Cyber Security for Law Firms in Australia: Trust Account Fraud, Regulator Expectations and What to Test

Cyber security for law firms in Australia comes down to three things: stop email compromise before it redirects trust money, meet your regulator's minimum controls (MFA, strong passwords and security updates come first), and keep client data you're now more likely to be legally responsible for under the Privacy Act. Since 1 July 2026, many small firms that provide AML/CTF designated services must also comply with the Privacy Act for that work, whatever their turnover. Get the basics in place, then get them independently tested so you have evidence, not just a policy.

Law firms ask us about cyber security for two reasons. Either something has gone wrong (a hacked mailbox, a client who paid a fake invoice) or someone is asking for proof: an insurer, a corporate client's procurement team, or a principal who's read the latest regulator guidance. This guide covers why firms are targeted, what Australian regulators and insurers expect, how the AML/CTF reforms change your privacy obligations, which controls matter most, and where penetration testing fits. It's written for principals, practice managers and the IT providers who support small and mid-sized Australian practices.

Why are Australian law firms a target for cyber criminals?

Because law firms move large sums of money through trust accounts and hold exactly the kind of confidential information criminals can sell or ransom. Combine that with busy staff, lots of email and payment instructions that change hands quickly, and you have the conditions business email compromise thrives on.

The numbers back it up:

▸The OAIC received 1,205 data breach notifications in the 2025 calendar year, the highest since the Notifiable Data Breaches scheme began in 2018, and malicious or criminal attacks caused the majority (716). Legal, accounting and management services recorded 81 notifications, putting the sector in the top five by volume (OAIC).
▸ASD's Annual Cyber Threat Report 2024–25 found the top self-reported cybercrimes for business were email compromise without financial loss (19%) and business email compromise fraud with financial loss (15%). The average self-reported cost per report was $56,600 for small businesses and $97,200 for medium businesses.
▸Professional, scientific and technical services made up 6% of incidents reported to ASD's ACSC in 2024–25, alongside health and telecommunications.

The Legal Practitioners' Liability Committee (LPLC), which insures Victorian law practices, says the most frequent cyber claims come from compromised email accounts used to impersonate either the client or the firm and redirect funds. In one claim example, a Victorian firm paid more than $400,000 in estate funds to criminal-controlled accounts after a client's email was compromised (LPLC).

There is some good news. LPLC's 2024–25 Annual Report reported a marked decrease in the number and cost of cyber notifications and claims, which it attributes to greater awareness and behavioural change, and it expects banks' new account name checks to help further. That's evidence the controls work when firms actually use them.

How does trust account fraud actually happen?

Almost always the same way: an attacker gets into an email account, watches a live matter, then sends convincing payment instructions at the right moment. LPLC describes the pattern as an active matter, an email that provides or changes account details, and a recipient who acts on it without fully verifying.

A typical sequence looks like this:

Initial access. A staff member or client enters their password into a fake Microsoft 365 login page, or reuses a password that was leaked elsewhere. Without MFA, that's enough.
Silent monitoring. The attacker reads the mailbox, often adding an inbox rule to hide replies, and waits for a settlement, estate distribution or deposit.
The switch. A "change of bank details" email arrives from the real account (or a lookalike domain), with the right names, matter numbers and tone.
The payment. Money goes to a mule account and is moved on quickly. LPLC notes banks aren't obliged to reimburse funds sent by mistake, and the window to recover money is short (LPLC).

LPLC is blunt about prevention. It says almost all cyber fraud claims notified to it could have been avoided by having multi-factor authentication installed on the firm's systems and devices, and it recommends a strict call-before-you-pay rule: phone a number you already hold on file (never one from the email), read the BSB and account number back in full, file-note the call, and have the person who verified the details make the payment.

What do Australian legal regulators expect from law firms on cyber security?

Regulators now treat basic cyber security as part of competent practice management, and in Victoria, failing at it can be a conduct issue. The Victorian Legal Services Board + Commissioner (VLSB+C) has published Minimum Cybersecurity Expectations that describe controls law practices should implement and conduct "capable of constituting unsatisfactory professional conduct or professional misconduct".

The three critical controls

VLSB+C asks every practice to prioritise three "critical controls" first:

▸Multi-factor authentication on all online accounts and services where it's available. Disabling MFA, sharing MFA codes or approving unexpected sign-in prompts are listed as conduct capable of being UPC or PM.
▸Strong, unique passwords or passphrases, ideally in a password manager. Reusing or sharing passwords is on the conduct list.
▸Security updates on all devices, apps and network hardware, with automatic updates turned on or manual checks at least once a fortnight.

