AI Deepfakes: Could Your Law Firm Spot a Fake Voice?

Posted on by

October is Cybersecurity Awareness Month, and this is part two of our five things every law firm should know to better protect its people, clients, finances, and data.

In our first article, we talked about phishing emails and why employees can no longer rely on obvious spelling mistakes or poor grammar to identify a suspicious message. But what happens when the request does not arrive by email at all?

What if it comes from a voice your employee recognizes?

Advances in artificial intelligence are making it increasingly possible to imitate voices and create convincing fake video. For law firms, that creates a new cybersecurity challenge: hearing or even seeing someone may no longer be absolute proof that the person is really who they claim to be.

Imagine This Happening at Your Law Firm

Your bookkeeper receives a phone call from one of the firm’s partners.

The voice sounds familiar. The partner seems rushed and says something like:

“I need you to send a wire right now. I’m walking into a meeting, so I can’t stay on the phone.”

The request sounds legitimate. The voice sounds right. There may not be anything obviously suspicious about the call.

Would your employee send the money?

The problem is that the person on the other end of the phone may not actually be the partner.

AI Is Changing How Firms Need to Think About Identity

AI technology can be used to create convincing imitations of a person’s voice. Similar technology can also generate or manipulate video.

That means one of the assumptions employees have traditionally relied on — “I know what this person sounds like” — may not provide enough protection for a high-risk transaction.

This is especially important for law firms because employees routinely work with sensitive information and high-value transactions.

High-Risk Requests May Include:

  • Wire transfers or other financial transactions
  • Passwords or account credentials
  • Confidential client information
  • Settlement funds
  • Changes to payment instructions
  • Requests to bypass established procedures
  • Access to sensitive documents or systems

These requests deserve additional verification, regardless of how convincing the person making the request may sound.

Create One Simple Verification Rule

Law firms do not need complicated procedures for every phone call.

A good place to start is with one straightforward rule:

An unusual request gets verified — even when you recognize the person making it.

If an employee receives an unexpected request involving money, credentials, confidential information, or a change to normal procedures, they should verify it using a separate, trusted method.

For example, an employee could call the attorney or staff member back using a phone number already saved in the firm’s contacts rather than a number supplied during the questionable interaction.

They could also use a known internal communication channel to confirm the request.

For particularly sensitive transactions, some firms may consider establishing an agreed-upon verification word or another internal authentication procedure.

Verification Does Not Have to Slow Down Your Firm

The goal is not to make employees suspicious of every phone call or video conference.

Instead, teach them to recognize situations where an extra level of confirmation makes sense.

A routine conversation may not require additional verification. An unexpected request to immediately transfer thousands of dollars should.

Taking an extra thirty seconds to verify a high-risk request can be significantly easier than trying to recover money, investigate a security incident, notify affected parties, or determine what information was exposed after an employee acts on a fraudulent request.

Talk About Deepfakes Before Your Staff Encounters One

Cybersecurity procedures are most effective when employees already know what to do before something unusual happens.

During Cybersecurity Awareness Month, talk with your staff about how high-risk requests should be verified. Make sure employees understand that stopping to confirm a request is not an inconvenience — it is part of protecting the firm and its clients.

Employees should know exactly who to contact, which communication channels to use, and which types of requests require additional verification.

Because in the age of AI, “It sounded exactly like him” may no longer be enough.

A simple verification process gives your employees something much more reliable than instinct: a clear procedure they can follow when a request does not feel routine.

Next in Our Cybersecurity Awareness Month Series

Next, we’ll look at what happens when a criminal gets hold of something even more convincing: a real password.

Phishing Has Changed: What Law Firms Need to Watch For

Posted on by

October is Cybersecurity Awareness Month, making it a good time for law firms to revisit one of the most common cybersecurity threats their employees face: phishing.

For years, people were told to identify phishing emails by looking for obvious warning signs such as poor grammar, misspelled words, strange formatting, or awkward language. While those clues can still appear, relying on them alone is no longer enough.

Modern phishing messages can be polished, professional, and highly convincing. They may reference a real attorney, client, transaction, vendor, or internal business process. With AI making it easier to generate natural-sounding messages quickly, even a well-written email may deserve a second look.

