Law Firm and Client Impersonation
Law Firm and Client Impersonation
< BLOG
Could a lookalike web address be mistaken for your law firm?
A website does not have to belong to your firm to use its name. Law firm and client impersonation is on the rise with new AI tactics aiding the speed at which they strike.
The Solicitors Regulation Authority’s scam alerts document cases where websites have misused genuine firms’ identities. In one example, a website using cms-law.co.uk cloned the genuine firm’s website, whose address was cms.law. The SRA also warned about the associated email domain.
For a client, that difference could be easy to overlook. For a practice, it raises a practical question: would you know if someone created a web address that could be mistaken for yours?
What does law firm and client impersonation look like?
A copied website can use a genuine firm’s name and details while operating from an unrelated address. The SRA has also reported emails misusing the names and details of genuine solicitors and firms.
The address does not have to be identical to cause confusion. In another alert, the SRA reported a website using gcbussiness.com that misused the details of GC Business Lawyers Limited. The firm had not authorised the use of its name. The same is for a client. The same impersonation works both ways.
These examples show why checking only the name or branding on a page is not enough. The address and the authenticity of the communication matter too.
Three practical checks for your firm
- Make your genuine contact details easy to verify. Give clients a clear way to check they are dealing with your firm. When something looks suspicious, the SRA advises contacting the firm directly through reliable, established means—not relying on the details supplied in the questionable correspondence.
- Reinforce how payment instructions should be checked. Remind clients to verify unexpected payment requests or changes to bank details using a trusted telephone number. The Law Society advises calling a firm on its published number rather than the number given in an email demanding payment.
- Decide who will handle a suspected impersonation. As a practical internal measure, nominate someone to receive reports and coordinate the response. A short checklist could cover recording the suspicious address, retaining relevant messages, checking whether anyone has acted on them, and identifying the appropriate reporting route.
Where monitoring fits
Checking for lookalike web addresses is worth considering as one part of that process. It addresses a specific question: are there other addresses that could be confused with your firm’s?
The limits matter. A similar address is not, by itself, proof of wrongdoing. Equally, a monitoring service should not be presented as a guarantee that every impersonation attempt will be found or prevented.
The useful outcome is information your firm can assess and act on—not a promise of complete protection.
Keep the message to clients simple
Clients should not have to become technical experts to check a communication.
A straightforward reminder could say:
“If you receive an unexpected request for payment or a change to bank details, call us using the number you already hold for our firm. Do not rely on contact details included in the unexpected message.”
That approach follows all of the UK’s society’s advice to verify payment instructions directly using a trusted contact route.
Law Society of Engalnd & Wales
Law Society of Scotland
Law Society of Northern Ireland
Law firm and client impersonation is not just about whether your own website is secure. It is also about whether someone else is presenting themselves as your firm—and whether clients know how to check.
About the author: Nick Brittan is the founder of The TLD Project, a service being developed to help businesses identify lookalike web addresses and support their response to suspected impersonation.
