It is the third week of July. One of your partners is somewhere off the grid, a senior associate is covering three matters that are not hers, and the front desk is running on a temp who started Monday. Then an email lands. It comes from a vendor your firm pays every month, and it says the banking details have changed. The request reads as routine, the tone is familiar, and everyone is busy. That is exactly the moment an attacker is counting on.
At ECS, we see the same pattern across the Greater Houston legal community every summer. The most damaging attacks on law firms rarely look like attacks. They look like normal business, and they arrive at the precise time your usual checks and balances are stretched thin. Below are three of them, along with what your firm can do to close the gap without slowing your practice down.
1. Fake Invoices and Vendor Impersonation
An attacker often does not need to break into anything. In many cases, all it takes is one believable email. This is called business email compromise (BEC), and it works by impersonating a vendor, co-counsel, or a partner your team already trusts. The message looks ordinary, someone approves the payment, and by the time anyone realizes the request was never legitimate, the money is gone. The FBI's Internet Crime Complaint Center reported $2.77 billion in business email compromise losses in 2024 across 21,442 complaints, and payment and banking-change fraud sits at the center of that total.
These attacks climb during vacation season for a plain reason. When the person who normally approves payments is out, requests get rerouted to someone who does not always know what normal looks like. A temporary stand-in is less likely to question urgency, and attackers know it.
The good news is that the fix does not require new software. Build a verification habit for any financial or banking-change request that arrives by email. A quick confirmation call to a known number, not the number printed in the message, stops most of these before they go anywhere. Pair that with a rule that any change to payment details needs a second person to approve it, and you have removed the single point of failure attackers rely on.
Want a clear view of where your firm is exposed? 
Schedule a short call and we will review how your payment approvals work, whether multifactor authentication is turned on across your email and remote access, and which outside vendors still hold access to your systems.
You will leave with a plain-language picture of your firm's exposure and a short list of fixes ranked by impact.
2. Vendor and Third-party Access that Travels Fast
Phishing works because it is engineered around how people behave when they are busy. An attorney sees a password-reset notice and clicks before thinking. A paralegal gets a text that looks like it came from IT. An email lands right before a closing asking for urgent approval on a wire. Nobody stops to verify, because stopping feels like losing time you do not have. Phishing and spoofing were the most reported cybercrime to the FBI in 2024, with 193,407 complaints, and legal teams handling privileged client data are a high-value target.
The strongest protection here is not a product, it is a culture. Your team needs to feel comfortable slowing down when something seems off. A few moments are worth turning into a reflex:
(a) An unexpected login or password-reset prompt that you did not initiate deserves a pause before you click anything.
(b) A payment or banking-change instruction that appears out of nowhere should be confirmed through a second channel every time.
(c) A link in an email you were not expecting is worth hovering over, or ignoring entirely, until you can verify who sent it.
Turning on multifactor authentication (MFA) across email and remote access adds a second layer, so a stolen password alone does not open the door. Speed is the weapon attackers use against you. Giving your team permission to slow down is how you take it away from them.
What a review actually covers We look at how financial and banking-change requests get approved, whether multifactor authentication is turned on across your email and remote access, and which outside vendors and former contractors still hold keys to your systems. You walk away with a clear, plain-language picture of your firm’s exposure and a short list of fixes ranked by impact. Schedule a no pressure conversation with our team.
3. Vendor and Third-Party Access That Travels Fast
When a vendor with access to your systems is compromised, the threat does not stay with them. It travels straight into your environment through whatever connection they have to your firm.
A clearer picture is closer than you think.
Review how financial and banking-change requests get approved, whether multifactor authentication is turned on across your email and remote access, and which outside vendors and former contractors still hold keys to your systems.
This is supply chain exposure, and most firms carry far more of it than they realize. Think of the eDiscovery platform, the document management system, the cloud billing tool, the outside IT help, and the contractor whose access was never switched off after a matter closed. Each one is a path few firms have ever mapped.
Outsourcing a service does not outsource the responsibility for it. Knowing where your firm stands comes down to three questions:
- Which outside vendors and platforms can reach your data or systems today?
- What exactly are they connected to, and what level of access do they hold?
- Who inside the firm owns each of those relationships and reviews them regularly?
If those answers are not clear, that is where your exposure lives. The reassuring part is that mapping this is a finite, doable exercise, and once it is done, keeping it current is straightforward.
By the time it shows, it is already moving
The firms that get hit are not always the ones ignoring obvious warning signs. Often they are the ones who assumed everything was fine because nothing looked wrong. Summer is when schedules loosen, attention drifts, and the water looks calmest. It is also when attackers are most active.
Most firms we meet are not careless. They are busy, and busy is where exposure hides. We help law firms get a clear picture of where they are exposed across payments, email, and vendor access before something breaks, and we translate it into plain language your partners can act on. If you are not certain where your firm stands heading into the back half of summer, that uncertainty is worth a short conversation. Want to talk through where your firm stands? We're here, and there is no pressure and no obligation.
We have spent years keeping Houston law firms running.
ECS has helped law practice teams across the Greater Houston area turn tangled, grown-in-a-hurry systems into technology they can trust, without the jargon and without the pressure.
Start with a free consultation, no strings attached.
Frequently Asked Questions
Cyber risk rises in summer because staffing gets thinner and oversight loosens right when attackers stay active. When the partner or manager who normally approves payments is on vacation, requests get rerouted to stand-ins who may not recognize what a normal request looks like, which is exactly the opening attackers wait for.
Confirm the request by calling a known, trusted phone number, never the number listed in the email itself. Add a policy that any change to banking or payment details requires a second person to approve it. These two habits stop the large majority of business email compromise attempts without any new technology.
Third-party risk is the exposure your firm inherits when an outside vendor with access to your systems is compromised. Document management platforms, eDiscovery tools, cloud billing services, and outside IT providers all create connections into your environment, and a former contractor whose access was never removed is a common blind spot.
No, antivirus alone is not enough, because most phishing succeeds by manipulating people rather than exploiting software. Effective protection combines multifactor authentication, regular staff awareness, and a culture that gives your team permission to slow down and verify anything that feels urgent or unexpected.
Start by mapping three things: how payment requests are approved, whether multifactor authentication is turned on everywhere, and which outside vendors can reach your systems. A brief review with an experienced IT partner will surface the highest-impact gaps quickly, and ECS offers a free consultation to help Houston firms see where they stand.
