC, and where the annual reports and public service announcements are posted. Free. File immediately with full transaction details; reading the latest PSAs a few times a year keeps training current.
• FBI Salt Lake City Field Office: The FBI office that covers Idaho through resident agencies in Boise, Coeur d'Alene, Lewiston and Pocatello. Free. Put the number on your printed BEC first hour checklist.
• FBI PSA: Business Email Compromise, The $55 Billion Scam (Sept. 11, 2024): Short official summary of BEC trends and the FBI's prevention tips. Free. Good handout for staff who handle payments.
• CISA, NSA, FBI and MS-ISAC Phishing Guidance (October 2023): Government guidance on stopping phishing, including DMARC, phishing-resistant MFA and training. Free PDF. Give it to your IT provider and ask which recommendations are in place.
• IRS Taxes-Security-Together Checklist: The IRS checklist for tax professionals, including phishing awareness and a data theft recovery plan. Free. Use it alongside IRS Publication 4557 and Publication 5708.
• Microsoft: Control automatic external email forwarding: Official documentation for blocking outside auto-forwarding in Microsoft 365 email. Free. For the firm's IT provider; firms on other platforms should ask for the equivalent setting.
• Idaho State Bar scam alerts: The bar's running list of scams aimed at Idaho lawyers, including settlement-fund wire schemes. Free. Check it monthly and share new alerts with staff.

Still being checked (11 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The detailed findings in Jetcrete North America LP v. Austin Truck & Equipment (D. Nev. 2020) were summarized from secondary sources; only the case header was confirmed.
• Studco Building Systems v. 1st Advantage Federal Credit Union: the district court holding, the Fourth Circuit reversal (March 26, 2025) and the Supreme Court's denial of review (Oct. 6, 2025) come from banking press and law firm reports, not the opinions.
• The Connecticut malpractice case reported by McCarter & English in March 2025: the defendant firm's name, docket number and final resolution were not confirmed.
• In the Matter of James W. Davis, III (Ga. 2024) was read only in a copy on a case-law aggregator, not on the Supreme Court of Georgia's site.
• No Idaho-specific BEC-only complaint or loss figure for 2025 was found; the Idaho figures in this lesson cover all internet crime reported to IC3.
• The Verizon 2025 DBIR's statement that more than $6.3 billion was transferred in BEC scams in 2024 does not match the IC3 annual BEC figure; what it measures was not confirmed.
• How much of the money frozen through the Financial Fraud Kill Chain was later returned to victims is not stated in the IC3 reports read.
• No specific cyber, crime or professional liability insurance policy wording was reviewed; coverage statements are general.
• No Idaho discipline decision involving trust account wire fraud by impostors was found; that does not prove none exists.
• Arrow Truck Sales v. Top Quality Truck & Equipment (M.D. Fla. 2015) is described from the Sixth Circuit's account in Beau Townsend; the district court opinion itself was not read.
• Microsoft's end-of-December-2026 default shutoff of basic authentication for SMTP AUTH comes from a secondary report of Microsoft's January 2026 announcement.

