For law firms
Payment instructions that look like they came from your firm?
That's how wire fraud aimed at law firms often starts: a settlement, a retainer or a closing, and an email in your firm's name telling the client where to send the money, from your exact address or from one a letter off. Your exact address can be set so forged mail is refused. The look-alikes can be watched and reported. And the record of the work goes in your file.
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, page 7.
What the ABA has said
Formal Opinion 477R (2017). A lawyer has an ethical responsibility to use reasonable efforts when communicating client confidential information over the internet.
Formal Opinion 483 (2018). Lawyers must make reasonable efforts to monitor their technology for a breach, and when a breach involves, or is substantially likely to involve, material client information, they have a duty to tell the client.
We aren't lawyers and this isn't legal advice. Your own state's rules control, and whether your firm's efforts are reasonable is for you to judge. Mail forged in your firm's name isn't by itself a breach of your systems, and we can't see inside your mailboxes: we watch who sends as your firm and the names that imitate it. That can be part of your efforts, with a dated record to show for it.
Start with the free check
It reads your public records in about a minute: whether a stranger can send mail as your firm's exact address today, and which look-alikes of your name are registered. No account, no card. The written plan that follows is free too, if you'd rather do the work yourself or hand it to whoever runs your IT.
We look for every service that sends mail in your firm's name: your email provider, your practice management and billing software, e-signature, your website's forms. We set each one up, then tighten enforcement in stages over 60 to 90 days, reading the reports at each stage, so a sender we missed shows up while it's still small.
-
$1,750 now, $1,750 at the end
Half to start, half when your domains are refusing forged mail. If that takes longer than 120 days for reasons that aren't ours, the second half is due then.
-
$3,500 paid at once
The same work, one payment, one receipt.
Up to three domains and up to ten services that send as them. A note for your clients about how your firm sends payment instructions, ready to send.
Every daily report read. The morning they show mail sent in your firm's name that failed the check, an email: how many, what each mail provider did with them, and where they came from. A short note each week. An email the morning after our nightly check finds a new look-alike that could pass for your firm, or finds one newly set up for mail, and the notice to its registrar drafted, filed and followed up when one needs it. Your dated record of the work whenever you need it.
-
$1,350 a quarter
Stop whenever you like and you aren't billed for the next quarter.
-
$4,800 a year
$600 less than paying by the quarter.
For the domains in your Fix. If you already did the work yourself, the Watch can start on its own.
Beyond the standard Fix and Watch, this price covers up to three domains, up to ten services that send as them, and the dated record for your file.
One domain and up to five sending services? The standard Watch covers the watching; this one adds the dated record for your file.
The record for your file
A dated account of what was checked and done for your domains: where each one started and where it is now, every change with the day our check saw it, mail that failed the check month by month and what happened to it, the look-alikes watched, and what we sent you. Built from stored checks and the daily reports mail providers send, never typed in. For your firm's written security policy, your insurer's questions at renewal, and a client's security questionnaire.
Each copy carries a reference and a fingerprint. We keep the data it was made from and a fingerprint of the file itself, and each day's are sealed with independent timestamps. Send us your copy and we'll tell you whether it's the exact file we made.
It's a record, not a certification. It doesn't say that a firm meets an ethics opinion, a bar rule or any insurer's requirements.
It shows what was checked and when. It isn't an opinion on whether you've met your professional duties; that's your judgment.
For your vendor file
Who we are. CopycatCheck is a product of ATXworks.dev, operated by C. Achberger in Austin, Texas.
What we touch. Your DNS settings, and only after a written agreement that says exactly what we'll change. No mailbox access, no passwords, nothing installed.
What we never receive. The content of your email, the addresses it went to, and your client files. The daily reports carry which servers sent in your name, how many messages, whether each passed the checks, and which provider reported it. Some also name the domain a message was delivered to, never the address, and for a firm that domain can be a client's company.
Where it lives. On servers we rent in Germany from Hetzner. Email we send goes out through Resend, the daily reports arrive in our Google mailbox, and payments go through Stripe. The privacy page names every service and says how long we keep each thing.
Paperwork. Ask and we'll sign a data processing agreement or a confidentiality agreement with you.
Before you decide
We never see your email. The reports show which servers sent in your name and how many, never what was written or the address it went to. We never see a client file.
What we can't promise. Enforcement turns away forged mail using your exact address at the providers that honor it, which is most of the large ones. It doesn't stop a look-alike address, or a real mailbox somebody has broken into. We file notices about look-alikes and follow them up; the decision belongs to the registrar, not to us. A note to your clients about how your firm sends payment instructions covers what no setting can.
What our watch covers. Our nightly check looks at the versions of your name it makes, the common misspellings and swaps, not every possible one. A name it finds for the first time may have been registered long before, so the email gives its registration date when public records have one. One that looks like a real business, or was registered long ago, goes in the weekly note instead of a morning email.
Refunds. Change your mind before we make the first DNS change and we refund The Fix in full. After that we refund the part we haven't done. The Watch stops at the end of any quarter you have paid for, and a year paid up front is refunded for the months we haven't watched. Full terms are on the terms page.
We check the domains are yours before taking any money. A code to an address at each one, or one DNS record, about five minutes, and it costs nothing. Nobody can buy work on a firm that isn't theirs.
More than three domains, or several offices? Tell us what you have and we'll quote it plainly.