A fraudster needs one convincing email to redirect a client's completion money or a tax payment. For a law firm or an accounting practice, that email puts client money, client trust and the firm's name at risk on the same day.
Cyber insurance for law firms, accountants and consultants exists for days like that. Here is how underwriters look at professional firms, and what they want to see before they offer terms.
Why insurers look closely at professional services firms
Professional firms hold three things criminals want: money, confidential files and trusted email addresses. A law firm moves client funds on completion days. An accountant holds payroll data and bank details for hundreds of clients. A consultancy holds board papers.
Your clients also act on your emails. If an attacker takes over a partner's mailbox, clients will pay the attacker's bank details without a second thought. That weakness drives many questions on the proposal form.
For example, a conveyancing firm with 25 staff handles dozens of property completions a month. The underwriter will ask how it confirms bank details before money moves, and who can approve a transfer.
The cyber risks underwriters see in professional services
- Business email compromise. An attacker reads a partner's mailbox for weeks, then sends fake payment instructions at the right moment.
- Invoice manipulation. Criminals copy your invoice style and send clients new bank details, so your fees land in their account.
- Theft of client funds. Money leaves a client account, or an escrow account in your name, after someone tricks a member of staff.
- Ransomware at a deadline. An accounting firm loses its practice software in the last week before a tax filing date.
- Confidential data leaks. Files from a merger or a family case appear online, and clients claim for the breach of confidence.
What underwriters usually ask professional services businesses
- Is MFA on for every user, including email, remote access and third parties? An export from your email admin console answers this.
- How do you check payment and bank detail changes? A written call-back procedure, plus records that staff follow it, is strong evidence.
- Do you hold client money or have access to client bank accounts? Say so plainly. The answer changes which cover you need.
- Do staff take phishing training at least once a year? Training completion reports are the evidence.
- Do you keep backups offline or in a purpose-built cloud service, and when did you last test a restore? Many forms look for a dated restore test from the last six months.
- Do you comply with privacy law where you operate, and who is responsible? A privacy policy and a named person cover it.
- Any incidents or claims in the last five years? Disclose them, along with anything a partner already knows about.
Our payment fraud checklist turns question 2 into steps your finance team can follow.
Cover that matters most for professional services
- Funds transfer fraud and invoice manipulation. These clauses respond when your money, or a client's payment to you, goes to a criminal. Many policies offer them as extensions or with a lower sublimit, so check the amount.
- Theft of client funds and escrow cover. Some wordings cover money stolen from client accounts you can reach, or from accounts held in your name, including what you must repay the client.
- Privacy liability. This responds to claims that you failed to protect personal data or broke a duty of confidence.
- Incident response and legal costs. Lawyers, forensics and breach notices in the first hours and days.
- Business interruption and lost bids. Lost income while systems are down, after a waiting period. Some wordings also pay when an attack stops you winning a bid.
A cyber policy sits next to your professional indemnity cover. For example, a claim that your advice was wrong usually belongs to the PI policy. Theft by your own employee often needs a separate crime policy, because many cyber wordings exclude insider theft. Your broker can confirm how they fit together.
How PrismX helps professional services firms get insurance ready
- Discover records your firm, systems, data, suppliers and people, including the partners whose awareness can start a policy clock.
- Assess checks each control and shows how your answers read on the insurer's question set.
- Verify takes each piece of evidence once, such as your MFA export and call-back procedure, and gives it an AI check, advisor verification and an expiry date: a restore test counts for six months.
- Submission pack: PrismX produces a signed pack with a sha256 fingerprint for your broker and insurer to review.
- During an incident: in the pilot, PrismX tracks the notification clocks and rules in your wording.