One inbox can hold the secrets of every client you have
A law firm's email has what attackers want: deal terms, medical records, Social Security numbers and wiring instructions, often all in a single mailbox. Small firms hold the same kinds of secrets as big ones, usually with no security team.
This checklist turns guidance you already know about into tasks someone can actually do. Model Rules and ABA opinions aren't binding on their own, and your state may differ, so take the conclusions to your ethics counsel.
The opinions, translated
| Source | What it addresses |
|---|---|
| Model Rule 1.6(c) | Reasonable efforts to prevent unauthorized disclosure of or access to client information |
| ABA Op. 477R (2017) | Securing electronic client communications, with a risk-based approach |
| ABA Op. 483 (2018) | Duties after a breach: monitor, stop it, find out what happened, notify clients |
| ABA Op. 498 (2021) | Virtual practice, reasonable precautions and supervision |
| ABA Op. 512 (2024) | Generative AI: competence, confidentiality, communication, supervision and fees |
Stop wire fraud: three rules
- ///Call back on every new or changed wiring instruction
Use a number you already had, never one from the email, every time. No exceptions for urgency or seniority.
- ///Warn clients at engagement, in writing
Tell them you'll never change wiring instructions by email, and to call you before sending money.
- ///Require two people for trust account wires
One sets it up, another approves it after the call-back. Set the rule with your bank, not only in an office policy.
We don't need your document system. Give us one lawyer's mailbox and a quiet week. We'll read how you write, learn which deals are closing, and set a rule to hide replies. Then we'll send the wiring instructions ourselves.
What's in the full PDF
- ///The full checklist for accounts, client files, remote work and AI
- ///A decision table for when email needs more than email
- ///A firm wire-safety sheet to fill in
- ///A breach response plan and contact sheet built around Opinion 483