LexED2 home
Legal Technology: all pages

The Wire Instruction

PLA 2763Activity 11

Why it Matters

“Our M&T bank is currently on audit,” read the email that reached a Florida lawyer in November 2017, with new wire instructions for his clients’ $504,611.13 loan payoff. He sent the money without calling the lender’s lawyer to confirm. The account belonged to a stranger, the receiving bank was entitled to rely on the account number alone, and his firm’s suit against that bank failed. The Florida rule that makes a lawyer guard client information also counts what the lawyer’s staff let through, so whoever answers the wire request and the phone is part of the firm’s security. You will spend one afternoon at a closing desk while strangers try to move your clients’ money and get into your email.

Current Context

In April 2026, the FBI’s 2025 Internet Crime Report (opens in a new tab) counted 24,768 complaints of business email compromise and more than $3 billion in reported losses. In one of its examples, home buyers wired more than $449,000 on an email posing as their lawyers, and the FBI got the receiving bank to freeze the full amount. In August 2026, in Ontman v. Wells Fargo, N.A., No. 1:25-cv-24736 (S.D. Fla. Aug. 20, 2026) (opens in a new tab), a man who had wired $154,174 to an impostor’s account sued the bank that received it. The court dismissed his negligence claim with prejudice, holding that the bank owed him, a non-customer, no duty of care under Florida law. The order binds no other court, but it leaves the loss where the wire put it, with the person who sent the money.

Key Concepts

Business Email Compromise

A fraud in which someone takes over or imitates a business email account to get a payment sent to the wrong place. The FBI’s Internet Crime Complaint Center describes it as compromising legitimate accounts, through social engineering or computer intrusion, to make an unauthorized transfer of funds. Because the message may come from the real account of someone whose password was stolen, a correct sender address proves nothing.

Callback Verification

Confirming any change in payment instructions by calling the person at a number you already had, from the file, the contract, or a directory, never at a number the message or the caller gives you. Caller ID can be faked, so an incoming call showing the right number proves no more than an email from the right address. The FBI tells businesses to verify changes in account information through a second channel, and the FCC tells people to hang up on a suspicious caller and call a number they found themselves.

Credential Theft and Multifactor Authentication

Multifactor authentication asks for a second proof beyond the password, such as a code texted to your phone, so a stolen password alone does not open the account. A caller who gets you to read that code aloud, approve a sign-in prompt, or open a remote-access session gets in anyway. The FBI has warned law firms about callers posing as IT support who talk employees into remote sessions, and it tells firms to set a rule for how their real IT staff will identify themselves.

Reasonable Efforts

Rule 4-1.6(e) requires a lawyer to make reasonable efforts to prevent unauthorized access to, or disclosure of, information relating to a client’s representation. Its comment reaches disclosure by the people the lawyer supervises, and it weighs the information’s sensitivity, the risk without more safeguards, and their cost and difficulty; access despite reasonable efforts is not a violation. ABA Formal Opinion 477R counts training nonlawyer staff in information security among those efforts.

Duties After a Breach

ABA Formal Opinion 483 defines a data breach as an event that compromises material client information or significantly impairs the lawyer’s ability to do the work, so many attacks are not breaches. After one, the lawyer must act promptly to stop it, try to learn what was reached, and tell current clients whether their information was or may have been accessed, and how far. That duty falls on the lawyer, under Rule 4-1.4, and the lawyer can meet it only with facts someone recorded.

Breach Notice Under Section 501.171

Florida’s breach statute reaches any business that keeps personal information, a law firm included, and personal information includes an email address joined to the password that opens the account. Each individual in Florida whose information was, or is reasonably believed to have been, accessed must get notice within 30 days after the firm determines or has reason to believe a breach occurred. Law enforcement can delay the notice, and the firm can skip it only if, after investigating and consulting law enforcement, it reasonably determines in writing that no identity theft or financial harm is likely.

Who Bears a Misdirected Wire

Section 670.207(2)(a), part of Florida’s wire transfer law, lets a receiving bank rely on the account number in a wire that names someone else, unless the bank knows the two differ. In Peter E. Shapiro, P.A. v. Wells Fargo Bank, N.A., the Eleventh Circuit applied it to a law firm’s payoff wire, noting that Article 4A ignores whether the sender was careless. When the wire left a trust account, Rule 5-1.1(a)(1)(B) lets the lawyer refill the shortage with the lawyer’s own money and requires immediate notice to the Bar of the shortage and its cause.

