How the scam reaches a broker’s file
A property deal is full of emails: deposit details, cash to complete, discharge amounts, who pays whom and when. The Australian Cyber Security Centre warns that criminals impersonate parties to a property transaction, such as real estate agents or conveyancers, and insert illegitimate bank details for settlement or rental payments.
The fake emails may come from hacked accounts, or from a web address that is only a letter or two away from the real one. A successful scam can go unnoticed for weeks until someone follows up on a missing payment.
Remember
- The criminal replaces a real bank account with their own.
- The email can come from a hacked mailbox or a look-alike address.
- Nobody notices until the money is missing.
Facts and sources for this part
- The Australian Cyber Security Centre warns that criminals impersonate parties to a property transaction, such as real estate agents or conveyancers, and insert illegitimate bank details for settlement or rental payments. [S11]
- The fraudulent emails may come from hacked email accounts, or from domain names similar to a real company, and a successful scam can go unnoticed for weeks until someone follows up on a missing payment. [S11]
Lenders and brokers are on the target list
The same alert says criminals also single out mortgage lenders in order to intercept property settlements. A broker sits between the client, the lender and the conveyancer, so an email that looks like it comes from any of them can look normal in your inbox.
It also says settlement systems can stay secure while the new bank details put into them are fraudulent, so the buyer sends funds to the criminal’s account. The system was not hacked; a person was fooled.
Remember
- Criminals target lenders and the people around them.
- A secure settlement system does not make a bad bank account safe.
- The weak point is the email that asks for a change.
The one check that works
If any party to a property transaction says their bank details have changed, confirm it by calling the sender’s established phone number, or meeting them face to face, before transferring any funds. That is the Australian Cyber Security Centre’s advice.
Our advice: take the phone number from your own file or the lender’s website, never from the email that asks for the change. Read the new account number back out loud. Write down who you spoke to and when.
Our advice: tell your clients at the start that your firm will never change bank details by email, and that they should phone you if an email ever says otherwise.
Remember
- Call a number you already trust, not one in the message.
- Meet face to face if you can.
- Tell clients early that bank details never change by email.
Facts and sources for this part
- If any party to a property transaction says their bank details have changed, confirm it by calling the sender’s established phone number, or meeting them face to face, before transferring any funds. [S11]
Train the whole team, not just yourself
The Australian Cyber Security Centre tells businesses to train staff to spot suspicious emails, including requests to change bank account details and emails linking to fake websites. Your loan processor, your admin assistant and your referral partners all see the same inbox traffic you do.
Our advice: make the call-back check a written step that anyone can use, and make it normal for a junior to say “I need to ring and check that”. A scam depends on pressure and hurry, and a rule that says “always ring” takes the pressure away.
Remember
- Everyone who can touch a payment instruction needs the rule.
- Make the check a written step.
- Nobody should be told off for ringing to check.
Facts and sources for this part
- The alert tells businesses to train staff to spot suspicious emails, including requests to change bank account details and emails linking to fake websites. [S11]
Scenario: new account details the day before settlement
Dev is buying a unit. The day before settlement, an email arrives that looks like it comes from Maple Street Conveyancing (the address is info@maplestreet-conveyancing.example): “Please use our new trust account for the balance. The old one is being closed.” Dev forwards it to you and asks if it is fine.
The right move is simple. Do not reply to that email. Ring the conveyancer on the number in your own records, ask them if the details changed, and ring Dev to say what you found. If the conveyancer says the email is not theirs, tell Dev to stop, tell the conveyancer and your licensee, and report it. If money has already gone, ring Dev’s bank at once.
Red flags: a change of bank details, an urgent deadline, a request to reply by email, and a look-alike web address.
Remember
- Never confirm a change by replying to the message that asked for it.
- Call the conveyancer on a known number and tell the client what you found.
- If money has moved, call the bank immediately.
Facts and sources for this part
- The Australian Cyber Security Centre warns that criminals impersonate parties to a property transaction, such as real estate agents or conveyancers, and insert illegitimate bank details for settlement or rental payments. [S11]
- If any party to a property transaction says their bank details have changed, confirm it by calling the sender’s established phone number, or meeting them face to face, before transferring any funds. [S11]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
A conveyancer’s email says their bank details have changed for settlement. What does the ACSC advise?
Show the answer
Right answer: B, Confirm by calling the sender’s established phone number, or meet face to face, before sending funds. The advice is to take extreme care to confirm changes by calling the sender’s established phone number or meeting them face to face before transferring any funds. [S11]
Question 2 of 3
Who else does the ACSC alert say criminals single out to intercept property settlements?
Show the answer
Right answer: B, Mortgage lenders. The alert says cybercriminals are also singling out mortgage lenders in order to intercept property settlements. [S11]
Question 3 of 3
Which kind of sender address is a typical trick in these scams?
Show the answer
Right answer: D, A domain name similar to the real company’s. Fraudulent emails may come from hacked accounts or from domain names that are similar to legitimate companies. [S11]