Law Firms: Client Confidentiality, Wire Fraud and AI Tools

Briefing

Small firms hold settlement figures, wire instructions, medical records and business plans. ABA Model Rule 1.6 requires reasonable efforts to prevent unauthorized access to or disclosure of client information. Check your state bar's version of the rule for the exact wording that applies to you.

On July 29, 2024, the ABA issued Formal Opinion 512, its first formal guidance on generative AI. It points to competence, confidentiality, client communication and reasonable fees. A lawyer using AI must protect information relating to the representation, and generally cannot bill a client for time spent learning the tool.

The most common losses we see are not exotic. Business email compromise redirects a closing payment. A phone call that appears to come from a client confirms a changed account number. Call authentication under STIR/SHAKEN helps carriers verify caller ID on IP networks, but it does not replace a callback to a number you already have on file.

What to do

Require MFA on email and every remote path, starting with partners and anyone who handles trust account transfers.
Set a rule: wire instruction changes are confirmed by calling a known number, never a number in the email.
Use business AI accounts with training on your data turned off. Keep client identifiers out of tools that have not been reviewed.
Write a one page AI policy and have a person verify every citation and fact before it leaves the office.
Encrypt laptops and phones used for client work, with remote wipe enabled.

How to verify

Review mailbox forwarding rules for every user. Unexpected external forwards are a common sign of compromise.
Run a tabletop: a client emails new wire instructions. Walk through who calls whom, and on what number.
Confirm the AI tools in use and their data retention settings in writing.

Sources

Questions about your phones, network or IT? Contact Texwan.