Fake Lawyer Email Scams: Red Flags, Verification, and Reporting

Fake lawyer email scams use a convincing law firm name, a spoofed address, and pressure tactics to trick you into wiring money, opening malware, or handing over personal information. Business email compromise scams, which frequently involve impersonating lawyers, generated more than $2.77 billion in reported losses in 2024 according to the FBI.¹ You can defeat almost all of these emails with a few minutes of verification before you click, reply, or send anything.

Red Flags to Check First

Most fake lawyer emails share the same tells. Once you know them, you can spot the fraud in seconds.

Look at the greeting. A real attorney handling your matter addresses you by name and references the specific issue. An email opening with “Dear Client” or “Dear Sir/Madam” is a mass mailing from someone who does not know you.

Look at the sender’s address, character by character. Scammers register domains that mimic a real firm’s domain but differ by a letter or two, like “smithlawfirn.com” instead of “smithlawfirm.com.”² That single-character swap is easy to miss when you’re scanning quickly, which is exactly what the scammer is counting on.

Urgency is the other universal signal. “Immediate action required,” “respond within 24 hours,” “failure to comply will result in legal action.” These phrases are designed to short-circuit your judgment. Legitimate attorneys set reasonable deadlines and explain consequences in measured terms. When an email tries to make you panic, the panic itself is the weapon.

Then look at what the email wants you to do. Fake lawyer emails often push you to open an attachment claiming to be a court document or settlement agreement. Opening those files can install malware on your device.³ Real attorneys handling sensitive documents typically use a secure client portal or encrypted file-sharing service. Any email requesting payment through gift cards, cryptocurrency, or a wire transfer to a personal account is a scam. No law firm collects fees that way.

Common Variations You’ll See

Scammers tailor the pitch to the situation. The more money on the table, the more convincing the email.

Inheritance and Advance-Fee

An email from a “lawyer” tells you a distant relative died and left you a large inheritance. To collect, you need to pay legal fees, taxes, or processing costs upfront. The FTC has flagged this exact scheme, noting the scammer typically demands secrecy and insists you respond by email immediately.⁴ The inheritance does not exist. No legitimate estate proceeding requires an heir to wire money to a stranger before receiving a distribution.

Fake Debt Collection

An “attorney” representing a creditor demands immediate payment of a debt you don’t recognize, threatening a lawsuit, wage garnishment, or asset seizure within days. The FTC warns that fake debt collectors often refuse to provide a mailing address or phone number, use scare tactics about arrest, and claim they’ll take legal action they have no authority to pursue.⁵

Federal law gives you a clean test. Under the Fair Debt Collection Practices Act, any legitimate debt collector must send you a written validation notice within five days of first contacting you. That notice must include the amount of the debt, the name of the creditor, and a statement that you have 30 days to dispute the debt in writing.⁶ An email that skips those disclosures and jumps straight to threats is either a scam or a collector violating federal law. Either way, don’t pay.

Fake Lawsuit and Court Notices

These emails claim you’ve been named in a lawsuit or must appear at a hearing, and they push you to open an attachment for case details. The federal judiciary has warned the public that these emails install malware when recipients open the attached files.³ Other versions skip the attachment and ask for personal information like your Social Security number to “resolve” the matter. Courts and court officials do not email citizens to demand payment, request Social Security numbers, or collect fines over email.⁷ Unless you are actively involved in a federal case and have consented to receive electronic notifications, you will not be served with court documents by email.

Real Estate Wire Fraud

This is where the stakes get highest. A scammer monitors email communications between a homebuyer and the real estate attorney or title company. Near the closing date, an email that appears to come from the attorney arrives with “updated” wire instructions for the down payment or closing costs. The sending address may differ from the real one by a single character, and the message often includes the attorney’s correct name, firm address, and website. If the buyer wires funds to the fraudulent account, the money is usually gone within hours.

The defense is simple and non-negotiable: never trust wire instructions received by email alone. Confirm wire details by calling a phone number you independently verified, meaning the one stored in your contacts or printed on the title company’s website, not a number pulled from the suspicious email itself.

Business Email Compromise

Business email compromise targets companies. A scammer either hacks an attorney’s real email account or creates a nearly identical spoofed address, then uses it to send invoices or payment redirect requests to the attorney’s corporate clients. The FBI describes three primary tactics: spoofing email addresses with slight character variations, sending spear-phishing emails to steal login credentials, and deploying malware to monitor legitimate billing conversations so the fraudulent request arrives at exactly the right moment.² In 2024, BEC scams generated over 21,000 complaints and $2.77 billion in losses.¹ Any email requesting a change to payment instructions or wire details, regardless of how familiar the sender looks, should trigger a phone call to a number you already trust.

How to Verify the Lawyer Is Real

Don’t evaluate a suspicious email in isolation. Verify that the person exists and actually sent the message. Five minutes of checking can save you thousands.

