ALIAlert: Canadian Lawyers Targeted by Sophisticated Voice Phishing Attacks
ALIAlert: Canadian Lawyers Targeted by Sophisticated Voice Phishing Attacks
Canadian Centre for Cyber Security issues an alert regarding an ongoing voice phishing campaign.
The Canadian Centre for Cyber Security (CCCS) issued an alert regarding an ongoing voice phishing (“vishing”) campaign targeting Canadian organizations, including those in the legal sector. Attackers are impersonating IT support personnel and directing individuals to fraudulent sign-in pages designed to steal credentials and bypass multi-factor authentication (MFA).
ALIA has learned of several recent incidents in which law firm employees fell victim to the scam. ALIA urges lawyers and firm administrators to share this ALIAlert with all employees and to stress the importance of vigilance against increasingly sophisticated and coordinated phishing and vishing attacks.
Law firms and legal professionals are appealing targets because they hold sensitive client information, financial records and other confidential material. The Cyber Centre reports that attackers may contact victims by telephone, Microsoft Teams, or other channels, claiming that urgent action is required to reset a password, enroll in Multi factor Authentication (MFA), or complete a security update.
What Lawyers and Firm Administrators Should Do
- Treat unexpected IT support calls, Teams messages, emails, or urgent requests with caution.
- Confirm who is contacting you before taking action.
- For a Teams call, ask the caller to turn on their camera and compare them with their official company profile photo, but remember that video alone does not prove identity.
- If you are unsure, end the call and contact the person or your IT provider using contact information you already trust—not details supplied by the caller.
- Never share passwords or authentication codes, approve an MFA prompt you did not initiate, or change authentication settings at a caller’s request.
- Verify the caller independently before sharing your screen or allowing remote access to your computer.Pay attention to security or suspected-scam warnings in Teams and stop the interaction if something does not look right.
- Ensure MFA is enabled on professional accounts and report suspicious activity to your IT provider or cybersecurity contact immediately.
- If you suspect a breach, contact your cyber insurance provider promptly for breach support.
Protecting Client Information Is Everyone’s Responsibility
A single compromised account can provide attackers with access to confidential client files, email communications, financial records, and other sensitive information. Lawyers and law firms are encouraged to discuss this threat with their staff and review their cybersecurity practices to help safeguard client information and maintain public confidence in the legal profession.
If you receive an unexpected request to change a password, re-enroll in MFA, or grant access to your account, stop, verify, and report before proceeding. When in doubt, contact your IT provider using a trusted contact method rather than relying or acting on information supplied by the caller.
If you believe you have been targeted by potentially fraudulent activity, please contact ALIAlert.
ALIA does not provide legal advice. ALIAdvisory newsletters, ALIAlert fraud warnings, ALIAction notices and the content on ALIA’s website, notices, blogs, correspondence, and any other communications are provided for general information purposes only and do not constitute legal or other professional advice or an opinion of any kind. This information is not a replacement for specific legal advice and does not create a solicitor-client relationship.
ALIA may provide links to third-party websites. Links are provided for convenience only; ALIA does not vet or endorse the information contained in linked websites or guarantee its accuracy, timeliness, or fitness for a particular purpose.