The question employees should ask is no longer simply:

“Does this email look fake?”

A better question is:

“Is this person asking me to do something unusual?”

The Warning Signs Have Changed

Consider this scenario.

An employee receives an email that appears to come from a partner at the firm:

“I’m tied up. I need this wire sent immediately. Don’t call — I can’t answer.”

The email address may look right. The writing may sound professional. The request may even reference a legitimate matter.

The danger becomes clearer when you focus on the behavior of the request, rather than the appearance of the email.

Here are several elements law firm employees should learn to recognize.

1. Urgency

Phishing attempts often create pressure to act immediately.

A message may say a payment must be sent right away, a document needs to be opened before a deadline, or an account will be locked unless the recipient responds.

Urgency is effective because it reduces the amount of time people spend thinking about the request.

When a message pushes an employee to move unusually fast, that should be a signal to stop and verify.

2. Pressure to Bypass Normal Procedures

A particularly important warning sign is a request to ignore the firm’s established process.

Examples might include:

  • Sending a wire without the usual approval.
  • Changing banking information without confirming it.
  • Providing confidential information through an unfamiliar method.
  • Skipping a required phone verification.
  • Being told not to contact the person making the request.

Legitimate requests should still be able to withstand normal verification procedures.

3. Unexpected Financial Changes

Law firms frequently handle money, settlement funds, invoices, retainers, and client transactions, which makes financial requests especially important to verify.

Employees should be cautious when a client suddenly provides new wire instructions, a vendor changes its banking information, or someone requests that money be sent to a different account than usual.

Even when the email looks legitimate, a financial change should be confirmed through a trusted channel.

4. Requests for Credentials or Confidential Information

Phishing is not limited to stealing money.

Attackers may also try to obtain usernames, passwords, documents, client information, access codes, or other sensitive data.

A request for credentials or confidential information that seems unusual—or that arrives through an unexpected channel—should trigger verification before anything is shared.

5. Instructions Not to Verify

One of the strongest warning signs may be an attempt to discourage verification.

Messages such as:

“Don’t call me.”

“I’m unavailable.”

“Just take care of this now.”

should receive additional scrutiny when paired with a sensitive or unusual request.

An attacker benefits when an employee feels that confirming the request would be inconvenient or inappropriate.

Create a Simple Verification Procedure

Law firms do not need an overly complicated policy to reduce this risk.

Start by defining which requests require additional verification. Financial transactions, changes to payment instructions, requests for credentials, and releases of confidential information are good places to begin.

Then determine how employees should verify those requests.

That could mean calling a phone number already stored in the firm’s records, contacting the person through a trusted internal channel, or following an established approval process.

Most importantly, employees should know that they have permission to stop before acting.

A simple statement can become an effective cybersecurity habit:

“Before I do this, I’m going to verify it.”

As phishing messages become more convincing, slowing down and verifying unusual behavior can be more valuable than trying to decide whether an email simply “looks fake.”

Cybersecurity Awareness Month is an excellent opportunity to make that expectation clear across your law firm.

How Artificial Intelligence May Affect Legal Malpractice Insurance

Posted on by

Artificial intelligence is becoming a regular part of everyday office operations. Many attorneys and law firms are already using AI in some form, whether they realize it or not.

A Question We’re Hearing From Clients

Recently, a client contacted me because he was concerned about whether using AI could affect the coverage provided by his legal malpractice insurance policy.

At this time, I am not aware of any changes to the policy forms used by the legal malpractice insurance carriers we work with. I am also not aware of any new exclusions, underwriting restrictions or major pricing changes specifically related to the use of AI.

What the Carriers Are Saying

Although we do not work with every carrier that offers legal malpractice insurance, we regularly work with four or five of them. I contacted several of those carriers to confirm their current positions.

As of right now, none of them have made changes to their policies or introduced specific exclusions related to AI. However, they did confirm that the use of artificial intelligence is being discussed regularly within the insurance industry.

