Playbook, law firm

Locked out of the client portal, with a document waiting

Firms that put documents behind a portal collect a new category of message: somebody with an expired link, a forgotten password, or a joint client trying to work out whose login to use. It looks like an ordinary support question and it is not, because answering it usefully would mean confirming that the person is a client and that something of theirs is sitting there. Both of those are things the firm keeps confidential, and the assistant has no way to verify who is typing.

Why this is not the general answer

The handling pattern for account access problems holds across every trade. What follows is the part that does not.

  • Confirming that somebody has a portal account confirms that the firm acts for them, which is a fact this trade protects even when the person asking is obviously the client.
  • The portal usually exists because documents need signing or approving, so being locked out is not an inconvenience, it is a step in a matter that has stopped moving.
  • Joint clients on a transaction or a probate often expect one shared login, and whether that is possible is a decision the firm has made about identity rather than a preference about convenience.
  • Portal invitations are commonly issued per matter and expire, so an old link failing is normal rather than a fault, and saying so removes most of these messages before they become calls.

How it arrives

  • i cannot log into the client portal
  • where do i sign the documents you sent
  • the link in your email has expired
  • can you resend my portal invitation
  • my husband and i are joint clients can we share one login
  • is the completion statement in the portal

What has to be indexed for this to work

Material behind this answer
How the portal is issued and how long a link lastsWho sends the invitation, whether it is per matter, how long a link is valid and what to do when it expires. Most of these messages are somebody using a link from three weeks ago, and one published sentence ends them.
The self service steps that need no identity checkResetting a password from the login page, the address a reset arrives from so it is not mistaken for something else, and where to look if it does not appear. Anything that only touches the person's own inbox is safe to describe in full.
Your position on joint clients and authorised peopleWhether each client gets a separate login, whether an authorised third party can be given access at all, and what the firm requires first. Write it as policy so the assistant states it rather than reasoning towards it.
Who to contact when a document is waiting and time mattersThe route and the response time when a signature is holding something up. A client who cannot sign is a matter that has stopped, and this contact is the one worth naming rather than leaving to a general form.

The reply

A reply worth copying
Portal invitations are issued for a specific matter and the links expire, so an older email will often stop working [1]. You can reset a password from the login page itself, and the message arrives from the address shown there [2]. I cannot reset anything, resend an invitation, or confirm whether there is an account or a document waiting, since I have no way to check who I am speaking to. If the reset does not get you in, leave me your name and an email and the team will sort it out.

It puts the likely cause first, because an expired link explains most of these and the person can act on it immediately. The self service step is described in full since it touches only their own inbox. The refusal names the reason as identity rather than as policy, which is both true and much easier to accept than an unexplained no.

Where it stops

The trigger. The visitor asks for a reset or a resend, asks what is in the portal, or says a signature is holding up something with a date attached to it.

The handover, worded
I cannot reset a login or see what is waiting for you, and I have no way to confirm who I am speaking to. Leave your name and an email and the team will get you back in.

It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.

Never say this here

Out of bounds

  • Never confirm that somebody has an account, a matter or a document waiting, because that confirms the firm acts for them.
  • Never say a login has been reset, an invitation resent or access restored, since nothing here touches any system.
  • Never suggest sharing a login between joint clients, or passing one to a relative, whatever the reason given.
  • Never ask the visitor to send a password, a code or a document by chat in order to be helped.

Questions

Can it reset the password if we connect the portal?
No. It has no write access to anything and cannot verify who is typing, which in this trade is the point rather than a shortcoming. It explains the self service route and collects a name and an email for your team.
Is it really a problem to confirm that a document is waiting?
It is, because the assistant cannot tell the client from anybody else who knows their name. In another trade that is a minor risk. Here it discloses that the firm acts for the person, which is the thing you are keeping confidential.
What single change reduces these messages most?
Publishing the fact that invitations are per matter and links expire. Almost every one of these is an old link, and clients assume a failure means something has gone wrong with their matter rather than with an email from last month.

Keep reading

Try it on your own material

Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.