CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, SMB1001
Why law firms are targeted
Property settlements and trust account payments are the classic target. An attacker gets into a mailbox (yours, your client's or the other side's), waits for a settlement, then sends new bank details that look legitimate. Once the money has gone it is rarely recovered.
Firms are also targeted for what they know. Matter files, commercial negotiations and personal disputes are valuable to criminals and embarrassing to lose, and a breach can be a professional conduct issue as well as a privacy one.
What the legal & professional check asks about
The quick check has 20 questions and the full assessment 44. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- Confidentiality & legal privilege
- Trust account protection
- Conveyancing / settlement fraud
- File retention & disposal
- Secure document exchange
- Secure remote / court working
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Confidentiality. The duty to keep client information confidential applies to every practice, whatever its size, and extends to how that information is stored and sent.
- Trust money. State legal profession laws set strict rules for trust accounts; losing trust money to fraud is a serious regulatory matter.
- Electronic conveyancing. Subscribers to e-conveyancing platforms take on security obligations under the participation rules, including protecting access credentials and verifying who they are dealing with.
- The Privacy Act. Firms with annual turnover above $3 million must comply with the Australian Privacy Principles and the Notifiable Data Breaches scheme.
- Ransomware payments. Firms with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Verify every change of bank details by phone using a number from your own file, never from the email
- Warn clients early, in writing, that you will never change bank details by email
- Turn on multi-factor authentication for email, practice management and e-conveyancing
- Use a secure portal for sensitive documents instead of email attachments
Start the free legal & professional check
Frequently asked questions
How do law firms stop settlement payment fraud?
Treat any change of bank details as suspicious, confirm it by calling a number already on your file, warn clients at the start of a matter that you will never change bank details by email, and protect every mailbox with multi-factor authentication.
Does the Privacy Act apply to small law firms?
The Australian Privacy Principles generally apply to firms with annual turnover above $3 million. Smaller firms may be exempt from the Act, but professional confidentiality duties still apply in full.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.