Assessment · 4–5 minutes
Would your firm spot
an AI-assisted attack?
The Law Firm AI Threat Check scores whether your procedures, people and systems would stop criminals who use AI, with most of the weight on the place fraud against law firms usually ends: the payment.
The phishing email with the spelling mistakes is disappearing. What replaces it is well written, arrives at the right moment in a matter, and is sometimes followed by a phone call in a partner's voice.
Answer 20 questions and see where an attacker would get in, and what to close first.
Built for private-practice UK law firms. Wondering whether your firm is ready to use AI itself? That is the AI Readiness Check.
Payments & client money
The heaviest-weighted section. Where fraud against law firms ends: a changed bank detail, or a payment released on the strength of a message.
When a client, supplier or another firm asks to change bank details, is the change always confirmed by phoning a number you already hold?
A number from the matter file or an earlier letter, never one given in the request itself.
What it covers
Five areas,
weighted by where the money goes.
Criminals using AI want what they always wanted: a payment, or access that leads to one. So payments and client money carry the most weight, and everything else is scored for how well it protects them.
Payments & client money
The heaviest-weighted section. Where fraud against law firms ends: a changed bank detail, or a payment released on the strength of a message.
Impersonation & deepfakes
Whether a convincing voice, video, document or phone call would be checked before anyone acted on it.
Email & phishing
Whether criminals can send as your firm, and whether staff would spot and report a well-written lure.
Accounts & exposure
What an attacker can learn about the firm, and how hard it is to take over an account once they try.
Detection & response
How quickly anyone would notice, and whether the first hour of a fraud is already planned.
This assessment is a practical security and operational readiness tool. It is not legal, regulatory or insurance advice, and no score is a guarantee against fraud. Your obligations depend on your firm, its clients and its systems.
Questions
What people ask
before they take it.
What is an AI-assisted attack on a law firm?
Mostly the same fraud as before, done better. AI writes phishing emails with no spelling mistakes in the style of a real client or colleague, clones a partner’s voice from a short recording, generates convincing ID documents and bank statements, and helps attackers exploit newly published software flaws faster. The aim is usually unchanged: to divert a payment, or to get into a mailbox that leads to one.
How is this different from the AI Readiness Check?
The AI Readiness Check asks whether your firm is ready to use AI safely: policy, client confidentiality, supervision and suppliers. The AI Threat Check asks the opposite question: whether your firm would withstand criminals who are already using it. A firm can score well on one and poorly on the other.
Why is the payments section weighted most heavily?
Because that is where fraud against law firms ends. A cloned voice or a compromised mailbox only costs money if a payment goes to the wrong account. Call-back verification of bank-detail changes, genuine dual authorisation and warning clients that your details never change by email stop most attempts, however convincing the lead-up.
Can a voice really be cloned from a few seconds of audio?
Yes. Widely available tools produce a convincing clone from a short recording, and a webinar, podcast appearance or voicemail greeting is often enough. Faked video calls have also been used to authorise large transfers. That is why the check asks about verifying requests on a second channel, rather than whether staff can tell a fake voice from a real one.
What happens to my answers?
They stay in your browser. The score is calculated on the page, progress is saved on your device, and nothing is sent anywhere unless you ask for the emailed report. If you do, we receive your answers and contact details to send it, and nothing else.
We scored badly. What should we do first?
Start with procedures, which cost nothing: call back on a known number before any change to bank details, require a second authoriser who checks the payee against the file, tell clients your details will never change by email, and write a one-page plan for the first hour of a payment fraud. Then turn to the technical controls: DMARC enforcement, phishing-resistant MFA for partners and finance, and alerting on mailbox rules.
One answer you can check for certain
Can criminals send email
as your firm?
Question 9 asks it. The Email Security Check answers it in about five seconds by reading your domain's SPF, DKIM and DMARC records, and gives you the exact record to publish for anything missing.
Check your domain →