Questions the Insurance Industry Is Considering

Carriers are considering questions such as:

  • Should policies include exclusions related to AI?
  • Should there be restrictions on coverage?
  • Should firms that use AI pay higher premiums?
  • Should carriers provide specific guidelines for using AI in a legal practice?

There are no definite changes to report at this time, but I do believe changes are likely coming.

Changes May Be Ahead

AI is being used more frequently in law firms and businesses of all kinds. Because of that, it is reasonable to expect insurance carriers to eventually address how AI use may affect coverage, underwriting and pricing.

Hopefully, carriers will also provide clear guidelines explaining how attorneys can use AI responsibly within their practices.

What Attorneys Should Know Right Now

For now, the important thing to know is that you are not the only attorney thinking about this issue. The legal malpractice carriers we work with have not made any policy changes yet, but the topic is actively being discussed.

If any changes are made, we will naturally be in touch with our clients to explain what has changed and how it may affect their coverage.

Have Questions About AI and Your Coverage?

If you have questions about how you are currently using AI in your practice, please do not hesitate to contact me. I would be happy to discuss your situation and involve the insurance carrier if necessary.

I’m Don I, your insurance guy.

Get Comfortable Shoes

Posted on by

I recently bought a new pair of leisure shoes.

That may not sound like a big deal, but these are probably the most comfortable shoes I’ve owned in decades.

Believe it or not, I had been wearing the same brand of tennis shoes I wore in high school and college. They were getting harder to find, but I kept making the effort.

Why?

Because they were familiar.

My wife and daughters kept telling me, “Don, those shoes are out of style, and they can’t possibly be comfortable.”

Eventually, I tried on the shoes they recommended.

I couldn’t believe what I had been missing.

It felt like I was walking on air. I had become so accustomed to my old shoes that I didn’t realize how uncomfortable they actually were.

Naturally, I started thinking about how this relates to my work and my company.

How many things do we continue doing the same way simply because that is how we have always done them?

When I looked at my own typical workweek, I realized there were still a few things I was doing the same way I had done them 20 or 30 years ago.

Not because they were the best methods.

Just because.

Technology has made many parts of our lives easier, but we do not always take advantage of it. Sometimes we dismiss a new system by saying, “I’m good,” or, “I don’t have the time or interest to change.”

But think about how much has changed in the tools we use every day:

Many of these changes are designed to make our lives easier and, perhaps more importantly, make things easier for our clients.

One small change we made involved our post office routine.

Our mail is delivered to a P.O. box, and someone from the office used to make a trip there every day. Sometimes we had mail. Sometimes we didn’t.

On the days when the box was empty, we had wasted time and gas.

A friend told me about the Postal Service’s Informed Delivery program. Each morning, we can receive images of the mail expected to arrive that day.

No picture, no trip to the post office.

It was a very small change, but it saved us time, money and unnecessary effort.

Comfortable.

I suggest taking a little time to look at what you do, how you do it and what equipment or systems you use.

Are you still doing something the same way simply because it is familiar?

There may be a better, easier and more comfortable option available.

Get comfortable shoes.

You’ll love them.

I hope this helps.

I’m Don I, your insurance guy.

Cyber Risk for Law Firms: People, Vendors, and Insurance Coverage

Posted on by

In Part 1, we talked about Verizon’s 2026 Data Breach Investigations Report and why law firms should pay attention to vulnerability exploitation and ransomware.

Now let’s talk about two other issues that are especially important for law firms: the human element and third-party risk.

The human element continues to play a major role in data breaches. The 2026 Verizon report found that the human element was present in 62% of breaches. That does not mean employees are bad. It does not mean lawyers or staff members are careless. It means people are busy, and cybercriminals know how to take advantage of that.

Lawyers, paralegals, office managers, and administrative staff deal with emails, phone calls, text messages, invoices, attachments, wire instructions, document requests, calendar invitations, and client questions all day long. In that environment, one message that looks legitimate can create a serious problem.

And these attacks are not limited to the obvious phishing email with poor grammar and misspelled words. Verizon’s report points out that social engineering is moving beyond email. Attackers are using phone calls, text messages, mobile devices, fake IT support requests, fake vendor communications, and fake client messages. Verizon’s SMB-focused summary also notes that mobile-based phishing simulations had a 40% higher median success rate than email-based simulations.