The wider expectations

Beyond the critical three, the guidance covers security software, device security, encryption of confidential data in storage and transit, backups (encrypted, stored separately, restore-tested at least once a year), annual staff training, and procedures to verify client and bank details before acting. Principals with trust authorisation are expected to review trust account transactions regularly.

Other states don't all have an equivalent document, but the direction is the same. The Law Council of Australia runs Cyber Precedent, a cyber security resource for the profession, and your state law society and professional indemnity insurer will typically have guidance too. If you practise outside Victoria, the VLSB+C list is still a sensible benchmark.

Does the Privacy Act apply to my law firm?

If your firm turns over more than $3 million, almost certainly yes. If it's smaller, it now depends on whether you provide AML/CTF designated services. Most small businesses with annual turnover of $3 million or less are exempt from the Privacy Act, but the exemption doesn't apply to some businesses, including AML/CTF reporting entities (OAIC).

That matters because the AML/CTF "tranche 2" reforms started on 1 July 2026. Lawyers, conveyancers and accountants who provide certain designated services, such as assisting with buying or selling real estate, creating or restructuring companies and trusts, or managing client funds for a transaction, are now reporting entities, and newly regulated businesses had to enrol with AUSTRAC by 29 July 2026 (AUSTRAC).

The OAIC's guidance for AML/CTF reporting entities confirms that small businesses that are reporting entities must comply with the Privacy Act for personal information handled for, or in connection with, their AML/CTF obligations. In practice that means:

▸APP 11 applies to that information: you must take reasonable steps to protect it from misuse, interference, loss and unauthorised access.
▸The Notifiable Data Breaches scheme applies, so an eligible breach of customer due diligence records may need to be reported to the OAIC and affected individuals.
▸Retention is now a security issue. The OAIC notes the AML/CTF Act no longer requires you to keep scanned copies of ID documents from commencement, and expects firms to take reasonable steps to destroy or de-identify copies once they're no longer needed.

The OAIC specifically calls out the "honey pot" risk of holding large volumes of identity data for long periods, and lists MFA, patching, audit logs, access monitoring, supplier contracts and a data breach response plan as steps that help. It also says it scales its expectations to a small business's size and resources, but that taking no steps isn't reasonable. For the full picture on APP 11, see our guide to Privacy Act cyber security requirements.

Which cyber security controls matter most for a law firm?

Start with the controls that stop email compromise and ransomware, because those are the incidents that hit firms hardest. Here's how the main expectations line up with what we'd check in a typical small or mid-sized practice:

Control	Why it matters for a law firm	What good looks like
MFA everywhere	Stops most mailbox takeovers that lead to payment fraud	Phishing-resistant MFA on Microsoft 365, practice management, trust accounting and remote access; no exclusions for partners
Email security	Lookalike domains and spoofed emails drive payment redirection	SPF, DKIM and DMARC enforced; external sender tagging; alerts on new inbox forwarding rules
Payment verification	The last line of defence if an account is compromised	Written call-before-you-pay procedure, file notes, client warnings in engagement letters
Patching	Unpatched VPNs and firewalls are a common way in	Automatic updates, a fortnightly check, nothing end-of-life on the network
Admin privileges	Limits how far an attacker can move	Separate admin accounts, no daily use of global admin, reviewed quarterly
Backups	Your recovery plan if ransomware hits	Encrypted, separated from production, restore-tested at least yearly
Data retention	Less data held means less to lose	Review client files regularly, destroy ID copies you don't need
Training	Staff are the ones who see the fake invoice	Induction plus annual refresher, with phishing scenarios specific to settlements and trust deposits

Many of these map directly to ASD's Essential Eight, particularly MFA, patching, restricting admin privileges and regular backups. If you want a structured baseline, our Essential Eight assessment measures each control against Maturity Level 1 or 2 and gives you a prioritised roadmap.

Do law firms need penetration testing?

No Australian legal regulator mandates penetration testing for law firms, but testing is the most reliable way to prove the controls above actually work. A policy that says "we use MFA" is different from evidence that no account, legacy protocol or forgotten admin login bypasses it.

Where testing adds the most value for firms

▸Microsoft 365 and cloud configuration. Most firms run email, documents and identity in Microsoft 365. A cloud penetration test checks for MFA gaps, legacy authentication, risky app consents and over-privileged accounts.
▸External attack surface. Remote access portals, VPNs, client portals and the firm's website. An external test shows what an attacker sees before they're inside; see external vs internal penetration testing for how the two differ.
▸Internal network and Active Directory. For firms with on-premises servers, this tests how far a single compromised laptop could reach.
▸Social engineering. A phishing simulation built around settlement and trust deposit scenarios tests whether staff follow the call-before-you-pay rule under pressure.