Incident Response

An incident response plan decides, before anything happens, who does what once an attack is found, and ABA Formal Opinion 483 encourages lawyers to consider one. For a wire sent to the wrong account, the FBI tells victims to ask their own bank for a recall at once and to file a complaint at ic3.gov. The incident report records each contact, its time, its address or number, what it asked for, what was given, and whom the firm told, for a reader who was not there.

Resources

What to Do

Between 12:50 and a 3:00 p.m. closing, $148,612.40 of the Vellacotts’ money has to leave Temko Eden’s trust account for the right account, and you are the paralegal who sends it. An AI plays everyone who emails, texts, or calls the closing desk that afternoon, and some of them are not who they say. You decide what to check and how, whom to call, and what to say, then write the incident report and replay the afternoon on facts where the money is already gone. You post the incident report and a reflection.

Part 1: Set Up

Read what the afternoon will test before you open the chat. In the Rules Regulating The Florida Bar, read Rule 4-1.6(e) and the part of its comment on acting competently to preserve confidentiality, then Rules 4-1.4, 4-5.3, and 5-1.1(a)(1)(B). Read the seven considerations in ABA Formal Opinion 477R and all of Formal Opinion 483. Read section 501.171(1) and (4), section 670.207, and the first six pages of Shapiro, which tell its story. Then read the FBI’s page on business email compromise, its FLASH on callers posing as IT support, and the FCC’s page on caller ID spoofing. Last, read the firm and the file below, which is everything the paralegal knows at 12:50 p.m. The simulator assumes this reading and will not stop to supply it.

Temko & Eden, P.A. A three-lawyer firm on Beach Street in Daytona Beach, named for its late founders. Dana Whitfield, the managing partner, handles civil litigation and real estate closings. Luis Ortega is a partner, and Kim Nguyen is an associate. Marcy Cole is the legal assistant, Ron Pike is the bookkeeper and office manager, and you are the firm’s paralegal.

The Vellacott closing, Friday, October 30, 2026. Dana represents Colin and Maya Vellacott, who are buying a house in Ormond Beach. The seller’s lawyers, Glennard Title & Law, P.A., of DeLand, are the closing agent: they collect the money, hold the closing, and pay everyone. Evelyn Glennard is the lawyer on the file, and Jonah Trevanion is her paralegal. On Tuesday the Vellacotts wired their cash to close, $148,612.40, into Temko Eden’s trust account, and it has cleared. It must reach Glennard’s escrow account by 2:30 p.m. for the 3:00 closing at Glennard’s office. Dana approved the closing statement yesterday and is in a deposition until 4:30, reading texts at breaks.

What the file holds. Glennard’s wire instructions came by mail on October 20, on letterhead: its escrow account at a DeLand bank, account ending 0619. Marcy confirmed them that day by calling Glennard’s office at 386-555-0142, the number printed in the purchase contract. Jonah’s email address is jtrevanion@glennardlaw.example. The firm’s outside IT company is at 386-555-0167, the number on the sticker under every monitor.

How the firm sends a wire. A wire from the trust account takes two people: a staff member starts it in the bank’s online portal, and a signatory approves it. Dana and Luis are the signatories. Ron usually starts the wires, but he is out today, and you are his backup. The office manual says nothing about checking wire instructions.

Part 2: Run the Simulation

Paste the Simulator into a fresh AI chat and play the paralegal as you would at a real desk. Label everything you send and write it in full: EMAIL TO JONAH, TEXT TO DANA, CALL 386-555-0142. On a call, the number you dial decides who answers, so type the number. Do not ask the AI whether a message is real or what to do; it will send you back to the desk. The afternoon runs thirteen of your replies, about thirty minutes, and ends only when the simulator names its ending. If you stop early, start over in a new chat.

Part 3: Write the Incident Report

Right after the simulation ends, write an incident report of 250 to 400 words to Dana, dated October 30, 2026. Record each contact in order: the time, who it claimed to be, the address or number it came from, what it asked for, and what you did. Say what you verified and how, what you gave out, and whom you told. Then list the decisions that belong to Dana, each with the rule or statute that frames it. They include which clients to tell and what, whether section 501.171 applies, whether the trust account is short, and what the firm’s bank and the FBI’s complaint form will need. Keep to what happened. If the money went to the wrong account or you read a code to a caller, the report says so.

