How it happens
A property deal runs on email: deposit details, cash to complete, payout figures. A criminal who gets into that conversation, or copies it, only needs one believable message that gives a new bank account.
- The criminal impersonates a party to the deal and inserts illegitimate bank details.
- The email comes from a hacked account or a domain name similar to a real company.
- Criminals also single out mortgage lenders to intercept settlements.
- It can go unnoticed for weeks until someone follows up a missing payment.
Facts and sources for this part
- The Australian Cyber Security Centre warns that criminals impersonate parties to a property transaction, such as real estate agents or conveyancers, and insert illegitimate bank details for settlement or rental payments. [S11]
- The same alert says criminals also single out mortgage lenders in order to intercept property settlements. [S11]
- The fraudulent emails may come from hacked email accounts, or from domain names similar to a real company, and a successful scam can go unnoticed for weeks until someone follows up on a missing payment. [S11]
Why a secure system does not help
The settlement system can stay secure while the new bank details put into it are fraudulent. The buyer then sends funds to the criminal’s account, because a person, not the system, was fooled.
Facts and sources for this part
- Settlement systems can stay secure while the new bank details put into them are fraudulent, so the buyer sends funds to the criminal’s account. [S11]
What stops it
- Call the sender’s established phone number, not one in the email.
- Train staff to spot requests to change bank account details.
- Tell clients early that bank details never change by email.
Facts and sources for this part
- If any party to a property transaction says their bank details have changed, confirm it by calling the sender’s established phone number, or meeting them face to face, before transferring any funds. [S11]
- The alert tells businesses to train staff to spot suspicious emails, including requests to change bank account details and emails linking to fake websites. [S11]
A short script for clients
Tell clients at the start: “We will never ask you to change bank details by email. If you get an email that says we have, ring us on the number you already have.” Say it again in your settlement reminder.
Facts and sources for this part
- If any party to a property transaction says their bank details have changed, confirm it by calling the sender’s established phone number, or meeting them face to face, before transferring any funds. [S11]