Overview
The rising threat of card testing attacks
For many UK law firms, enabling clients to make payments through their website seems like a natural step towards convenience. After all, we live in a digital-first world, and clients expect the ability to settle invoices online. However, what often goes unnoticed are the growing insecurities tied to accepting direct card payments on law firm websites.
One of the most common (and costly) risks is card testing attacks. Criminals use law firm websites that accept guest payments as a testing ground for stolen or fabricated card details. By running hundreds or even thousands of small test transactions, fraudsters can determine whether card details are active before using them elsewhere.
For law firms, this creates a number of problems
- Financial exposure: Each fraudulent transaction often comes with fees, chargebacks, and administrative overhead.
- Reputational damage: Clients expect their law firm to safeguard sensitive information. A compromised payment system can undermine trust.
- Regulatory pressure: Law firms are held to strict compliance standards. Any weakness in handling client payments can attract scrutiny from regulators and professional bodies.
Why traditional guest payments aren’t enough
Most payment pages on law firm websites operate on a guest payment model. Anyone with card details, legitimate or not, can access the page and attempt a transaction. The lack of client authentication means the system cannot distinguish between genuine clients and malicious actors. For an industry that relies heavily on trust and confidentiality, this is far from ideal.
A more secure approach: Mozaique Client Portal by Accesspoint
At Accesspoint, we’ve developed a secure client portal designed to give law firms peace of mind when it comes to online payments. Unlike open guest payment systems, our Mozaique Client Portal requires clients to log in securely before making a payment.
This ensures that:
- Only valid entities can access the payment facility, reducing the risk of card testing attacks.
- Client data remains protected within a controlled environment.
- Law firms maintain compliance with industry regulations by using a purpose-built legal services platform.
✨ Want to see how Mozaique can transform the way your firm handles payments? Book a demo with our team today.