For law firms, that should get your attention.

A fake wire instruction can lead to a financial loss. A fake password reset can give someone access to your systems. A fake document link can compromise a computer. A fake call from “IT support” can trick someone into sharing access. A fake email that appears to come from a client can start a chain of events that becomes much larger than one message.

So the question should not be, “Does this message look real?”

The better question is, “Did we verify this through a trusted process?”

That is an important distinction. Cybercriminals are trying to create urgency. They want someone to act quickly. They want someone to skip the normal process. That is why law firms need written procedures for payment changes, wire instructions, password resets, file access, and unusual client or vendor requests.

If new wire instructions are received, they should be verified through a known phone number already on file – not the number in the email. If someone requests access to sensitive information, there should be a clear approval process. If someone claims to be from IT support, staff should know how to confirm that request before giving access.

The second issue is third-party risk.

Most law firms rely on outside vendors. That is normal. But it also means your cyber risk is not limited to what happens inside your own office. Verizon’s 2026 report found that breaches involving third parties increased and now account for 48% of breaches.

Think about the vendors that may touch a law firm’s data or systems: IT providers, cloud software companies, case management platforms, document storage systems, billing software, phone providers, payment processors, marketing vendors, and other outside services.

If those vendors have access to your data, your systems, or your credentials, their security matters too.

That does not mean every law firm needs to conduct a full-scale security audit of every vendor. But firms should be asking basic questions before there is a problem.

Do they use multifactor authentication? Do they have written security procedures? Do they carry cyber insurance? What happens if they have a breach involving your data? Who has to notify whom? Who pays for what? How quickly will you know?

Those questions are much easier to ask before something goes wrong.

The same is true for your own cyber insurance coverage.

A law firm should know what its policy actually covers before there is a claim. Does the policy provide coverage for ransomware? Business interruption? Data restoration? Breach response costs? Social engineering fraud? Funds transfer fraud?

Are there sublimits? Are there exclusions? Are there conditions that must be satisfied before coverage applies?

And one of the most important questions is this: did the firm accurately answer the questions on the cyber insurance application?

If the application says the firm has multifactor authentication, but MFA is only being used in some places — or not at all — that can become a very serious issue after a claim. If the application says backups are being performed and tested, but no one has verified that, the firm may have a problem when coverage is needed most.

The lesson from the 2026 Verizon report is not that law firms should panic. It is that law firms should prepare.

Review your procedures. Review your vendors. Review your cyber insurance. Make sure your written practices match what is actually happening inside the firm.

Because when a cyber incident happens, the issue is not only whether your computers can be restored.

The issue is whether your firm can keep operating, protect your clients, meet your obligations, and recover financially.

And the worst time to find out you are not prepared is after the breach.

The 2026 Verizon Data Breach Report Is Out: Why Law Firms Should Pay Attention

Posted on by

Verizon recently released its 2026 Data Breach Investigations Report, and law firms should take note. 

Each year, the DBIR provides a useful look at what is actually happening in cyber incidents and confirmed data breaches. It is not based on speculation or scare tactics. It is based on real-world reported incidents.

For law firms, especially small and mid-sized firms, the report is another reminder that cybercriminals are not only targeting large corporations. They are looking for opportunity. If a system is exposed, software is unpatched, credentials are stolen, or remote access is poorly protected, that may be enough to create a serious problem.

The DBIR does not break out Pennsylvania law firms as their own category, but law firms generally fall within the broader professional services category. In that category, Verizon reported 3,578 incidents and 2,558 confirmed data breaches. The top breach patterns for professional services were system intrusion, social engineering, and basic web application attacks.

That should not surprise anyone. Law firms hold valuable information. Client files, settlement details, trust account information, tax records, employment records, business documents, family information, medical information, and other confidential materials may all be sitting inside a law firm’s systems. To a cybercriminal, that data can be valuable.

One of the most important findings in the 2026 report is the rise of vulnerability exploitation. According to Verizon’s SMB-focused summary, vulnerability exploitation as an initial access vector is now up to 31%, which is jump from the prior year. The same summary also notes that the median time to fully resolve a critical vulnerability is now 43 days.