Start with your state bar’s online attorney directory. Every state maintains a searchable database of licensed attorneys with the lawyer’s name, bar number, admission date, current status, and office address. Search by name and confirm the attorney is licensed and in good standing. If the name doesn’t appear, or the listed office address doesn’t match the email signature, that’s your answer.

For cross-state verification, the American Bar Association maintains the National Lawyer Regulatory Data Bank, the only national repository of public regulatory actions against lawyers across all 50 states and the District of Columbia.⁸ If someone claims to be licensed in a state different from where you live, the Data Bank can reveal whether they’ve been disbarred or suspended elsewhere.

Once you’ve confirmed the lawyer exists, call the firm through a phone number you find independently on the firm’s official website or through directory assistance. Do not call the number in the email. Scammers anticipate this step and sometimes include a phone number that rings to an accomplice. Ask the firm whether anyone there sent you the communication and whether the details match. A legitimate attorney will not be offended; they’ll appreciate that you’re being careful.

Where to Report a Fake Lawyer Email

Reporting protects you and feeds the databases that law enforcement and email providers use to shut scammers down. The FTC uses fraud reports to build enforcement cases, and other agencies access those reports for their own investigations.⁹ File in as many of these places as apply:

Anti-Phishing Working Group. Forward the phishing email to reportphishing@apwg.org, which helps security researchers track active campaigns.¹⁰
FTC. Report at ReportFraud.ftc.gov. Forward phishing texts to SPAM (7726).¹⁰
FBI’s IC3. If you lost money or shared sensitive financial data, file a complaint at ic3.gov. The form asks for your information, financial transaction details, the subject’s information, a narrative, and any email headers you can provide.¹¹
State attorney general. Your state’s consumer protection office investigates fraud within the state. Find it through usa.gov/state-consumer.¹²
Your email provider. Most providers have a “Report phishing” option built into the interface, which improves spam filters for everyone on that platform.

Do not click any links, open any attachments, or reply to the email before reporting it. If you’ve already opened an attachment, run a full malware scan on your device immediately.

What to Do If You Already Responded

Speed matters enormously. If you wired money, call your bank’s fraud department immediately and request a wire recall. Ask the sending bank to contact the receiving bank to freeze the funds. Reporting wire fraud within 72 hours gives you the best chance of recovery, and if the transfer exceeds $50,000 and went through the international SWIFT system, the bank can initiate the FBI’s Financial Fraud Kill Chain to attempt to intercept the funds. Call, don’t email. Every hour counts.

If you shared personal information like your Social Security number, bank account numbers, or login credentials, take these steps in order:

Freeze your credit. Contact Equifax, Experian, and TransUnion individually to place a security freeze. When you request a freeze online or by phone, the agency must freeze your report within one business day. A freeze prevents anyone from opening new accounts in your name.¹³
File an identity theft report at IdentityTheft.gov. The FTC’s recovery portal generates a personalized recovery plan with pre-filled letters for banks and creditors and walks you through each step.¹⁴
Notify your bank and card issuers. Under federal law, if you report an unauthorized electronic transfer within two business days of discovering it, your liability is capped at $50. Wait longer than two days and the cap jumps to $500. Miss the 60-day window after a fraudulent transfer appears on your statement, and you could lose everything taken after that point.¹⁵
Change compromised passwords. If you entered login credentials on a phishing site, change that password everywhere you use it.
File with IC3 at ic3.gov even if you’ve already reported to the FTC. Include email headers, transaction details, dates, and the full text of the fraudulent email.¹⁶

Keep records of every report you file and every call you make, with the date, time, and name of the person you spoke with. Those records become critical if you need to dispute unauthorized charges or prove you reported within the required timeframes. Identity theft recovery can stretch over weeks or months, but the actions you take in the first 48 hours decide how much damage the scammer can ultimately do.

1
FBI Internet Crime Complaint Center. 2024 IC3 Annual Report
2
FBI. Business Email Compromise
3
United States District Court. Public Alert – Scam Emails About Phony Court Cases Carry Computer Virus
4
Federal Trade Commission. Contacted About a Long-Lost Relatives Inheritance Hold On
5
Federal Trade Commission. Fake and Abusive Debt Collectors
6
Office of the Law Revision Counsel. 15 USC 1692g – Validation of Debts
7
North Carolina Judicial Branch. Email Scammers Claiming to Represent the Court Targeting the Public
8
American Bar Association. National Lawyer Regulatory Data Bank
9
Federal Trade Commission. Why Report Fraud
10
Federal Trade Commission. How To Recognize and Avoid Phishing Scams
11
Internet Crime Complaint Center. Frequently Asked Questions
12
USAGov. State Consumer Protection Offices
13
USAGov. How to Place or Lift a Security Freeze on Your Credit Report
14
Federal Trade Commission. IdentityTheft.gov – Report Identity Theft and Get a Recovery Plan
15
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
16
Internet Crime Complaint Center. Complaint Form