That Court Filing Email Could Be a Trap: A Law Firm Verification Checklist

A court filing notice arrives while your team is preparing for a hearing. Someone needs to open it, identify the document, and make sure nothing gets missed.

That ordinary workflow gives a fake filing email its leverage: the recipient has a good reason to act quickly.

The U.S. District Court for the District of Oregon warns that fake Notices of Electronic Filing (NEFs) have circulated nationwide. In the sequence it describes, the first email prompts a reply. A follow-up then provides a document link that leads to a malicious website. The court recommends checking suspicious notices against the docket in PACER. Read the court’s warning.

If a filing email seems suspicious, open the court system independently and verify the filing there.

What the court warnings say

The District of Oregon updated its warning on August 20, 2026. The same reply-then-link sequence appeared in a warning from the U.S. District Court for the Western District of Michigan on November 6, 2024. Michigan also tells recipients to validate case information independently through CM/ECF. Read Michigan’s notice.

These notices describe a phishing method. They do not say that PACER or CM/ECF was breached, identify a particular attacker, or establish that every suspicious email carries the same payload.

A convincing court-related message may reach someone whose job requires handling filings, documents, and deadlines. The firm needs a process that lets that person keep the matter moving without trusting the email.

Why a familiar case name is not enough

A case number, attorney’s name, court seal, or professional-looking signature can make an email feel credible. Treat those details as things to check, not proof that the message is authentic.

The reply-first sequence is easy to overlook. Staff may know not to open an unexpected attachment but still answer a message asking whether they received a filing. That reply can lead to the document-link stage described by the courts.

Following a malicious link could expose credentials or trigger a harmful download. Those are possible risks, not confirmed outcomes for every fake NEF. The court notices do not establish what happened to any particular recipient.

A five-step checklist for suspicious court filing emails

1. Pause the email interaction

Do not reply, open attachments, follow links, or call a number included in the suspicious message. Use your firm’s approved process to report it.

An urgent claim still deserves prompt attention. Alert the responsible attorney so the team can check for a filing or deadline through an independent route.

2. Open the court system through a trusted route

Open PACER or the relevant court’s CM/ECF site using a saved bookmark you have verified, or start from the court’s official website. If you need to find the court’s site, use an independently verified court directory or address.

For a state-court notice, use that court’s official filing or case-access system. PACER provides access to federal court records; it is not a substitute for checking a state-court docket.

3. Match the message to the docket

Compare the court, case number, parties, docket entry, filing date, and document description. If authorized and available, review the document through the court system.

A real case with a matching name does not authenticate the email. Check the specific filing the message claims to announce.

If the docket does not resolve the question, ask the responsible attorney or contact the clerk’s office using independently obtained contact details. Do not return to the suspicious link to investigate.

4. Report the message and preserve it

Notify the person responsible for security response, whether that is an office manager, internal IT contact, or outside provider. Use the firm’s designated reporting button or process so the original message and headers can be preserved.

Do not forward a clickable copy to the whole office. The security contact can check whether others received it and send a warning through an approved channel.

The U.S. Courts’ scam guidance advises attorneys to validate case documentation directly through CM/ECF and contact the relevant court before opening suspicious links or attachments. It also recommends contacting the local clerk’s office to report scams.

5. Say exactly what happened

If someone interacted with the message, report whether they replied, clicked, entered a password, approved an authentication prompt, granted an application permission, or opened a download.

Each action may call for different follow-up. A click alone does not prove a compromise, and changing a password alone does not show that an incident is resolved. Your security contact can assess what happened, preserve evidence, and coordinate account or device containment as needed. For a broader response sequence, see Attorney Incident Response: Your First 72-Hour Playbook.

Check court-specific guidance

Oregon’s notice says its official CM/ECF NEFs have no attachments, link directly to ecf.ord.uscourts.gov, and do not include instructions for next steps such as filing a response. These details apply to District of Oregon notices; they are not universal rules for every federal or state court.

Michigan’s warning identifies ecfhelp@miwd.uscourts.gov as its NEF sender. A displayed sender address is a clue to examine, not a reason to skip independent verification.

Keep a short reference sheet for courts your firm uses regularly. Include verified portal bookmarks, clerk contact information, published notice guidance, and the person responsible for resolving uncertain messages. Review it when court systems or procedures change.

Give staff words to use under pressure

“Be careful with phishing” leaves too much to individual judgment. A more useful instruction is:

Practice the response with attorneys, paralegals, legal assistants, and anyone monitoring a shared filing inbox. Ask them to show where they would check the docket and how they would report a suspicious message. Make sure they know to escalate promptly if someone has already clicked.

For ideas on practicing verification and reporting, see our phishing readiness guide for law firms. It covers staff decisions around suspicious requests, reporting, and follow-up.

Make filing verification part of staff training

Give staff a clear procedure, then help them practice before a suspicious notice arrives during a busy workday. Our cybersecurity awareness training for attorneys and staff uses short weekly decision challenges on phishing, fake e-filing notices, suspicious sign-ins, and risky document sharing. Managers can review completion and scores.

The point is to verify the filing without using the email to find it.