The Utah State Bar has issued a warning about a highly sophisticated phishing scam specifically aimed at family law practitioners. Unfortunately, one of our colleagues recently fell victim to this scheme, and their experience highlights just how convincing and dangerous these attacks can be.
How the Scam Worked
About two weeks ago, a family law custody evaluator received an email that looked like it came from a known attorney. The email claimed to be sharing a document via Dropbox. When the recipient clicked the link and entered their Microsoft credentials, their email account was compromised.
The attackers didn’t stop there. Once inside the account, they:
- Searched historical email exchanges with other attorneys and mental health professionals.
- Sent fraudulent replies within ongoing threads, using the lawyer’s real signature block and HIPAA disclosure.
- Created hidden server-side rules to redirect replies to the RSS feeds folder, preventing the evaluator from noticing the activity.
- Continued sending malicious file-sharing links, sometimes dropping Dropbox references and instead urging recipients to “copy and paste” a suspicious link into their browser.
This is still an active scam, with multiple family law practitioners continuing to receive fraudulent messages as of this week.
What You Should Do
If you receive an email with Dropbox, OneDrive, or other file-sharing links that seems suspicious:
- Contact the sender independently using a phone number or email you already trust.
- Double-check the sender’s address for typos or slight variations (e.g.,
.comvs..co). - Never click or paste unknown links into your browser.
- Report the email immediately to your IT team or service provider.
- Delete using your provider’s security tools, not just the trash folder.
Awareness is your best protection.
RELATED: Phishing Email Scam Impersonating Utah State Bar Communications Director
Other Email Scams Targeting Lawyers
Unfortunately, this is not an isolated attack. Lawyers have long been attractive targets for cybercriminals because they handle sensitive information, client funds, and confidential communications. Here are a few other common scams to watch for:
Fake Client Overpayment Scams
An individual posing as a client asks an attorney to handle a quick legal matter. They “accidentally” send a check or wire for too much money, then request a refund. By the time the attorney realizes the original payment was fraudulent, the refund has already been sent.
Wire Fraud in Real Estate Transactions
Cybercriminals monitor communications between lawyers, clients, and title companies. At the right moment, they send an email—appearing to come from a lawyer or client—with “updated” wire instructions. The result: hundreds of thousands of dollars sent to a scammer’s account.
Compromised Vendor or Court Notices
Scammers impersonate courts, opposing counsel, or professional vendors, sending official-looking emails with malicious attachments labeled as “motions,” “subpoenas,” or “invoices.” The attachments often contain ransomware or credential-harvesting malware.
Business Email Compromise (BEC)
Attackers gain access to a lawyer’s email account (often through phishing, like in the Utah case). They silently monitor communications, waiting for the right time to insert fraudulent requests for payments, settlement disbursements, or confidential files.
Fake Bar or Disciplinary Notices
Lawyers have reported receiving emails claiming to be from their state bar, alleging disciplinary action or requesting payment of dues. These scams prey on lawyers’ fear of professional sanctions and often include urgent deadlines to prompt rash clicks.
Protecting Yourself and Your Clients
- Enable Multi-Factor Authentication (MFA): Even if credentials are stolen, MFA can stop attackers from logging in.
- Train Staff Regularly: Many breaches occur when non-lawyer staff unknowingly click a link or open an attachment.
- Use Secure File-Sharing Services: Avoid sending sensitive documents via email links unless absolutely necessary.
- Monitor Your Email Rules: Periodically review server-side rules to ensure none have been secretly added.
- Stay Informed: Bar associations and cybersecurity groups often issue alerts—make it a habit to check them.
Cybercriminals are increasingly targeting lawyers with personalized, highly convincing scams. By staying alert and skeptical of unexpected messages, you can help protect yourself, your clients, and the integrity of the profession.
*This blog was partially created with the assistance of AI.