In plain English, attackers are increasingly getting in through unpatched software, exposed systems, remote access tools, web applications, and other technology that has not been properly secured.

For a law firm, that matters. 

Most firms now rely heavily on technology to operate. Email, case management software, cloud storage, billing systems, document management platforms, remote access tools, outside IT providers, phone systems, and payment processors may all be part of the firm’s day-to-day operations. Every one of those systems creates some level of exposure if it is not patched, configured, monitored, and protected.

The second major issue is ransomware. 

The DBIR explains that ransomware was involved in 48% of breaches, while also cautioning that this statistic should not be read as the probability that any one organization will be hit. Instead, it means that among the detected and reported breaches in the DBIR dataset, 48% involved ransomware.

For a law firm, ransomware is not just an IT inconvenience. If systems are locked, the firm may not be able to access calendars, client files, email, billing records, or key documents. Attorneys may have trouble communicating with clients, meeting deadlines, sending invoices, or continuing normal operations.

If data was taken before the systems were encrypted, the issue becomes even more serious. The firm may also be dealing with client notification obligations, reputational harm, possible ethics concerns, and an insurance claim.

That is why cyber risk cannot be viewed only as an IT issue. For law firms, it is also a management issue, a risk management issue, and an insurance issue.

The key takeaway from the first part of this discussion is simple: law firms should not assume they are too small, too local, or too specialized to be targeted. Cybercriminals are looking for weak points. An unpatched system, stolen credential, exposed remote access tool, or poorly protected application may be enough to create a breach.

Now is a good time for law firms to review the basics with their IT provider. Are systems being patched? Is remote access protected? Are backups in place? Are critical applications monitored? Are vulnerabilities being addressed quickly? Are access points protected with multifactor authentication?

Law firms should also look at these issues through the insurance lens. If a breach or ransomware event happens, does the firm understand what its cyber policy may cover? Are there exclusions, sublimits, or security requirements that could affect coverage? Has the firm accurately represented its security controls on the insurance application?

The 2026 Verizon DBIR is not a reason for law firms to panic. It is a reason to prepare.

Cybercriminals are looking for opportunity. Law firms need to make sure their systems, procedures, vendors, and insurance coverage are ready before an incident happens.

Will Cyber Insurance Cover a Law Firm Wire Fraud Loss?

Posted on by

Law firms are prime targets for wire fraud. 

Attorneys regularly handle sensitive financial transactions involving trust accounts, retainers, settlements, real estate closings, vendor payments, and client funds. That makes law firms attractive to cyber criminals who know that one convincing email can lead to a very expensive mistake.

A typical wire fraud scenario:

It starts with an email that looks legitimate. It may appear to come from a client, a title company, opposing counsel, a vendor, or even someone inside the firm. The email may include a real matter name, familiar language, and wiring instructions that seem reasonable. In some cases, the fraudster has gained access to an actual email account. In other cases, the email address is simply spoofed or altered slightly.

The firm wires the money. Then, after the transfer is complete, someone realizes the instructions were fraudulent.

At that point, the firm has two immediate concerns. 

First, can the money be recovered? 

Second, will insurance cover the loss?

Many attorneys assume that if their firm has cyber liability insurance, a wire fraud loss will automatically be covered. Others assume the loss will fall under crime coverage or lawyers professional liability insurance. Unfortunately, the coverage answer is not always that simple.

Wire fraud can fall into a complicated area between different types of policies. A cyber policy may include coverage for social engineering fraud or funds transfer fraud, but that coverage may be limited by a sublimit. The policy may also include conditions that must be satisfied before coverage applies. For example, the firm may be required to follow specific verification procedures before transferring funds.

A crime policy may also provide coverage in certain situations, but not every fraud scenario fits neatly into the policy language. Lawyers professional liability insurance, meanwhile, is generally designed to respond to professional negligence claims. It should not be treated as a catch-all policy for every financial loss connected to a cyber event.

That is why law firms should not assume they are covered just because they have “cyber insurance” listed on a policy. The details matter.