Last verified October 28, 2026. General education, not legal, ethics, accounting or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), Internet Crime Report 2025 (released April 2026): overall totals; crime types by complaint count and loss (BEC 24,768 complaints, $3,046,598,558); top reported transaction types (wire transfer or ACH 86 percent in the BEC chart of how complainants reported losing money); real estate; crime types reported by complainants 60 and over; the "AI Related" descriptor and AI section; "IC3 Recovery Asset Team - Financial Fraud Kill Chain in 2025"; state tables (Idaho 4,479 complaints, $88,725,284); Appendix B definition of BEC (read Oct. 28, 2026). Read it online. ↩
2. Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018) (not recommended for full-text publication), opinion by Judge Siler. Secondary sources give the reporter citation 759 F. App'x 348 (read Oct. 28, 2026). Read it online. ↩
3. FBI IC3, Internet Crime Report 2024 (released April 2025): totals; BEC and real estate figures for 2022, 2023 and 2024; Recovery Asset Team results (66 percent success rate); state tables (Idaho 3,081 complaints, $63,035,342) (read Oct. 28, 2026). Read it online. ↩
4. FBI IC3, Internet Crime Report 2021: BEC threat overview (19,954 complaints); three-year loss comparison table showing BEC/EAC losses of $2,395,953,296 (2021), $1,866,642,107 (2020) and $1,776,549,688 (2019); Recovery Asset Team results for 2021 (1,726 complaints, about $329 million held, 74 percent) (read Oct. 28, 2026). Read it online. ↩
5. FBI IC3, 2019 Internet Crime Report: "Hot Topics for 2019: Business Email Compromise" (23,775 complaints, evolution of the scheme, payroll diversion); crime type loss table (BEC/EAC $1,776,549,688); Recovery Asset Team established February 2018 (read Oct. 28, 2026). Read it online. ↩
6. FBI IC3, Public Service Announcement I-091124-PSA, "Business Email Compromise: The $55 Billion Scam" (Sept. 11, 2024) (read Oct. 28, 2026). Read it online. ↩
7. FBI IC3, Public Service Announcement, "Business Email Compromise: The $50 Billion Scam" (June 9, 2023). Title, date and figures checked (read Oct. 28, 2026). Read it online. ↩
8. FBI IC3, Public Service Announcement, "Business Email Compromise: The $43 Billion Scam" (May 4, 2022). Title, date and figures checked (read Oct. 28, 2026). Read it online. ↩
9. Verizon, 2025 Data Breach Investigations Report (incident data Nov. 1, 2023 to Oct. 31, 2024): human element, third-party involvement, BEC median and wire share, and the $6.3 billion statement attributed to IC3 (read Oct. 28, 2026). Read it online. ↩
10. Financial Crimes Enforcement Network (FinCEN), FIN-2016-A003, "Advisory to Financial Institutions on E-mail Compromise Fraud Schemes" (Sept. 6, 2016); title and date confirmed through citations in FIN-2019-A005 and FIN-2022-FCT1 (read Oct. 28, 2026). Read it online. ↩
11. FinCEN, FIN-2019-A005, "Updated Advisory on Email Compromise Fraud Schemes Targeting Vulnerable Business Processes" (July 16, 2019) (read Oct. 28, 2026). Read it online. ↩
12. FinCEN, FIN-2022-FCT1, Rapid Response Program fact sheet (Feb. 11, 2022) (read Oct. 28, 2026). Read it online. ↩
13. Idaho State Bar, Scam Alert posts dated April 7, 2023; April 22, 2024; July 8, 2024; May 14, 2025; June 24, 2025; and Dec. 2, 2025 (read Oct. 28, 2026). Read it online. ↩
14. Internal Revenue Service, Tax Tip 2024-06, "Tax professionals: Watch out for new client email scam" (Feb. 13, 2024) (read Oct. 28, 2026). Read it online. ↩
15. Microsoft Learn, "Control automatic external email forwarding from cloud mailboxes" and "Recommended email and collaboration threat policy settings for cloud organizations" (Microsoft Defender for Office 365 documentation) (read Oct. 28, 2026). Read it online. ↩
