Most solicitors send sensitive contracts, identity documents, and completion statements as PDF attachments via standard email. This is the digital equivalent of sending a confidential contract on a postcard and hoping the postman does not read it. Standard email is not a private channel; it is a series of handovers between servers, and if any of those handovers lack encryption, the data is readable by anyone with the right tools. For a law firm, this is not just a technical risk; it is a breach of SRA (Solicitors Regulation Authority) standards regarding client confidentiality and a significant GDPR liability.
What secure email actually means for solicitors
When we talk about secure email, we are usually referring to two distinct things: transport security and content encryption. Transport security, specifically TLS (Transport Layer Security), ensures the 'pipe' between your mail server and the recipient's server is encrypted. Most modern providers like Microsoft 365 and Google Workspace use this by default. However, if the recipient is using an old, unencrypted mail server, the email drops back to clear text.
Content encryption, or message encryption, is different. It encrypts the email itself, regardless of the pipe it travels through. The recipient must verify their identity, usually by logging in or receiving a one-time passcode, before they can read the message. This ensures that even if the email is intercepted or the recipient's inbox is compromised, the sensitive contents remain unreadable. For UK law firms, IT support for law firms must prioritise configuring these encryption layers so they are easy for staff to trigger without needing a degree in computer science.
Moving away from the 'attachment' habit
Attachments are the primary cause of version control chaos and security leaks. Once you send a document as an attachment, you lose all control over it. You cannot revoke access, you cannot see who has opened it, and you cannot stop it from being forwarded to the wrong person.
We recommend solicitors move toward sharing documents via secure links in SharePoint or OneDrive rather than attaching files. When you share a link, the file stays on your secure server. You can set an expiry date so the link stops working after 48 hours, or you can block the recipient from downloading the file, forcing them to view it in a secure web browser. If you realise you sent the wrong version, you can disable the link immediately. This provides a level of 'digital shredding' that attachments simply cannot offer.
Protecting against payment diversion fraud
Payment diversion fraud, often called 'Friday afternoon fraud', is the single biggest threat to UK conveyancing firms. It usually starts with a compromised email account. An attacker gains access to a solicitor's or a client's inbox and waits for a transaction to reach its final stages. They then interject, sending an email that looks identical to previous correspondence, claiming the firm's bank details have changed.
Secure email protocols help, but they do not solve this on their own. We advise firms to implement a strict out-of-band verification policy. This means that bank details are never accepted or sent solely via email. They should be provided at the start of a matter via a secure portal or a physical letter, and any changes must be verified via a known phone number. A pattern we see on most tenants we take on is that legacy authentication protocols like POP3 and IMAP are still enabled, which allows attackers to bypass Multi-Factor Authentication (MFA) and gain the access needed to pull off these frauds.
Implementing Microsoft 365 encryption and sensitivity labels
If your firm uses Microsoft 365 Business Premium, you already have the tools to secure your communications; they are just rarely configured correctly. We use sensitivity labels to automate security. For example, a solicitor can click a button labelled 'Highly Confidential' in Outlook. This automatically encrypts the email, prevents it from being forwarded, and adds a watermark to any attachments.
This takes the guesswork out of security. Instead of asking staff to remember complex encryption steps, you give them clear, task-based options. For external clients, this experience is relatively smooth. They receive an email telling them they have a protected message, and they click a link to sign in with their own Google or Microsoft account, or a one-time code sent to their phone. It adds about ten seconds to their process but adds a massive layer of protection to the matter.
When a client portal is better than email
For long-running matters with high volumes of documentation, even encrypted email becomes cumbersome. This is where a law firm client portal is more effective. A portal is a secure website where clients log in to view their case files, upload ID documents, and sign contracts.
From a security perspective, a portal is superior because the data never leaves your environment. You are not 'sending' anything; you are simply granting a client a temporary window into a specific folder. This centralises the audit trail, making it much easier to prove GDPR compliance during an audit. You can see exactly when a client viewed a document, providing a clear record of disclosure that email read receipts cannot reliably match.
Financial implications of a data breach
Consider a hypothetical 10-person law firm. If an unencrypted email containing a client's financial statement is intercepted, the fallout includes an ICO notification, potential fines, and a significant increase in Professional Indemnity (PI) insurance premiums.
A breach that leads to a £250,000 payment diversion might be covered by insurance, but the subsequent premium hike could cost the firm £10,000 to £15,000 extra every year for the next five years. This is before you factor in the billable hours lost to the investigation and the damage to the firm's reputation. Implementing managed IT support with a focus on security typically costs a fraction of a single year's PI insurance increase.
Specific anti-patterns we see in law firms
We frequently encounter these three mistakes when taking over the IT management for legal practices:
- Sending passwords in the same thread: Sending an encrypted PDF and then sending the password in the very next email is pointless. If an attacker has access to the inbox, they have both.
- Using personal email for work: Staff using Gmail or iCloud accounts because the firm's own email system is 'too slow' or 'too hard to use' creates a total loss of data control.
- Failing to disable old accounts: Leavers often retain access to their mailboxes for weeks, providing a massive surface area for attackers to exploit without being noticed.
How Black Sheep Support helps
We help law firms move from basic, insecure email to a setup that meets SRA and Cyber Essentials standards without making life difficult for fee earners. We configure your Microsoft 365 environment to handle encryption automatically, set up secure document sharing, and provide the monitoring needed to catch account compromises before they turn into fraud.
If you want to move your firm away from risky attachments and ensure your client data is actually private
and we will show you how to lock down your communications.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers, or 15 to 20 minutes on your own, no commitment. We also handle hardware, broadband, mobile and networking, ensuring your entire practice is built on a solid foundation.
Frequently Asked Questions
Is standard Microsoft 365 email secure enough for solicitors? By default, it is encrypted in transit but not at rest for the recipient. For sensitive legal matters, you should use the advanced encryption features found in Microsoft 365 Business Premium, which allow you to encrypt the message content and prevent forwarding or printing.
Do my clients need a Microsoft account to read my encrypted emails? No. They can choose to receive a one-time passcode via email. They click a link, a code is sent to them, they enter it, and the message opens in a secure browser window. It is designed to be accessible for clients who are not tech-savvy.
What is the safest way to share large files with clients? Avoid email attachments for files over 10MB. Instead, use a secure SharePoint link with an expiry date and 'block download' enabled if they only need to view the document. This keeps the data under your control and provides an audit log of who accessed it.
How can we stop our firm's email from being spoofed? You must correctly configure SPF, DKIM, and DMARC records in your DNS. These protocols prove to the world that an email claiming to be from your firm actually originated from your authorised servers, which is essential for preventing impersonation fraud.
Want this handled for you? See Managed IT support.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
