Wire Fraud Prevention and IT Documentation for a McLean, VA Litigation Firm
After two phishing near-misses, a complete security rebuild eliminated BEC risk and satisfied insurance requirements.
2
Wire fraud attempts blocked in first 12 months
24→71
Microsoft Secure Score improvement
0
Successful phishing incidents post-implementation
100%
MFA adoption across all attorneys and staff
The Situation Before Metro Point IT
A 6-attorney litigation firm in McLean, Virginia handling commercial real estate transactions and business litigation had been relying on a single-person internal IT department for 8 years. When that employee departed, the firm discovered their IT environment was entirely undocumented — no password manager, no asset inventory, no backup documentation, and no written IT policies. Client files were stored on a shared server with no access controls; all attorneys had full access to all client matters regardless of involvement. The firm had experienced two phishing incidents in the prior 18 months, both involving wire transfer requests.
ABA Cybersecurity Obligations
The ABA Model Rules require lawyers to make reasonable efforts to prevent unauthorized disclosure of client information and to supervise non-lawyer employees for technology-related obligations. Two phishing incidents targeting wire transfers created both ethical and malpractice exposure — the firm's managing partner engaged Metro Point IT after consulting with their professional liability insurer.
What Metro Point IT Implemented
Metro Point IT conducted a 2-week discovery engagement to document the existing environment before recommending changes. Implementation:
Identity and Access: Microsoft 365 Business Premium deployed. MFA enforced on all accounts. Matter-based SharePoint structure implemented — attorneys access only matters they are working on. Admin accounts separated from daily-use accounts.
Email Security: Advanced anti-phishing with impersonation detection for all attorney names and the firm's domain. External email warning banners. DMARC, DKIM, and SPF authentication configured to prevent domain spoofing. Wire transfer verification policy written and trained — all wire transfer instructions require phone verification to a known contact number, regardless of email authority.
Data Protection: Client matter data classified and protected with Microsoft Purview. Full-disk encryption on all workstations and laptops. Mobile device management for firm-issued and BYOD devices accessing firm email.
Documentation: Complete IT asset inventory, network diagram, admin credential vault, and written IT policies — all accessible to firm management, not held by a single IT employee.
Measurable Outcomes
Results at 12-month mark:
Outcomes
Zero successful phishing incidents in 12 months following email security implementation. Wire transfer verification policy in place — two attempted BEC wire fraud incidents detected and blocked. Professional liability insurer satisfied cybersecurity requirements. Complete IT documentation created — firm no longer dependent on any single person for IT knowledge. Microsoft Secure Score increased from 24 to 71 out of 100.