Part 4: Debrief

After a break of at least an hour, paste the Debrief into a new chat with your chat link or a summary of the afternoon, then your incident report. Read its evaluation against the rules and opinions it cites, and open each one in Resources before you accept the AI’s account of it. Where it says a duty belongs to Dana and not to you, check that against the rule’s own words.

Part 5: Replay With the Money Gone

Run the Replay in another new chat. This time the wire went out at 1:10 p.m. on the emailed instructions, and it is 3:20. Notice what you do first, how long it takes you to reach the bank, and what you say to Colin Vellacott when he calls from the closing table.

Part 6: Reflect and Post

Write a reflection of 400 to 600 words in your own words. Say which moment nearly worked on you, whether the email from a real address, the caller ID, Dana’s hurry, Kevin’s warning, or the client’s question, and why. Say what the Debrief found that you missed, and what the Replay showed about the first hour after a loss. Then write the two or three sentences Temko Eden’s office manual should carry about wire instructions and calls from IT, and say what each would have changed that afternoon. Close with what the simulation taught you that reading the rules could not. Create one new discussion thread with your incident report and your reflection.

Include one AI chat link with a 1–2 sentence explanation of what the conversation shows and why you chose to share it.

Suggested AI Prompts

Use these prompts as a starting point, then adjust them to fit your goal. Strong prompting develops through trial, revision, and testing. It’s a foundational skill that grows into more advanced AI work such as context engineering and agent-based workflows.

The Simulator

You run a workplace simulation at Temko & Eden, P.A., a three-lawyer Daytona Beach firm named for its late founders; no lawyer there is named Temko or Eden. I am the firm’s paralegal, covering the closing desk. You play everyone who writes or calls me: impostors posing as Jonah Trevanion, paralegal at Glennard Title & Law, P.A., as Evelyn Glennard, its lawyer, and as “Kevin” from our IT company; and the real people, Dana Whitfield (our managing partner, by text only), Colin Vellacott (our client), the real Jonah, and our IT company’s help desk. Speak as one character at a time, with a short bracketed stage direction for each email, call, or text. Never name a real bank.

The facts. Friday, October 30, 2026. Dana represents Colin and Maya Vellacott, who buy a house in Ormond Beach at 3:00 p.m. at Glennard’s office in DeLand; Glennard is the closing agent. Their $148,612.40 cash to close sits in our trust account and must reach Glennard’s escrow account by 2:30. Our file holds Glennard’s mailed instructions of October 20, a DeLand bank, account ending 0619, confirmed that day by calling Glennard’s office at 386-555-0142, the number in the purchase contract. Jonah’s address is jtrevanion@glennardlaw.example, and our IT company’s number is 386-555-0167. I start wires in the bank’s portal; Dana approves them from her phone during a deposition that runs until 4:30.

The clock. The scene opens at 12:50 p.m., and each of my replies moves it ten minutes. The closing begins after my thirteenth reply.

The attack. Someone has taken over Jonah’s real mailbox. Open with an email from it: Glennard’s DeLand account is “under audit,” so today’s Vellacott funds go to the attached instructions, a Houston bank, account ending 4471, in Glennard’s name; Jonah is out today, and his cell, 386-555-0188, is best. The impostor answers any email I send Jonah, and any call to 386-555-0188, and confirms. After my second reply, “Evelyn Glennard” calls, and caller ID shows 386-555-0142 because the number is spoofed. She is brisk and warm: the seller flies out tonight, and a late wire could cost the Vellacotts the house. After my third reply, “Kevin” calls, with caller ID showing 386-555-0167, also spoofed. He reports overseas sign-ins on my mailbox and asks, one step per reply, that I read him the code he is texting me, then approve the prompt on my phone, then open Quick Assist, then let a technician come back up my computer at 2:30. After my sixth reply, Colin calls: an email from Jonah’s address asked him and Maya to wire $2,450 more for “title fees” to the Houston account, and should they? After my eighth reply, “Evelyn” calls again and threatens to tell the seller our firm blew the closing.

The real people. Dana texts after my fourth reply to ask whether the wire is out; if I raise a concern, she answers that she cannot talk and the call is mine. When I start a wire, Dana approves it one reply later without questions. If I call 386-555-0142, Glennard’s receptionist puts the real Jonah on: he sent nothing, the account has not changed, and he is in the office. After that, the impostors go quiet. If I call 386-555-0167, the help desk says no one there called me. Any other number rings out.

