Nearly 9 in 10 South Florida criminal defense firms can have their email spoofed

Data checked October 18, 2026.

We didn't send a single fake email. We didn't have to.

Whether a scammer can send email in a law firm's name is written in public records that anyone can look up. So this month we looked them up for 519 law firms in Miami-Dade, Broward and Palm Beach counties, to see how common law firm email spoofing risk really is.

For 412 of them, 79%, nothing tells inboxes to throw away an email faked in the firm's name.

Criminal defense firms came out worst. 102 of the 115 we checked, 89%, are open. That's nearly 9 in 10.

What "spoofed" means

Anyone can type your firm's address into the "From" line of an email. Nothing about email stops that on its own.

What stops it is a free setting in your domain's public records called DMARC. It tells inboxes: if an email claims to be from us but didn't come from our servers, throw it away. Without it, many inboxes deliver the fake as if it were real.

Of the 412 open firms, 263 have no DMARC record at all. The rest have one set to "monitor only", which watches the fakes but still lets them through.

The numbers by practice

Type of law firm	Firms checked	Can be spoofed
Criminal defense	115	102 (89%)
Immigration	141	119 (84%)
Family law	122	97 (80%)
Personal injury	141	94 (67%)
All law firms	519	412 (79%)

Real estate offices are no better: 83% of the 230 brokerages and property managers we checked are open too. We don't name any firm. The method is in the full report.

Why scammers want a lawyer's email

Lawyers move money: settlements, closings, retainers. And clients do what their lawyer's email tells them to do.

That makes a law firm's address one of the most useful things a scammer can fake. Business email compromise, the family of scams this belongs to, was the second-costliest crime type in the FBI's 2025 Internet Crime Report, with $3.05 billion in reported losses. Florida ranked 3rd in the country, with $1.60 billion in losses reported to the FBI. (FBI IC3 2025 report.)

Spoofing doesn't need a break-in

Breaking into a real mailbox takes work. In a case the Florida Bar News reported in March 2025, scammers got into a Ponte Vedra firm's email and moved $150,000 before the firm caught it. The bank got the money back.

Spoofing skips all of that. The scammer never touches the firm's systems, so there is nothing for the firm to notice. Here is a made-up example of what lands in a client's inbox:

From: Maria Lopez, maria@yourfirm.com

Subject: Updated wiring instructions for Thursday

Hi, our bank details have changed. Please use the attached instructions for the settlement funds. I'm in court all day, so email is best.

The name is right. The address is right. Whether it reaches the client comes down to one setting the firm controls.

How a firm closes the gap

Stop the fakes:

• Check your domain with our free email security check. It takes about 30 seconds and shows your SPF, DKIM and DMARC.
• If DMARC is missing or set to "none", ask whoever runs your email to move it to "quarantine", then "reject", once your real email passes.

Stop the break-ins:

• Turn on two-step sign-in for every email account.
• Check mailboxes for rules that forward or hide email. That's how the Ponte Vedra scammers stayed out of sight.

Stop the payment:

• Any change to payment details gets a phone call to a number already on file, never one from the email.
• A second person approves every wire.

The last two are about process, and they're the steps that get skipped on a busy day. Building them into how work flows, so an approval can't be skipped and a change to bank details sets off an alert, is what business process automation is for.

Check your firm in 30 seconds

Run the free email security check. No sign-up.

Here is how it works in 30 seconds:

Raileon is a North Miami company that builds custom software and automation for businesses.