Fake IT Support Scam Now Targeting Law Firms (Why the FBI Is Warning About It)

A fake IT support scam is one of the fastest-growing cybersecurity threats facing law firms today. Criminals are posing as IT support professionals, convincing employees to grant access to computers and sensitive data, and then using that access to steal confidential information. According to a recent FBI warning, these attacks are increasingly targeting law firms, and in some cases scammers have even appeared in person at offices, posing as legitimate technicians.

For law firms, the risk is significant. Client files, privileged communications, financial records, and case documents are among the most valuable forms of data criminals can access. Understanding how a fake IT support scam works is the first step toward protecting your firm.

What Is a Fake IT Support Scam?

A fake IT support scam occurs when a cybercriminal pretends to be a trusted technology professional and persuades an employee to provide access to systems, credentials, or sensitive information.

Unlike traditional cyberattacks that rely on sophisticated malware or technical exploits, these scams primarily target people rather than technology. Attackers use social engineering tactics to build trust and create a sense of urgency.

The FBI recently warned that the Silent Ransom Group has been using these techniques to target law firms and other professional organizations. Their approach is effective because it exploits a simple human instinct: when someone claims to be from IT, most employees assume they are there to help.

How the Fake IT Support Scam Works

The process is surprisingly simple and often unfolds in four stages. By the time the ransom demand arrives, the damage has often already occurred, the same pattern we see in business email compromise attacks on professional services firms.

1. Initial Contact

An employee receives a phone call, email, or message from someone claiming to be from IT support, a software vendor, or another trusted technology provider.

In some cases, attackers send fake billing notices or subscription renewal warnings designed to encourage employees to initiate contact themselves, a tactic we broke down in our look at a fake support scam built around remote access.

2. Remote Access Request

The scammer instructs the employee to install remote access software or approve a support session.

Because the request appears legitimate, employees often comply without verifying the individual’s identity.

3. Data Collection

Once access is granted, attackers quietly gather sensitive information, including:

• Client files
• Legal documents
• Financial records
• Email communications
• Credentials and passwords

Rather than disrupting operations immediately, they often spend time collecting valuable information.

4. Extortion or Ransom Demand

After the data has been stolen, the organization receives a ransom demand threatening to publish, sell, or leak confidential information unless payment is made.

By the time the demand arrives, the damage has often already occurred.

The Most Concerning Trend: In-Person IT Support Scams

One of the most alarming details in the FBI warning is that some attackers have gone beyond phone calls and emails.

In several reported incidents, individuals appeared at offices claiming they were sent by IT support to image devices, perform maintenance, or create backups.

Once inside, they connected external drives or devices and copied sensitive information directly from company computers.

This tactic works because it appears normal. A professionally dressed individual carrying a laptop bag and speaking confidently about technical issues can easily blend into a busy office environment.

The attack succeeds not because of advanced hacking skills, but because nobody questions whether the visitor is legitimate.

Why Law Firms Are Prime Targets

Valuable Confidential Information

Law firms handle highly sensitive information every day.

Client communications, litigation strategies, contracts, financial records, intellectual property, and privileged legal documents all have significant value on the black market.

Law firms face unique cybersecurity challenges because they manage confidential client information, privileged communications, and sensitive case data. Organizations that specialize in IT services for law firms can help implement the security controls and employee training needed to reduce these risks.

Cybercriminals know that organizations holding this type of information are more likely to pay to prevent public exposure. It’s one of the biggest cybersecurity risks facing law firms today.

Trust-Based Work Environments

Law firms operate on trust and efficiency. Employees frequently collaborate with outside vendors, consultants, and technology providers.

That environment can make it easier for attackers to impersonate legitimate service providers and gain credibility.

Limited Internal IT Resources

Many small and midsize firms rely on outside managed IT providers rather than maintaining large internal technology teams.

While this approach often improves security, employees must know exactly who their authorized technology partners are and how to verify their identity.

How Law Firms Can Prevent a Fake IT Support Scam

The good news is that preventing these attacks does not require expensive technology investments.

Most defenses focus on verification, awareness, and strong security practices.

Know Your IT Team

Employees should know who provides technology support for the firm.

Whether support is internal or outsourced, staff should recognize authorized technicians and understand how legitimate support requests are communicated.

Verify Before Granting Access

Any unexpected request for remote access should be independently verified.

If someone calls claiming to be from IT, employees should hang up and contact the IT provider using an established phone number rather than continuing the conversation.

Enable Multi-Factor Authentication

Multi-factor authentication (MFA) adds an additional layer of security to email accounts, cloud applications, and systems containing sensitive information.

Even if credentials are compromised, MFA can help prevent unauthorized access.

Restrict Remote Access Tools

Remote support software should only be installed when necessary and managed through approved channels.

Employees should never install software at the request of an unknown caller.

Control USB and External Devices

Organizations should establish policies governing the use of external storage devices.

Limiting USB access can significantly reduce the risk of unauthorized data transfers.

Verify Visitors Claiming to Be Technicians

If someone calls claiming to be from IT, employees should hang up and call back using an established phone number rather than continuing the conversation.

Legitimate technology professionals understand these precautions and will not object.

Frequently Asked Questions

How can I tell if an IT support call is legitimate?

Treat any unsolicited support request as unverified until confirmed. Contact your IT provider directly using a known phone number. Legitimate technicians will always support verification procedures.

Does using a managed IT provider eliminate the risk?

No. Managed IT services improve security, but employees still need training to recognize impersonation attempts and verify unexpected requests.

What should we do if an employee granted access to a scammer?

Immediately disconnect the affected device from the network and contact your IT provider. Rapid response can help limit data exposure and prevent further compromise.

The Bottom Line

The modern fake IT support scam succeeds because it exploits trust rather than technology.

Criminals understand that busy professionals want problems solved quickly and often hesitate to challenge someone who appears knowledgeable and authoritative.

It’s part of a broader pattern: attackers are increasingly exploiting trust in a familiar voice or identity to bypass technical defenses entirely. AI voice cloning is the newest version of that same tactic — see AI Voice Cloning Is Behind a New Law Firm Wire Fraud Scam for how it’s playing out against law firms specifically.

For law firms, making verification a routine part of daily operations can dramatically reduce risk.

Strong cybersecurity is not always about sophisticated tools or complex technology.

Sometimes it starts with a simple question:

“Can you verify who you are?”

Is Your Firm Prepared?

Concerned about how your law firm would respond to a fake IT support scam?

Slingshot Information Systems offers a free 3-minute IT Risk Scorecard that helps you identify security gaps, evaluate your current protections, and see exactly where your firm stands — no jargon and no IT background required.

As a local technology partner serving Cape Ann and the North Shore, we believe cybersecurity works best when your team knows exactly who is on the other end of the phone. Our goal is simple: help law firms build stronger security practices, reduce risk, and stay ahead of emerging threats before they become costly problems.

IT Support Across the North Shore

Slingshot provides reliable, security-focused IT support for businesses across Massachusetts’ North Shore. Whether you’re dealing with cybersecurity threats, compliance requirements, or day-to-day IT challenges, our team delivers fast, proactive support tailored to your local business environment.

North Shore Communities We Serve

If your business operates in any of these North Shore communities, Slingshot can help you reduce downtime, improve security, and keep your systems running smoothly.