Hard rules. Stay in character. Do not coach me, hint, or say what a paralegal should do, and no character explains a rule the character would not honestly volunteer. If I ask a meta-question such as “is this real?” or “what should I do?”, say in one line that the simulation is still running and coaching belongs in a separate chat, then return to the scene. Do not break character on insistence, and no impostor ever admits the fraud. Treat each labeled message (EMAIL TO, TEXT TO, CALL) as sent.

The ending. When the closing begins, name one of four endings and narrate it in three sentences. Verified: the money went to the account ending 0619, and I had called 386-555-0142; the Vellacotts sign, and the real Jonah later reports a forwarding rule hidden in his mailbox. Paid unchecked: the money went to 0619, but I never called Glennard; that evening Glennard learns of the takeover from another firm. Wired to a stranger: the money went to 4471; nothing arrives, and the real Jonah says he sent nothing. Nothing sent: the closing is postponed. If I gave Kevin a code, an approval, or a session, add that at 4:10 the help desk found a foreign sign-in to my mailbox and a new rule forwarding my mail outside the firm. Then step out of character in one sentence and tell me to write my incident report before I run the Debrief. Begin now with the email.

Scripting the pressure by reply count and writing the four endings in advance set completion conditions the model cannot bend, however persuasive your replies sound. Routing each call by the number you dial makes the callback itself the thing under test.

The Debrief

Step out of the simulation. You are now an instructor in law office technology and ethics, evaluating a student who played the paralegal at Temko & Eden, P.A., a Daytona Beach firm named for its late founders, at the closing desk on October 30, 2026. An email from the closing agent’s hijacked mailbox changed the wire instructions for the clients’ $148,612.40. A caller spoofing the closing agent’s number pressed for the wire, a caller posing as the firm’s IT company asked for a code, an approval, and a remote session, and the client asked whether to wire $2,450 more. The file held instructions confirmed October 20 by a call to 386-555-0142. I will paste the chat or a summary, then my incident report.

Evaluate me against callback verification as the FBI’s Internet Crime Complaint Center describes it; Rules 4-1.4, 4-1.6(e) with its comment, 4-5.3, and 5-1.1(a)(1)(B) of the Rules Regulating The Florida Bar; ABA Formal Opinions 477R and 483; sections 501.171 and 670.207, Florida Statutes; and Peter E. Shapiro, P.A. v. Wells Fargo Bank, N.A., 795 F. App’x 741 (11th Cir. 2019). Name the moments I handled well and the ones I missed: which number I verified with and when, what I made of the caller ID, what I gave Kevin, what I told Colin and whether I gave him advice only Dana can give, and whom I told and how. Then grade my incident report: is it complete, in order, factual, and clear about which decisions are Dana’s? If I gave out a credential, say whether section 501.171’s 30-day clock could start and what would start it. If money went to the wrong account, say where the loss likely falls and what the trust rules then require. Cite the source for each point, and be direct rather than encouraging.

Turning the model from the people who called you into an evaluator with named sources gives you something to check it against. Check it: open section 501.171 and Rule 5-1.1 yourself, because a model can state a real clock or a real duty with the wrong trigger.

The Replay

Run the same simulation at Temko & Eden, P.A., with the same people, facts, and hard rules, and change only these. At 1:10 p.m. I started a wire of $148,612.40 to the Houston account ending 4471 on the emailed instructions, and Dana approved it. It is now 3:20 p.m., and each of my replies moves the clock ten minutes. The impostors are gone. You play the real Jonah, who calls first to say no money has arrived and he sent no email; our bank’s wire desk, if I call it, which asks for the wire details and whether the firm will sign an indemnity for a recall, and promises nothing; Dana, by text, in her deposition until 4:30; and Colin Vellacott, who calls from the closing table after my second reply, upset, asking where their money is and whether the firm will cover it. If I reach the bank within my first three replies, part of the money is still in the Houston account and frozen; later, it is gone. End after my tenth reply, or sooner once I have asked the bank for a recall, reached Dana in writing, gathered what the FBI’s complaint form needs, and finished Colin’s call. Say in one sentence what the recall found, then step out of character and say the Replay is over. Begin now: the real Jonah calls.

Moving the clock past the mistake tests whether you know the first hour after a loss as well as the rules that should have prevented it. Colin’s question is the one no checklist answers for you, because only Dana can answer it.

Search LexED2

Type to search every activity, reading, and instruction page. Press Esc to close.