In short: Cyber security training for law firms focuses on the threats that hit legal practices hardest: conveyancing and completion-money fraud, impersonation of clients and other firms, and phishing aimed at fee earners and accounts staff. It supports SRA expectations that firms manage material risks and keep staff competent, alongside client confidentiality duties.
Why law firms are targeted
Criminals target law firms for both money and information:
- Client money passes through the firm, especially on property completions, so a single redirected payment can be very large
- Email-driven processes: clients, estate agents, lenders and other firms exchange bank details and documents by email
- Confidential information about deals, disputes and individuals is valuable to criminals and to rivals
- Public profiles: partners and fee earners are easy to research and impersonate
- Time pressure around exchange and completion makes people less likely to stop and check
The SRA has repeatedly highlighted cybercrime, and email-based fraud in particular, in its Risk Outlook publications.
Conveyancing and payment diversion fraud
Payment diversion is the threat most law firms worry about most. Typical scenarios include:
- A criminal who has compromised a client's, agent's or the firm's own mailbox sends 'updated' bank details just before completion
- A client receives an email apparently from the firm asking them to send their deposit to a new account
- An email appearing to come from the other side's solicitor changes the account for completion monies
- A 'partner' asks an accounts assistant to make an urgent, confidential transfer
Training should make one rule automatic: never act on bank details received or changed by email without verifying them by a call to a number already known to be genuine. Tell clients at the start of every matter that you will never change your bank details by email, and train staff to repeat that message. Our business email compromise training covers call-back verification in depth.
What the SRA expects
The SRA does not prescribe a specific security awareness course, but its standards are relevant. The Code of Conduct for Firms requires firms to have effective governance, systems and controls, including that they identify, monitor and manage all material risks to the business (paragraph 2.5), and that managers and employees are competent to carry out their role and keep their knowledge and skills up to date (paragraph 4.3). Firms must also keep the affairs of current and former clients confidential (paragraph 6.3).
For most firms, cyber crime is a material risk, and training records, simulation results and documented verification procedures are practical evidence that it is being managed. This is not legal or regulatory advice; check the SRA's current standards, warning notices and Risk Outlook for your firm. Our UK requirements page covers the wider picture, including UK GDPR.
Role-based training in a law firm
Different teams face different risks:
| Team | Main risks | Training focus |
|---|---|---|
| Conveyancing and property | Completion-money diversion, fake client and agent emails | Call-back verification, client warnings, spotting lookalike domains |
| Accounts and cashiers | Fake payment instructions, impersonation of partners | Dual authorisation, verifying every new payee and change of details |
| Fee earners and partners | Spear phishing, fake document-sharing links, deepfake requests | Targeted simulations; see deepfake awareness training |
| Secretaries and PAs | Requests made on behalf of partners, diary and email access | Verifying unusual requests, delegated mailbox security |
| Reception and client services | Callers impersonating clients to obtain information | Identity checks; see social engineering training |
Everyone also needs the core curriculum: phishing, passwords and MFA, safe handling of client data and reporting. See security awareness training for employees.
Client confidentiality and data handling
Confidentiality is at the heart of legal practice, and many breaches are caused by everyday mistakes rather than sophisticated attacks. Training should cover:
- Misdirected email: checking autocomplete suggestions and recipients before sending documents, especially to opposing parties
- Secure sharing: using the firm's portal or approved sharing tools rather than personal email or consumer file-sharing
- Working away from the office: screen privacy on trains and in court buildings, and never leaving files or devices unattended; see security for remote and hybrid workers
- Generative AI: never pasting client information into public AI tools; see safe use of AI at work
- Personal data breaches: recognising one and reporting it internally at once, so the firm can decide whether the ICO must be told; see GDPR training for staff
Choosing a platform for a law firm
Look for realistic spear phishing and payment-fraud simulation, reporting by team, and integration with your email security. Platforms that pair training with email protection, such as IRONSCALES, Proofpoint Essentials Security Awareness or the Hornetsecurity Security Awareness Service (Hornetsecurity is now part of Proofpoint), can be a good fit, as can Attack Simulation Training for firms on Microsoft 365 E5. See security awareness training platforms compared.
How we help law firms
We run a baseline simulation themed on payment fraud, set up role-based training for conveyancing and accounts teams, help you document verification procedures, and give partners a quarterly report. It is all part of our managed security awareness training service.
Contact us to plan training for your firm.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does the SRA require cyber security training?
The SRA does not prescribe a specific course, but its Code of Conduct for Firms requires firms to identify, monitor and manage material risks and to keep staff competent. Training records are practical evidence that cyber risk is being managed. This is not regulatory advice.
How can law firms prevent conveyancing fraud?
Tell clients at the outset that you will never change bank details by email, verify any bank details by calling a number already known to be genuine, use dual authorisation for payments, and train conveyancing and accounts staff with realistic payment-fraud scenarios.
What should law firm staff do if they think they have been phished?
Report it immediately through the firm's report button or IT contact, change the affected password, and tell the matter owner if any payment or client information could be affected. Fast reporting matters more than anything else.
Should we run phishing simulations in a law firm?
Yes. Simulations themed on document sharing, completion and payment requests show how staff respond under realistic pressure. Run them without blame and focus on reporting.