Law firms hold client funds, handle sensitive information and routinely act on instructions involving large payments — making them attractive targets for social engineering fraud.
As AI helps criminals impersonate trusted contacts and exploit those transactions, a successful scam can expose gaps in a firm’s insurance protection.
Specialists at Amwins Program Underwriters (APU) say the risk calls for a closer look at how professional liability, cyber and crime policies fit together, including limits on fraud coverage and verification requirements that could determine whether a loss is covered.
“AI has made the attackers much better because they can target particular attorneys, they can target particular transactions, and they can monitor email threads back and forth,” said John Muller (pictured left), senior vice president, lawyers’ professional liability, at APU. “It's become a much more complex claim environment.”
The FBI's Internet Crime Complaint Center logged 22,364 complaints with an AI-related nexus in 2025, tied to about $893 million in reported losses, according to its 2025 Internet Crime Report. More than $30 million of those losses came from business email compromise scams with a confirmed AI component.
Luna Moth, a cyber extortion group also known as Silent Ransom Group, has consistently targeted US law firms since spring 2023, according to the FBI. Its attacks use deception to gain access to sensitive files, which are then held over the firm in demands for payment.
The group initially became known for fake subscription invoices that prompted recipients to call a fraudulent customer support number. More recent attacks involve callers impersonating the firm’s own IT staff, persuading employees to share their screens or install legitimate remote support software.
Real estate is among the practice areas most exposed to these schemes, Muller said, because attorneys often hold earnest money or final deposits that they will transfer to close a contract.
“We’ve seen a number of instances where the threat actors have actively stepped into the email chain and say, ‘There's been a change. Could you send it to this account?’” Muller said. “They can time their attacks much better.”
Trust and estate attorneys, particularly those acting as trustees, and plaintiff firms disbursing settlement funds also face exposure, said David Collins (pictured middle), Esq., senior vice president, professional lines, at APU. Confidential client files give criminals another source of leverage, through ransomware attacks that begin when a social engineering prompt gets someone to click something malicious.
“Firms have a lot more than just the cash on hand that's attractive to these bad actors,” Collins said. “Especially larger firms involved in very high-profile cases or with high-profile clients, they have a lot to lose if those client files are gone. There's more there than simply trying to extract funds.”
Marie Gaudette (pictured right), vice president at APU, agreed that claims involving phishing scams and wire fraud are increasing, with attacks becoming “smarter and more sophisticated.” At the same time, while larger firms are investing heavily in technology and risk controls, smaller and midsized firms may not have the money to keep pace.
The size of a firm’s transactions provides a starting point for reviewing coverage.
Muller contrasted firms handling $250,000 transactions with those moving seven-figure sums. A $250,000 social engineering limit leaves a different exposure in each case, making transaction values a starting point for a broker’s coverage review.
Building a meaningful limit can be difficult because firms often have to take “bits and pieces” from crime, fidelity, fiduciary and cyber policies, he explained. Once those are exhausted, the loss may land on the professional liability policy, where coverage is uncertain.
Professional liability policies also take different approaches to the exposure. Most lawyers' professional liability (LPL) wordings remain silent, with sublimits and exclusions “probably the minority position,” Muller said, partly because exclusions drawn too broadly can capture normal parts of a firm's practice.
However, a silent policy won't provide the notification and public relations support a firm needs after an attack, and paying a social engineering loss erodes the limit available for claims the policy was designed to cover.
It can also leave room for dispute. Collins noted that some carriers treat failure to safeguard client funds as a cyber loss rather than a professional liability trigger and carve it out of their policies.
Verification requirements are increasing amid the intensifying threat landscape. The APU specialists noted that some carriers have written verification steps, such as a call to a known number, into their policies as a condition of coverage.
In some cases, to trigger coverage, the firm must verify a wire request with a call to a number previously known to it before funds are sent. A closing-day email supplying both new banking instructions and a new contact number would not satisfy that requirement if staff called the newly supplied number.
Meanwhile, many cyber carriers now ask whether a firm uses a third-party authentication process and what it is, and some help provide training. The training should cover what a suspicious email looks like, what to do when asked to send a wire and which authentication process staff must follow.
“It means that law firms need to take more care and caution to recognize (fraud) and put in other verification steps before they send a wire or allow anyone access to their information,” Gaudette said.
Dedicated cyber policies can bring forensic specialists and public relations support into the response, and speed matters. According to Muller, the first 24 or 48 hours of response are “really critical to potentially getting the money back,” since a bank that catches the transaction quickly may be able to stop the funds from going out.
For law firms, the consequences can extend beyond the immediate financial loss.
“When you experience an attack and you have to disclose it, whether you have coverage or not, there's a lot of reputational damage,” Gaudette said. “That will impact your business for several years.”
APU now offers comprehensive protection for law firms of varying sizes under our Lawyers’ Professional Liability Solutions. Learn more about APU Lawyers' Professional Liability Solutions.
This article was produced in partnership with Amwins.
