October 2026 | Law Firm IT Security Salt Lake City | Security Culture | Trust Account Fraud
It's 4:17 on a Friday afternoon at a Salt Lake City law firm.
The bookkeeper receives an email that appears to be from the managing partner: "The client sent updated wire instructions for the settlement disbursement. Can you update them and get this out before you leave? They need it funded Monday."
The name is right. The tone sounds familiar. The matter is real — the settlement really is disbursing. With everyone trying to wrap up the week, the easiest thing to do is simply update the instructions and send the wire from the trust account. There's only one problem: the managing partner never sent it.
Trust account wire fraud is the law firm nightmare — money that belongs to clients, moved on the strength of a single email. Your IT security tools can put strong protections in place, but they can't stop every bad click, rushed reply or split-second wire. Some decisions still come down to whether a person knows what to do when something feels off.
The Assumption That Leaves Law Firms Exposed
Most managing partners believe cybersecurity lives somewhere behind the scenes. The IT provider has tools. The computers have protection. Someone schedules the updates. Cybersecurity is "handled."
In reality, your defenses are tested every time an attorney, paralegal or bookkeeper decides whether to trust an email, link or request. Those decisions happen every day, across every matter and every desk in the firm — and because they can touch client funds and privileged client files, the stakes are higher than in almost any other business. To truly strengthen your firm's IT security, your attorneys and staff must know what to do when something doesn't look right.
Technology Can't Make Every Call
Good security tools block a lot of attack attempts before anyone ever sees them. But no technology can eliminate every questionable request or make every decision on a person's behalf.
Today's phishing attacks aren't obvious. They're built to mimic familiar writing styles, reference real matters and mirror the rhythm of normal legal practice. A fake e-filing notice that looks like it came from the court. A message from "opposing counsel" with a revised agreement attached. A title company "correcting" wire instructions the day before a closing. When an unusual disbursement request comes from a partner, a client legitimately changes banking details mid-matter, or a staff member needs access to a file they've never opened before — someone must decide what happens next. The person at the keyboard has to determine in an instant whether they're looking at a scam or an authentic request.
"Be Careful" Isn't a Cybersecurity Plan
Most firms tell their people to watch out for suspicious emails. But what should they do when they find one? Every attorney and staff member should know:
- Who to contact inside the firm
- How to verify a request is legitimate — especially any change to wire instructions, confirmed by phone at a known number, every time
- Not to click links or download attachments from suspicious messages, including unexpected "court filings"
- What to do if they already clicked a link or downloaded an attachment
- How to report the issue quickly and without blame
Telling everyone to simply "be careful" without a clear next step puts the full weight of a high-stakes decision — sometimes involving client trust funds — on the person least equipped to handle it in the moment.
Assuming people know what to do is a liability. A staff member who isn't sure whether they're bothering a partner may stay quiet. Someone who fears getting blamed for clicking the wrong thing may wait before reporting it. Hesitation is costly — the time lost while someone decides whether to speak up can turn a manageable incident into a trust account loss, a privilege problem and a malpractice claim.
Leadership Sets the Tone
Responsibility starts at the top, because your attorneys and staff take their cues from the partners. If a partner routinely skips verification steps because they're in a hurry, the firm learns that speed matters more than process. If it's uncomfortable to flag suspicious activity, people stay quiet. If someone clicks something they shouldn't and gets publicly reprimanded, everyone learns to hide their mistakes.
Fortunately, the opposite is also true. When the partners normalize verification — including pausing their own wire approvals for a call-back — everyone takes it seriously. When a bookkeeper who questions an unusual disbursement request is backed up rather than brushed off, the whole firm operates more carefully. When people trust leadership, they speak up before a situation becomes a crisis. In a profession built on client confidentiality, that culture is part of the duty.
Cybersecurity Works Better When Everyone Knows Their Role
Back to that bookkeeper at 4:17 on a Friday afternoon.
The goal isn't to make your team paranoid about every email they receive. It's to make sure that when something feels off — an urgent wire change, an odd document link, a login prompt for Clio or NetDocuments that appears out of nowhere — they know exactly what to do, who to ask and how to verify. Speaking up should always feel like the right move.
Your attorneys and staff don't need to become cybersecurity experts to help protect the firm and its clients. They need clear expectations, good habits and the confidence to flag when something doesn't look right.
Creating that kind of security culture takes more than an annual CLE hour. It requires the right safeguards, practical processes and ongoing guidance to keep your firm prepared as threats change.
Frequently Asked Questions
What is security awareness training for law firms?
It's structured, ongoing education that teaches attorneys and staff to recognize phishing, wire fraud attempts and social engineering — including legal-specific lures like fake court notices and spoofed opposing counsel — and gives them a clear process for verifying and reporting suspicious activity. Done well, it turns your team into an active layer of defense and supports the profession's duty of technological competence.
Do you offer cybersecurity services for law firms in Salt Lake City?
Yes. Qual IT delivers legal IT services across Salt Lake City and the Wasatch Front, including email security, phishing protection, wire fraud safeguards, security awareness training for attorneys and staff, and incident response planning. We work with Salt Lake City law firms to protect client confidentiality and meet bar association IT requirements.
How does an IT partner help a firm build a security culture?
A partner like Qual IT identifies your gaps, implements the right safeguards around practice management, document and accounting systems, sets up practical verification and reporting processes — especially for trust account disbursements — and provides the ongoing training and guidance that keeps security habits current as threats evolve.
You Don't Have to Manage It Alone
That's where the right IT partner comes in. Qual IT provides IT support for law firms in Salt Lake City, taking the guesswork out of cybersecurity by identifying gaps, strengthening protections and helping your attorneys and staff understand the role they play in keeping client files and client funds secure.
Cybersecurity is everyone's responsibility — but you don't have to manage it alone. Schedule a 10-minute discovery call with Qual IT to find the gaps in your firm's current approach and how to address them. Book your discovery call here.
