Law Firm IT Support Verification: Callback Script and Staff Checklist
Verify unexpected IT support requests before giving access. A callback script, approved-contact sheet, and staff checklist for law firms.
Someone calls reception: "I'm with IT. We need to check your computer."
Before anyone connects, staff need to confirm who is asking and what work is authorized. A computer already signed in to email or matter files could give the wrong caller access to client information.
End an unexpected support call or chat. Contact IT through the firm's approved number or bookmarked portal, then verify the request.
The FBI's May 2026 advisory describes impostors targeting law firms by phone, email, and in-person visits. ScreenConnect and Quick Assist have legitimate uses; the product name does not verify the caller. Our fake IT support guide explains that risk.
What to say to the caller
If they insist it is urgent:
End the call. Do not accept a transfer to a supposed supervisor or use contact details the caller provides. A ticket number, caller ID, or knowledge of a partner's name is not proof.
What to ask your approved IT contact
Use the contact sheet below or a bookmarked support portal. Do not search for a replacement number during the call.
If IT cannot confirm the request, do not allow access. Notify the firm's designated contact. If support is unavailable, use the approved backup or wait for confirmation.
Keep an approved support-contact sheet
The office manager should complete this with the IT provider through an established contact. Keep printed and approved digital copies available, including for remote staff.
| Field | Firm-approved entry |
|---|---|
| IT provider or internal contact | |
| Main support number | |
| After-hours support number | |
| Bookmarked support portal | |
| Firm approver and backup contact | |
| Approved tools and connection method | |
| How to confirm substitute technicians | |
| Contact for suspected unauthorized access | |
| Sheet owner and next review date |
Keep passwords and recovery codes off the sheet. Review it when contacts change. Confirm any proposed change to the support number through the existing approved contact.
Before clicking "Allow"
Use this for unexpected calls, emails, Teams messages, and support pop-ups.
- Pause. Do not install software, follow supplied links, enter a support code, or approve screen sharing.
- End the interaction. Note the claimed name, company, ticket, and requested action.
- Contact IT independently. Use the approved number or bookmarked portal.
- Confirm the assignment. Have IT check its records and confirm the technician, computer, work, and connection method.
- Escalate unusual work. Get designated firm approval before document exports, new upload destinations, storage-device connections, or changes to security protections.
- Protect sign-ins. Never share passwords, recovery codes, or MFA authentication codes with the caller. Do not approve an unexpected sign-in prompt.
- Record the outcome. Note who verified the request, when, and whether it was approved, declined, or reported.
A remote-support session code can enable access. It is different from an account authentication code, but should be used only after verification.
Files and office visits need verification too
If someone asks for documents to "check a backup," confirm the purpose, destination, and permission through the same approved channel. Use the firm's approved sharing method.
For an unexpected technician at reception, confirm the visit with IT before granting access. Follow visitor and escort rules; obtain approval before connecting storage devices.
If access was already granted
Report it promptly, even if the computer still works.
- End the session if possible. If access may remain active, disconnect Wi-Fi and Ethernet. Call verified IT and the firm's response lead from another device.
- Keep messages, voicemails, caller details, tool names, and times. Do not restart, wipe, or uninstall software before responders advise you.
- Explain what happened: screen access, installed software, sign-in approvals, credentials entered, connected devices, or files sent.
- Let responders assess ongoing access and account or file activity. Coordinate any credential resets and session revocation from a trusted device.
Closing a window does not prove access has ended. The incident response plan template helps assign contacts before an incident; it is not an emergency support channel.
Practice the callback
Agree on this procedure with your IT provider. Ask which tools are approved, who can connect unattended, and how unusual sessions are detected. The joint remote-access guide covers those controls. Authorized unattended maintenance needs its own documented process.
Then try a five-minute staff discussion: a caller knows a partner's name and asks for access to fix an email problem. Have everyone find the approved number and read the script. Record gaps and assign follow-up.
For recurring practice, Cybersecurity Awareness Training for Law Firms provides weekly scenarios, feedback, and completion tracking alongside your IT safeguards. It does not include live telephone impersonation tests or incident investigation.
For related exercises, see Phishing Training for Law Firms: What to Test and Measure.
This article is informational and is not legal, compliance, or insurance advice.