Who's asking for evidence

You'll usually be asked for proof of security by cyber and professional indemnity insurers at renewal, corporate and government clients through vendor security questionnaires, and panel or tender applications. Our guide to what cyber insurers require covers the questions underwriters ask and how to answer them honestly.

How much does cyber security cost for an Australian law firm?

It depends on the size of the practice and what you need to prove, but you can start for less than many firms expect. Our current fixed-fee pricing (AUD, from our pricing page):

▸Automated security assessment: $80 to $2,000, depending on targets, with a 24 to 72 hour turnaround. A good first look at your website, client portal or remote access.
▸Human-led penetration test: from $5,000 + GST for an external network test of up to 25 IPs, from $12,000 + GST for combined external, internal and web application testing, and from $20,000 + GST for full-scale engagements including social engineering.
▸Essential Eight assessment: $4,950 + GST fixed fee for environments up to 50 seats, with ML1 or ML2 target maturity, a maturity score, a remediation roadmap and a live debrief.
▸vCISO retainer: $2,500 to $6,500 per month for ongoing advisory, risk register tracking and board-ready reporting, useful if your firm is juggling insurer, client and AML/CTF expectations at once. See our vCISO cost guide.

For context, ASD puts the average self-reported cost of a cybercrime report at $56,600 for small businesses, before you count the reputational damage of telling a client their settlement funds are gone.

What should a law firm do first?

Lock down email, write down your payment verification process, then test. A practical order for most small and mid-sized firms:

Turn on MFA for every account in Microsoft 365, practice management and trust accounting software, and check there are no exclusions.
Adopt a written call-before-you-pay procedure and tell clients in your engagement letter that you'll never change trust account details by email.
Check your AML/CTF position. If you're now a reporting entity, update your privacy policy and collection notices, and make sure your data breach response plan covers customer due diligence records.
Review data retention. Destroy ID copies and old client files you no longer need to keep.
Confirm backups restore. Run a test restore, not just a backup report.
Get independent evidence. Start with an automated security assessment or an Essential Eight assessment, then scope a penetration test around Microsoft 365 and your external perimeter.
Keep it going. Train staff every year, and retest after major changes such as a new practice management system or an office move.

If your IT is handled by an MSP, share this list with them. Independent testing works best alongside your provider, not instead of them, and it gives both of you a clear, prioritised list to work through.

Frequently asked questions

Is cyber security mandatory for law firms in Australia?

There's no single cyber law for law firms, but regulators expect it. VLSB+C's Minimum Cybersecurity Expectations describe failures such as not using MFA as conduct capable of being unsatisfactory professional conduct or misconduct, and the Privacy Act requires reasonable security steps for covered firms.

Does the Privacy Act apply to small law firms?

Firms with turnover of $3 million or less are generally exempt, but from 1 July 2026 small firms that provide AML/CTF designated services must comply with the Privacy Act for personal information handled for those obligations, including the Notifiable Data Breaches scheme.

What is the biggest cyber risk for Australian law firms?

Email compromise leading to payment redirection. LPLC says the most frequent cyber claims involve compromised email accounts used to impersonate clients or firms and redirect funds, and that almost all could have been avoided with MFA.

What is call-before-you-pay?

A rule that any instruction to pay money or change bank details is verified by phone using a number already on file, not one from the email. The details are read back in full, the call is file-noted, and the person who verified them makes the payment.

Do law firms need a penetration test?

It isn't mandated by legal regulators, but insurers, corporate clients and tenders increasingly ask for evidence of security testing. A test focused on Microsoft 365 and your external perimeter is a practical starting point for most firms.

How often should a law firm test its security?

At least annually, and after significant changes such as a new practice management system, a cloud migration or an office move. Automated assessments can run more often between human-led tests.

Can our IT provider do the testing?

They can run scans, but independent testing avoids the provider marking its own homework and is more credible to insurers and clients. The best results come when the tester and your IT provider work together on the fixes.

Bottom line

Australian law firms are targeted because they hold trust money and confidential information, and most losses still start with a compromised mailbox. Regulators now expect MFA, strong passwords and patching as a minimum, and the AML/CTF reforms have pulled many smaller firms into the Privacy Act for their customer due diligence data. The firms that do well get the basics right, write down how they verify payments, and get independent evidence that it all works.

If you'd like to know where your practice stands, book a 1-on-1 call and we'll recommend the smallest scope that gives you real evidence, whether that's an $80 automated assessment, an Essential Eight assessment or a full penetration test. Full details are on our pricing page.

Sources

This article is general information only, not legal, regulatory, privacy or insurance advice. Check your own obligations with your regulator, AUSTRAC, the OAIC and your professional indemnity insurer. Prices are current as of October 2026, and sources were checked on 28 October 2026. Only test systems you have written authority to assess.