The Caller Says They're Your IT Company. Are They?
Check Out The Warning From The FBI
Click the image to view the full PDF!
If someone called your law firm tomorrow claiming to be from IT, would your team know how to check?
It's not a hypothetical question. In May, the FBI warned law firms across the country about a group that does exactly this. They send an email about an invoice or a computer problem and wait for someone at the firm to call the number in it. From there, "IT support" walks the employee through installing remote access tools, copies client files, and demands payment to keep them private. No broken firewall. No sophisticated hack. One helpful employee, doing what seemed right.
And law firms are getting hit. In the last few months alone, Greenberg Traurig, Eckert Seamans, Herbert Smith Freehills Kramer, and Goodwin have all disclosed data breaches (the reported causes vary), and recent state breach notices show the same one-person-tricked pattern at smaller firms: someone was socially engineered, and client documents were exposed.
Here's the uncomfortable truth for smaller firms: attackers are not skipping you. They're counting on you. Large firms have security teams. A five-attorney practice in Houston has a busy office manager and an IT company they call when something breaks. That's exactly the gap these scams are built for.
How the scam actually works
The playbook the FBI describes is simple, which is what makes it dangerous:
The bait. An email arrives about an invoice, a billing issue, or a computer problem. It looks routine.
The call. The email asks you to call a number to resolve it. The person who answers is polished, patient, and sounds like every IT technician you've ever talked to.
The access. "IT" asks you to install a remote support tool so they can fix the problem. In some cases, someone has even shown up in person claiming they need to back up a computer.
The theft. Instead of encrypting your files like classic ransomware, they quietly copy client documents, then threaten to publish them unless you pay.
Every step of that chain is social engineering: a real cyberattack that runs on trust, not on breaking technology.
Five habits that reduce the risk
The good news is that the defenses are mostly habits, not expensive technology:
Decide now how your real IT identifies itself. Your team should know that your IT company will never call out of the blue asking for remote access, and exactly what to do if someone does.
Hang up and call back on a number you already have. Never use the phone number or link inside an unexpected email. If the request is real, it will survive a two-minute verification.
No remote access tools from unsolicited contact. Treat any unexpected request for remote access as unverified until you confirm it through a channel you already trust.
Check ID for anyone who shows up in person. A polo shirt and a USB drive are not credentials. A quick call to your IT provider confirms whether they sent someone.
MFA on every account, trained people on every team. Multi-factor authentication limits the damage when a password slips, and a 30-minute team conversation about this exact scam is the cheapest insurance you'll buy this year.
What real IT support looks like
Law firms hold what clients can't afford to lose: privileged documents, financial records, settlement details, personal information. Protecting that isn't just software. It's knowing who your IT people are before the phone rings.
At First IT Solutions, we believe IT support should work that way: a team you know, contact you can verify, and protections in place before something goes wrong. We help Houston-area law firms put practical protections in place, from verification procedures and security training to document management built for legal work, so a convincing voice on the phone is much less likely to get through.
If you're not sure how your firm would handle that call, that's the conversation to have now, not after. Reach out to First IT Solutions and we'll talk through how your firm handles email, remote access, and document security. No pressure, no jargon.
If protecting client files is a priority for your firm, learn more about our approach to document management for law firms.
Because the next time someone calls claiming to be IT, your team should already know the answer.
