Law firms are no stranger to phishing schemes. Just ask Ostroff Injury Law in Philadelphia, which almost forked over $100,000 in settlement funds to a scammer leveraging a fake Facebook page and a non-existent dog bite.

Now, even a phone call from the boss could be a cause for suspicion. The Wall Street Journal published a report in late August about a bad actor who used AI voice technology to create a "deepfake" impersonation of a high-ranking executive at a U.K.-based energy firm directing the company's CEO to transfer approximately $243,000 to a Hungarian bank account.

So do law firms need to be worried about whether or not the person on the other end of the line is real or a very convincing deepfake?

"They are a business just like anybody else, so if that deepfake technology gets to the point where they really are cloning phone calls in a way, yeah I think that it could work just the same against a law firm as it would against a corporation," Gulam Zade, CEO of the legal IT consulting firm Logicforce.

The key word there is "could."

While Frank Gillman, a principal at Vertex Advisors Group and former chief information security officer at Lewis Brisbois Bisgaard & Smith, thinks that while technology needed to initiate a successful audio deepfake isn't too far off, there are still some speed bumps that could potentially hinder a would-be scammer.

"I think it's pretty hard to truly imitate a natural cadence to a conversation when you're talking to a machine," Gillman said. "That stuff isn't cheap to do."

That might provide some indication as to why email still seems to be among the more popular methods for the average scammer. Zade said Logicforce hasn't seen many law firms grappling with fraudulent phone calls.

Whereas email provides a direct channel of access to an attorney or decision maker, Zade pointed out that phone lines are usually buffered by staff at the front desk or other assistants who act as gatekeepers.

"It's not very likely that you as a scammer is going to get an attorney on the phone," Zade said.

But those defenses aren't always in place thanks to an increasingly mobile work environment that sees many workers conducting business on-the-go or away from the office.

Gillman believes most fraudulent calls are likely to reach an attorney through their cell phones rather than on an office line.

"I think where firms miss the boat a little bit is they don't focus on the fact that so many lawyers are doing business on their cell phones now," Gillman said.

He thinks that while many firms have controls in place to intercept spam emails, protection against fraudulent phone calls still largely comes down to employee training.

The essence of that training probably won't require much tweaking in the event that deepfake phone scams catch on: If a call seems fishy, hang up and alert the IT department.

"I think people know when something feels a little off," Gillman said.