The 12 email questions a carrier or underwriter asks.
Use this for your malpractice renewal, your ALTA assessment, or the next time a client asks “is email safe?”.
- Have you assessed which matters require more than ordinary email? Opinion 477R expects a judgment, not a default.
- Is client email encrypted in transit, always? Enforced TLS with a fallback — not “usually”.
- How are privileged or settlement documents sent? Locked delivery with a code for the sensitive ones, by policy.
- How do you send wire instructions, and how are changes handled? Always locked, with a verify-by-phone notice; inbound changes flagged.
- Can staff recognize an impersonated lawyer or title agent? Technology flags it; training backs it up.
- Is MFA on for every account? Carriers increasingly require it.
- Can you place a litigation hold that actually prevents deletion? By matter or custodian, enforceable.
- How long is email kept, and can you prove it wasn’t altered? Written retention; immutable archive.
- Can you produce every message on a matter in e-discovery formats? Export from the archive, not from inboxes.
- Who at your vendors can read client email, and where are they? No offshore access to content; logged access.
- Is your domain protected from spoofing? SPF, DKIM, DMARC published.
- What is your plan when a wire goes to the wrong account? Incident playbook: bank recall, FBI IC3, carrier notice, client communication — within hours.
Why these twelve
Questions 1 to 3 come straight from ABA Formal Opinion 477R, which says a lawyer must make reasonable efforts under Model Rule 1.6(c) and that the effort depends on the sensitivity of the matter: unencrypted email may be fine for a scheduling note and not for a settlement draft. Questions 4, 5 and 12 come from the wire-fraud guidance in ALTA Best Practices Pillar 3 and from the underwriter assessments built on it. Questions 6 and 11 are the two controls every cyber and E&O carrier now asks about: MFA and a published DMARC record. Questions 7, 8 and 9 come from litigation-hold and e-discovery duties: a hold that is only a memo does not stop deletion. Question 10 is the vendor question on every client questionnaire.
The numbers behind questions 4 and 12
The FBI’s IC3 2024 Internet Crime Report counted 21,442 business email compromise complaints and $2.77 billion in losses in 2024, out of 859,532 complaints and $16.6 billion in reported losses overall. The Coalition 2026 Cyber Claims Report found that BEC and funds-transfer fraud made up 58% of all claims, that 52% of funds-transfer-fraud claims began as BEC, and that the average BEC loss was about $27,000 with the average claim about $116,000. The NetDiligence Cyber Claims Study 2025 found 98% of claims came from small and mid-sized businesses. This is why the underwriter asks how you send wire instructions before anything else.
A worked answer sheet: Harbor Title
Fourteen people, Microsoft 365, Qualia. Escrow officer Maria filled it in for the E&O renewal and the underwriter assessment in the same week.
| # | Harbor Title’s answer | Evidence |
|---|---|---|
| 1 | Written policy: wire instructions, closing packages and anything with an account number go locked; routine scheduling goes TLS | Policy page in the compliance binder; rules in Console → Policy |
| 2 | TLS enforced for all outbound mail; recipients that cannot negotiate it get locked delivery instead | Policy screenshot; audit trail entries showing the decision per message |
| 3 | Locked delivery with a one-time code; 30-day expiry; revocable | Sample notification and open log |
| 4 | Always locked, with a verify-by-phone notice in the message; inbound “updated wire instructions” are flagged and held | Wire-instructions detection rule; held-message log |
| 5 | Inbound impersonation flagged by policy; annual training with a wire-fraud module | Training roster; policy rule |
| 6 | MFA on all 14 accounts, enforced in Microsoft 365 and in the PXCMail console | Console → Users export |
| 7 | Legal hold by file number or custodian in the archive; deletion blocked while the hold is on | Hold list in Console → Archive |
| 8 | Six years, immutable storage; sha256 manifest on every export | Retention setting; sample manifest |
| 9 | EML or PST export by file number with chain-of-custody statement | Last export job record |
| 10 | US-based PacinfraX staff only, on written request, logged; no offshore content access | Data residency page; Data Processing & Safeguards Addendum |
| 11 | SPF, DKIM and DMARC at p=reject | Scanner result, dated |
| 12 | Playbook: bank recall request, IC3 complaint, carrier notice, client call, all within the first hours; the audit trail identifies every affected message | Playbook in the binder; the first 60 minutes printed |
How to use it before the renewal
- Fill in the sheet two weeks before the application is due, so gaps become tasks instead of “no” answers.
- Run the scanner for question 11 and fix DMARC first; it is the fastest fix and the one underwriters check themselves.
- Send one wire-instruction email to yourself and keep the notification, the code screen and the audit entry as evidence for questions 3 and 4.
- Place a test legal hold on a closed file and confirm a message under it cannot be deleted.
- Attach the sheet to the application and keep a copy with the underwriter assessment.
FAQ
Does Opinion 477R require encryption for all client email?
No. It requires a judgment about which communications need it and reasonable efforts for those. Writing that judgment down as a policy, with the technology enforcing it, is the answer underwriters accept.
We are a title company, not a law firm. Which questions apply?
All twelve. ALTA Pillar 3 covers the same ground as 477R for settlement data, and questions 4, 5 and 12 were written with escrow in mind.
Is a hold in Microsoft 365 enough for question 7?
A Microsoft 365 hold can work, but it lives in the same tenant as the mailboxes and the admin who sets it can lift it. Carriers and opposing counsel ask for a separate, immutable copy; see the comparison.
Will PXCMail stop every wire-fraud attempt?
No product does. It makes wire instructions go out locked, flags inbound changes, and records every open, which removes the common paths and gives you evidence for the rare ones.
Related
ABA 477R and ALTA, in plain English · Legal & Title · Title & escrow · Wire fraud by email