November 5, 2026Back to Latest

The Canadian Centre for Cyber Security (CCCS) issued an alert regarding an ongoing voice phishing (“vishing”) campaign targeting Canadian organizations, including those in the legal sector. Attackers are impersonating IT support personnel and directing individuals to fraudulent sign-in pages designed to steal credentials and bypass multi-factor authentication (MFA).

Law firms and legal professionals are appealing targets because they hold sensitive client information, financial records and other confidential material. The CCCS reports that attackers may contact victims by telephone, Microsoft Teams, or other channels, claiming that urgent action is required to reset a password, enroll in Multi factor Authentication (MFA), or complete a security update.

What Lawyers and Firm Administrators Should Do

• Treat unexpected IT support calls, Teams messages, emails, or urgent requests with caution.
• Confirm who is contacting you before taking action. For a Teams call, ask the caller to turn on their camera and compare them with their official company profile photo, but remember that video alone does not prove identity.
• If you are unsure, end the call and contact the person or your IT provider using contact information you already trust—not details supplied by the caller.
• Never share passwords or authentication codes, approve an MFA prompt you did not initiate, or change authentication settings at a caller’s request.
• Verify the caller independently before sharing your screen or allowing remote access to your computer.
• Pay attention to security or suspected-scam warnings in Teams and stop the interaction if something does not look right.
• Ensure MFA is enabled on professional accounts and report suspicious activity to your IT provider or cybersecurity contact immediately.
• If you suspect a breach, contact your cyber insurance provider promptly for breach support.

Protecting Client Information Is Everyone’s Responsibility

A single compromised account can provide attackers with access to confidential client files, email communications, financial records, and other sensitive information. Lawyers and law firms are encouraged to discuss this threat with their staff and review their cybersecurity practices to help safeguard client information and maintain public confidence in the legal profession.

If you receive an unexpected request to change a password, re-enroll in MFA, or grant access to your account, stop, verify, and report before proceeding. When in doubt, contact your IT provider using a trusted contact method rather than relying or acting on information supplied by the caller.