16. FBI IC3, Public Service Announcement I-100824-PSA, "Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme" (Oct. 8, 2024) (read Oct. 28, 2026). Read it online. ↩
17. American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 515, "A Lawyer's Discretion to Report When a Client Commits a Crime Against the Lawyer or Against Someone Associated with, or Related to, the Lawyer" (March 5, 2025). Link is to the ABA's announcement; short quotations only (read Oct. 28, 2026). Read it online. ↩
18. Idaho Bar Commission Rules, Section XIII, Trust Accounts, Rules 1301 to 1309, including Rule 1307 (overdraft notice to Bar Counsel) and Rule 1308 (current as of March 9, 2026) (read Oct. 28, 2026). Read it online. ↩
19. IRS, IR-2026-30, "Dirty Dozen tax scams for 2026" (March 5, 2026), item 11, "Spear-phishing and malware campaigns targeting tax professionals" (read Oct. 28, 2026). Read it online. ↩
20. CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim" (May 16, 2024), reporting Arup's confirmation and Hong Kong police statements (read Oct. 28, 2026). Read it online. ↩
21. FBI IC3, Public Service Announcement I-120324-PSA, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud" (Dec. 3, 2024) (read Oct. 28, 2026). Read it online. ↩
22. Otto v. Catrow Law, PLLC, No. 19-0361 (W. Va. 2020) (Justia case page) (read Oct. 28, 2026). Read it online. ↩
23. McCabe v. Talero, 2025 NY Slip Op 50597(U) (Sup. Ct. Queens County, March 31, 2025) (read Oct. 28, 2026). Read it online. ↩
24. IRS, IR-2024-180 (July 2, 2024), Security Summit release on tax professional data incidents (read Oct. 28, 2026). Read it online. ↩
25. U.S. Attorney's Office, Southern District of New York, press release announcing charges against Iat Hong, Bo Zheng and Chin Hung (Dec. 27, 2016); see also SEC press release 2016-280. Final outcome for each defendant not checked for this lesson (read Oct. 28, 2026). Read it online. ↩
26. ABA Formal Opinion 477R, "Securing Communication of Protected Client Information" (May 11, 2017; revised May 22, 2017). Link is to the ABA's index of formal opinions (read Oct. 28, 2026). Read it online. ↩
27. North Carolina State Bar, 2015 Formal Ethics Opinion 6, "Lawyer's Professional Responsibility When Third Party Steals Funds from Trust Account" (adopted Oct. 23, 2015), Inquiry #5. Not Idaho law (read Oct. 28, 2026). Read it online. ↩
28. Idaho Rules of Professional Conduct, Rule 1.1 and Comment [8], Rule 1.4, Rule 1.6(c), Rule 1.15 and Comment [1], Rule 5.3 and Comments [2] and [3] (Idaho State Bar text current as of March 9, 2026) (read Oct. 28, 2026). Read it online. ↩
29. 16 CFR 314.4, "Elements" (FTC Safeguards Rule), paragraphs (c)(5) multifactor authentication, (e) training and (j) FTC notification; 16 CFR 314.5 makes 314.4(j) effective May 13, 2024 (Cornell LII copy of the current CFR) (read Oct. 28, 2026). Read it online. ↩
30. CISA, NSA, FBI and MS-ISAC, "Phishing Guidance: Stopping the Attack Cycle at Phase One" (October 2023) (read Oct. 28, 2026). Read it online. ↩
31. Microsoft Learn, "Deprecation of Basic authentication in Exchange Online," and Microsoft lifecycle announcement, "Deprecation of Basic Authentication (Basic Auth) in Exchange Online" The Microsoft Learn page says SMTP AUTH remains available and links Microsoft's January 2026 update on the SMTP AUTH timeline; the end-of-December-2026 default shutoff is as reported by Office 365 for IT Pros (Jan. 29, 2026) (read Oct. 28, 2026). Read it online. ↩
32. RFC 7208, "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1" (April 2014), Proposed Standard, updated by RFCs 7372, 8553 and 8616 (read Oct. 28, 2026). Read it online. ↩