Firms should review whether their policies address social engineering fraud, fraudulent instruction schemes, and funds transfer fraud. They should also pay close attention to sublimits, exclusions, deductibles, and any required internal controls. A policy may provide a $1 million cyber limit, but the amount available for social engineering fraud could be much lower.

Just as important, the firm’s internal procedures should match the risk.

Email alone should never be enough to change wiring instructions or authorize a transfer. 

If new or revised instructions are received, the firm should verify them using a trusted phone number already on file – not the phone number included in the suspicious email. Any last-minute change, unusual urgency, or request to bypass normal procedures should be treated as a red flag.

Wire fraud prevention is not just an IT issue. It is a law firm management issue, a risk management issue, and an insurance issue.

Before a loss occurs, attorneys should speak with their insurance advisor and review their coverage carefully. The goal is to understand what coverage may apply, what limits are available, and what procedures the firm must follow.

The worst time to discover a gap in coverage is after the money is gone. If your law firm handles wire transfers or client funds, make sure you know how your insurance would respond before a fraud attempt turns into a claim.

What Happens to Prior Acts Coverage When an Attorney Leaves a Law Firm?

Posted on by

Are You Leaving Your Law Firm? 

What are you doing about your Prior Acts Coverage?

When an attorney leaves one firm to join another, merges a solo practice into a larger firm, or shuts down an existing office, there are usually many practical issues to address. Client files have to be transferred. Engagement letters may need to be updated. Conflicts need to be checked. Staff, leases, technology, and client communications all have to be handled carefully.

But one issue that can easily be overlooked is lawyers professional liability coverage — specifically, what happens to your prior acts.

Prior acts are the legal services performed before the attorney joins the new firm or before the old policy ends. Even if the attorney has no known claims, no pending disputes, and no reason to believe anything went wrong, that does not mean the exposure disappears. 

Unfortunately, a malpractice claim can arise months or even years after the legal work was completed…That is why attorneys need to know exactly which policy will respond if a claim is made later.

A common mistake is assuming that the new firm’s malpractice policy will automatically cover the attorney’s past work. 

In many cases, it will not. 

The new firm may be willing to cover the attorney for work performed after joining the firm, but that does not necessarily mean it wants to accept responsibility for past files.

From the new firm’s perspective, that is understandable. The firm did not supervise the attorney’s prior matters. It did not collect the fees. It did not manage the client relationships. It had no control over how those services were performed. As a result, the firm may not want its insurance limits exposed to a claim involving work done before the attorney ever joined the firm.

Even if the new firm is open to the idea, its insurance carrier may not be. The carrier may agree to add the attorney going forward, but refuse to include prior acts coverage. That leaves the attorney with a critical question: 

How will claims arising from past work be covered?

In many situations, the answer is tail coverage, also known as an extended reporting period. 

Tail coverage allows an attorney to report future claims based on work performed before the policy ended. It does not provide coverage for new legal work. Instead, it protects against claims tied to past services.

The cost of tail coverage can surprise attorneys. It is typically based on the last premium paid. 

For example, if the attorney’s annual premium was $3,000, an unlimited tail might cost somewhere around $9,000. In many cases, tail coverage can be approximately 255% to 300% of the current premium.

[show this as an image]

That cost should be discussed before the move happens, not after. If a solo attorney is closing a practice to join another firm, or if an attorney is leaving a multi-person firm, the parties should address prior acts coverage directly.

Key questions to discuss include:

  • Who is responsible for the prior acts exposure?
  • Will the new firm’s policy pick it up?
  • Will the new firm’s carrier allow it?
  • Does the attorney need to purchase tail coverage?
  • Who will pay for that tail?

In some cases, the attorney may be able to negotiate the issue. The new firm might agree to pay for the tail instead of adding the prior acts to its own policy. The parties might split the cost. Or the cost might become part of the overall merger, acquisition, or compensation discussion.

The important point is that this should never be assumed.

Before leaving a firm, closing a solo office, or joining a new practice, attorneys should speak with their lawyers professional liability insurance advisor. A careful review can help prevent a dangerous gap in coverage.

