Skip to content
01482 586 550
Remote support
Selectgroup

Professional services

IT and security for professional services

Accountants, solicitors and consultancies hold client money, client data and client trust. The threat is rarely dramatic. It is an email that looks exactly like the one you were expecting.

Professional services firms rarely get attacked in an interesting way. The thing that actually costs money is an email that fits the conversation you were already having, asking you to pay a real invoice into a different account.

No product stops that on its own. What stops it is multi-factor authentication so the mailbox is not readable in the first place, email authentication so lookalike domains get caught, and a written rule that any change of bank details is verified by phone on a number you already had.

The rest of it is unglamorous: tested backups, patching, leavers removed, and not doing anything risky the week before a filing deadline.

UK Finance put invoice and mandate scams at £41.3 million in 2025, with around two thirds of that taken from business accounts and only a third of business losses returned. We have written up how the scam actually works and the six checks that stop it, which is worth ten minutes of anyone in your accounts team’s time.

What we see

What this sector is up against

  • Invoice and payment redirection fraud

    The most expensive thing that happens to firms like yours is not ransomware. It is an email saying bank details have changed, arriving in the middle of a transaction, from an address that is almost right.

  • Client confidentiality is the product

    A breach is not just a GDPR problem. It is a professional conduct problem, an insurance problem and a reputation problem, often in that order.

  • Deadlines that do not move

    Year end, filing deadlines, completion dates. Downtime during the wrong week costs far more than the same downtime in a quiet month.

  • Your regulator and your insurer both ask

    Professional indemnity renewals increasingly ask what controls you have. So do a growing number of clients before they instruct you.

What we do about it

In the order it usually matters

  1. 1

    Lock down email first

    Multi-factor authentication, SPF, DKIM and DMARC, plus rules that catch lookalike domains and forwarding set up by somebody who should not have set it up.

  2. 2

    A payment process that does not rely on an email

    Technology only goes so far here. The control that stops payment fraud is verifying changed bank details by phone, on a number you already had. We will help you write that down and train people on it.

  3. 3

    Cyber Essentials for the insurer and the tender

    A recognised answer to the questions your PI insurer and your clients are already asking, with a defined scope and an end date.

  4. 4

    Staff training that uses real examples

    Short monthly training and realistic phishing tests based on the scams actually going round, not obvious fakes nobody would fall for.

Professional services: common questions

What is the single biggest risk to a firm like ours?

Payment redirection. Somebody emails saying their bank details have changed, during a real transaction, from an address that looks right. It costs firms more than anything else and it is stopped by a process rather than a product: verify any change of bank details by phone, on a number you already held.

Our PI insurer is asking about cyber controls. What do they want?

Usually multi-factor authentication, patching, backups, staff training and often Cyber Essentials. They are asking for the basics, which is the same list we hold every client to anyway.

We cannot afford downtime at year end. How do you handle that?

By not doing anything clever in your busy period. We plan changes around your calendar, and we would rather postpone a project than risk your deadline. Tell us when your pinch points are and they go in the plan.

Is our data safe in Microsoft 365?

Safer than most alternatives, and not automatically. Microsoft keeps the service running. It does not keep a long term backup of your data, and it does not configure your sharing rules for you. Both are on us, and both are things we check.

Start somewhere

Find out where you stand

Want a straight answer about your IT?

Tell us what is not working. We will tell you what we would do about it, with no sales pitch and no obligation.

Book a free IT review Call 01482 586 550