33. RFC 6376, "DomainKeys Identified Mail (DKIM) Signatures" (September 2011), Internet Standard (STD 76), updated by RFCs 8301, 8463, 8553 and 8616 (read Oct. 28, 2026). Read it online. ↩
34. RFC 9989, "Domain-Based Message Authentication, Reporting, and Conformance (DMARC)" (May 19, 2026), Proposed Standard; obsoletes RFC 7489 and RFC 9091 (read Oct. 28, 2026). Read it online. ↩
35. Google Workspace Admin Help, "Email sender guidelines" (answer 81126) (read Oct. 28, 2026). Read it online. ↩
36. Yahoo Sender Hub, "Sender Requirements and Recommendations" FAQ (read Oct. 28, 2026). Read it online. ↩
37. Idaho Code 28-4-610, "Authorized and verified payment orders" (Idaho's version of UCC 4A-202), added 1991, ch. 135, sec. 1 (read Oct. 28, 2026). Read it online. ↩
38. John Simek, "2023 Cybersecurity TechReport," American Bar Association Law Practice Division (Dec. 18, 2023), based on the 2023 ABA Legal Technology Survey Report (read Oct. 28, 2026). Read it online. ↩
39. FBI Salt Lake City Field Office, "About" page (territory and resident agencies, including Boise, Coeur d'Alene, Lewiston and Pocatello; phone (801) 579-1400) (read Oct. 28, 2026). Read it online. ↩
40. IRS, "Data Theft Information for Tax Professionals" (last reviewed March 26, 2026). The IRS calls the contact office its "Stakeholder Liaison" (read Oct. 28, 2026). Read it online. ↩
41. ABA Formal Opinion 483, "Lawyers' Obligations After an Electronic Data Breach or Cyberattack" (Oct. 17, 2018). Link is to the ABA's index of formal opinions (read Oct. 28, 2026). Read it online. ↩
42. Idaho Code 28-51-104 to 28-51-107 (Title 28, Chapter 51, "Identity Theft"), including 28-51-104(5) (personal information) and 28-51-105 (notice) (read Oct. 28, 2026). Read it online. ↩
43. 16 CFR 314.2(m), definition of "notification event" (Cornell LII copy of the current CFR) (read Oct. 28, 2026). Read it online. ↩
44. Jetcrete North America LP v. Austin Truck & Equipment, Ltd., No. 2:18-cv-01999-APG-BNW, 484 F. Supp. 3d 915 (D. Nev. Sept. 3, 2020) (Gordon, J.), findings of fact and conclusions of law after bench trial. Case header confirmed; the summary of the holding relies on secondary sources, including a McDonald Hopkins article (read Oct. 28, 2026). ↩
45. Arrow Truck Sales, Inc. v. Top Quality Truck & Equipment, Inc., No. 8:14-cv-2052-T-30TGW, 2015 WL 4936272 (M.D. Fla. Aug. 18, 2015), as cited and described in Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018). The district court opinion itself was not read (read Oct. 28, 2026). Read it online. ↩
46. Idaho State Bar, Formal Ethics Opinions page (opinions from 1944 to 1999, plus Formal Ethics Opinion 137 announced Sept. 18, 2024 on the State Public Defender transition) (read Oct. 28, 2026). Read it online. ↩
47. Reported by McCarter & English (plaintiff's counsel), March 14, 2025, Connecticut Superior Court, Judge Juliett L. Crawford; later appeal and resolution reported by Law360. The law firm's name and the docket number were not confirmed for this lesson (read Oct. 28, 2026). ↩
48. Idaho Bar Commission Rules, Section VI, Client Assistance Fund, Rules 601(f), 601(j), 602 and 606 (current as of March 9, 2026) (read Oct. 28, 2026). Read it online. ↩
49. In re Davis (In the Matter of James W. Davis, III), No. S23Y0622 (Ga. May 14, 2024) (per curiam), read in full-text copies on FindLaw and law.co; not checked on the Supreme Court of Georgia's own site (read Oct. 28, 2026). Read it online. ↩
50. Idaho Bar Commission Rules, Section IV, Mandatory Continuing Legal Education, Rule 402(a) (current as of March 9, 2026); a text search found no technology or cybersecurity credit requirement (read Oct. 28, 2026). Read it online. ↩