Your prior work does not disappear just because you move to a new firm. Make sure your prior acts are protected before the transition is complete.

The Facebook Verification Scam That’s Stealing Business Accounts

Posted on by

Key Takeaway

If you receive a Facebook message claiming your business page is about to be disabled, proceed with caution. Many of these messages are phishing scams designed to steal your Google or Microsoft login credentials—not just your Facebook account. Once cybercriminals gain access to your email account, they may be able to access other business systems, reset passwords, and compromise sensitive information.

Why So Many Business Owners Are Seeing These Messages

Over the past several months, many business owners have reported receiving Facebook messages claiming that their page has violated advertising policies, posted prohibited content, or is about to be restricted unless they complete a verification process.

At first glance, these messages often appear legitimate.

They may use Facebook logos, professional formatting, and language that creates a sense of urgency. The message often warns that your account will be disabled or restricted if you fail to act immediately.

Unfortunately, that’s exactly what scammers are counting on.

Their goal is to create enough concern that you react before taking the time to verify whether the message is legitimate.

How the Scam Typically Works

The process usually starts with a message that appears to come from Facebook.  It is normally sent to your email address.

The message encourages you to click a link to verify your account or appeal a policy violation.

Once you click, you’re often taken to a website that looks very similar to Facebook’s login page.

At that point, the scam takes an unexpected turn.

Instead of asking you to verify your Facebook credentials, you’re asked to log in using Google or Microsoft.

For many people, this doesn’t seem unusual. After all, we use Google and Microsoft accounts to access countless online services every day.

But this is where the real danger begins.

The Real Target Is Often Your Email Account

Many people assume the scammers are trying to steal their Facebook account.

In reality, the bigger target is often your email account.

If a cybercriminal gains access to your business email, they may be able to:

  • Reset passwords for other accounts
  • Access sensitive business communications
  • Review financial information
  • Access cloud storage systems
  • Compromise additional business applications
  • Impersonate employees or business owners
  • Start wire transfers

For law firms, accountants, financial professionals, and other businesses that handle confidential information, the risks can be even greater.

Why Two-Factor Authentication Doesn’t Always Stop the Scam

Many business owners assume that two-factor authentication (2FA) will completely protect them.

While 2FA remains one of the most important cybersecurity tools available, sophisticated phishing attacks can sometimes work around it.

In these scams, victims are often asked to enter both their password and their authentication code.

The victim believes they are verifying their identity.

In reality, they are providing the scammer with the exact information needed to access the account in real time.

This type of attack is one reason cybersecurity experts continue to emphasize awareness and employee training in addition to technical security measures.

What Can Happen After an Account Is Compromised?

Once a cybercriminal gains access to an email account, the consequences can spread quickly.

We’ve seen situations involving:

  • Compromised business email accounts
  • Fraudulent wire transfers
  • Stolen social media accounts
  • Data breaches
  • Business interruption
  • Reputational damage

For many small businesses, the financial impact can be significant, especially when operations are disrupted or sensitive information is exposed.

How to Protect Yourself

Fortunately, there are a few simple steps that can help reduce your risk.

If you receive a message claiming Facebook is about to disable your account:

  1. Do not click the link in the message.
  2. Open a new browser window.
  3. Go directly to Facebook.com.
  4. Log in normally and check your notifications.
  5. Verify any account warnings through official Facebook channels.

Most importantly, slow down.

Scammers rely on urgency. The more rushed you feel, the more likely you are to make a mistake.

You should also look at the sender’s actual email address and the URL that the link sends you to.  Be sure to block that sender in your email.

How To Protect Yourself From Scams Like This

Cybercriminals continue to find new ways to trick business owners into giving away valuable credentials. What makes the Facebook verification scam particularly effective is that it combines social engineering, phishing, and urgency into a message that appears legitimate.

Good cybersecurity practices are always your first line of defense. However, businesses should also understand their exposure and review whether they have appropriate cyber liability insurance coverage in place.

Sometimes what looks like a simple Facebook notification can become a very expensive mistake. Taking a few extra moments to verify a message today may save your business from a much larger problem tomorrow.