Does solicitor PII cover cyber attacks and payment fraud – or is there a gap?
Solicitors are one of the most targeted professions for payment fraud – and many firms assume their professional indemnity insurance will cover them if something goes wrong. It won’t always. The line between what solicitor PII covers and what it doesn’t is one of the most important things a firm can understand before an incident occurs. Alexandra Henley, professional indemnity specialist at Konsileo, sees firms caught out by this distinction regularly.
Does solicitor PII cover cyber attacks and payment fraud?
It depends on where the failure occurred and who suffered the loss.
If a solicitor has been negligent – for example, transferring client funds to a fraudster after failing to follow appropriate verification procedures – that could give rise to a solicitor PII claim. PII is designed to respond to claims brought by third parties alleging negligence, and may cover the firm’s liability to its client in those circumstances.
But PII is not designed to provide comprehensive protection against cyber-related losses. The costs that follow a cyber incident – forensic investigations, incident response, regulatory and ICO-related expenses, business interruption, data breach notification – typically fall outside a PII policy. A standalone cyber policy covers these first-party losses. Without one, a firm can face significant uninsured costs even where the PII policy responds to the underlying negligence claim.
PII and cyber policies can and should work alongside each other. Relying on solicitor PII alone leaves a gap.
What does a real cyber incident look like – and how does cover respond?
Following a break-in at a law firm, several laptops, tablets, and backup devices were stolen. The immediate concern wasn’t the equipment – it was the sensitive client data held on the devices.
Cyber services carried out a rapid triage of the affected devices, identifying which posed a genuine data security risk and which could be ruled out. Forensic investigators were brought in. The investigation confirmed that most data remained secure, significantly reducing the severity of the incident and the number of individuals affected.
Cyber services then coordinated the client notification process, helping the firm meet its regulatory obligations while managing reputational damage. The outcome was far better than it could have been – but only because a cyber policy was in place to fund the response. Without it, the firm would have faced those costs directly.
What cyber and fraud controls do insurers want to see in a solicitor PII submission?
Most firms submit generic statements. Insurers want to see evidence of specific controls operating in practice. The firms that present most favourably are those that can demonstrate:
- Multi-factor authentication (MFA) across all email accounts, remote access, and key systems – the single most effective technical control against account compromise.
- Robust payment transfer processes – restricted access, two-step verification, and a mandatory call-back procedure using a trusted number before any payment is made to a new account.
- Regular cyber awareness training for all staff, including phishing simulations – human error remains the most common entry point for fraud.
- Regular, tested backups stored separately from the live network, so the firm can recover quickly if systems are compromised.
- A documented incident response plan – what the firm does in the first 24 hours of a cyber attack determines how much damage is contained.
- Cyber Essentials or Cyber Essentials Plus accreditation – independently verified and increasingly expected by insurers.
Many firms lack formal payment verification processes, have no staff training programme, and no documented business continuity plan. Those gaps are visible in a submission – and they affect both insurability and premium.
What are the gaps in solicitor PII cover that catch firms out when a cyber or fraud claim arises?
Two assumptions create the most exposure.
The first is that a firm is too small to be targeted. Cyber criminals don’t discriminate by size – smaller firms are often targeted precisely because their controls are less robust.
The second is that having IT support is the same as having cyber insurance. It isn’t. IT support manages systems. Cyber insurance responds to the financial consequences when those systems fail or are compromised – the investigation costs, the regulatory response, the business interruption. A firm without a cyber policy faces those costs directly, regardless of how good its IT provider is.
What’s the single most effective thing a solicitor firm can do right now to reduce fraud exposure?
Introduce a mandatory call-back process for any change to payment details.
Some of the largest losses in solicitor PII arise from email compromise and fraudulent changes to bank account details – particularly during property transactions. A simple, mandatory call using a trusted number before any payment is made to a new account can prevent the vast majority of these incidents.
Combined with staff training and multi-factor authentication, it’s the control that makes the most difference – and it’s the one most firms still don’t have in place. From an insurer’s perspective, firms that can demonstrate strong fraud controls and clear payment verification procedures are viewed more favourably – which means better terms and a more competitive premium at renewal.
Alexandra Henley – Professional Indemnity, Konsileo
21 Sept 2026
