In this guide: Recognize the changed-instructions moment · Call a previously verified number · Build controls on both sides · Respond immediately to a suspected diversion
Recognize the changed-instructions moment
A request to change the receiving account, pay an individual, use an unfamiliar portal, or act urgently deserves independent confirmation. The message may come from a compromised real account rather than an obvious imitation. Do not rely on the email signature’s phone number to verify the same email.
Call a previously verified number
Use the number from the original engagement documents or another independently trusted source. Confirm the payee, account details or approved payment method, amount, and purpose. Ask who at the firm authorized the change. A brief verification is easier than recovering a payment after it has moved through multiple accounts.
Build controls on both sides
Firms should establish who may issue payment instructions and how changes are approved. Clients should know that last-minute changes will be verified. Use individual accounts, multifactor authentication, and appropriate access restrictions. Do not include sensitive bank details in broad email chains merely to make the process convenient.
Respond immediately to a suspected diversion
Contact the financial institution through its official fraud channel and ask about the available recall or containment steps. Notify the law firm through a trusted route. Preserve the original message, headers where available, invoice, and transaction information. The appropriate reporting and notification duties depend on the facts; delay can reduce practical recovery options.
A practical comparison
| Issue | What to examine | Practical safeguard |
|---|---|---|
| Changed account | Independent confirmation | Use a known number |
| Urgent payment | Pause and verify | Do not let pressure bypass checks |
| Unexpected payee | Match engagement terms | Confirm with authorized staff |
| Suspected fraud | Contact bank and firm | Preserve the original records |
Pause
Verify independently
Document the confirmation
An explanatory workflow, not a prediction of an individual result.
A worked example
Hypothetical: a client receives an email directing a legal payment to a staff member’s personal account. Even if the message uses the firm’s logo, the client should verify with the firm through the established number before paying. An internal-looking message is not sufficient authorization.
Questions to resolve before acting
Does a real email address guarantee the instruction is genuine?
No. Real accounts can be compromised. Verify a change through an independent, previously trusted channel.
Use the comparison above to identify the records and unanswered questions that will affect the next decision. Keep the original documents, note where each important fact came from, and distinguish an assumption from something independently verified. A short, accurate explanation of the problem is more useful than a large collection of unorganized material.
Sources and further reading
NC State Bar: Email-fraud warning
CISA: Account and phishing protection
Continue with our related North Carolina legal guide or browse the LKN Law Legal Guides library.
Published November 3, 2026. Original educational analysis. Hypotheticals are illustrative, not client stories or promised results. Out-of-state developments do not automatically control North Carolina cases. Sources and applicable rules should be checked for subsequent changes. No attorney-client relationship is created by this article.
Leave a Reply