Find your course
Menu

Scam training your trainers can deliver, ready to license.

Two ready-made course packs for training providers: a Victorian property CPD activity on privacy and cyber security, and learner resources for the national unit BSBXCS402. Your presenter delivers and your organisation tells the regulator. We supply the slides, notes, questions, certificates and a yearly update.

Talk to usSee a sample
  • Built to the BLA’s written outline
  • Examples use invented people and bank details
  • Every rule tied to a stored source

What you get.

  • Victoria property CPD pack: Privacy and cyber security

    For the mandatory activity for estate agents and agents’ representatives. The first CPD year starts on 1 April 2027.

    • Slides with a presenter script: 36 slides, about 70 minutes of teaching, 14 polls, scenarios and exercises (.pptx)
    • A written assessment of practical scenarios: 30 questions in 3 forms, 80% pass mark, 2 re-attempts (.json and printable)
    • A certificate generator with every field the BLA lists
    • An attendance-to-certificate checklist and a blank register
    • A one-page table: each point of the BLA outline against the slides, exercises and questions
    • A guide to notifying the BLA, from the BLA’s own pages

  • BSBXCS402 learner resources for RTOs

    For registered training organisations delivering Promote workplace cyber security awareness and best practices, using AI-scam examples.

    • A learner guide: 6 lessons covering all 9 performance criteria and the knowledge the unit lists
    • 13 activities and a workbook
    • 5 assessment tasks and an assessor guide with benchmark answers
    • A mapping matrix: every performance criterion, the performance evidence, the knowledge evidence and the foundation skills
    • A SCORM 1.2 package and a 12-question quiz for your learning system

Your RTO stays responsible for assessment. These are learner resources: we do not issue the unit.

Who it is for.

Victorian property CPD

  • Victorian RTOs with CPP41419 Certificate IV in Real Estate Practice or CPP51122 Diploma of Property (Agency Management) on their registration.
  • The prescribed organisations the BLA lists, and contractors or agents of these.

Providers in other states

  • We build to a state’s published rules. Victoria is first. Tell us what your regulator asks and we will check it against the published rules.

RTOs delivering BSBXCS402

  • Learner resources, activities and assessment tasks mapped to every performance criterion, ready to adapt to your own assessment tools.

Workplaces with their own learning system

  • The lessons and quiz as a SCORM 1.2 package that reports completion and score to Moodle and similar systems.
  • An RTO can provide CPD for estate agents if it is approved by ASQA or the VRQA to deliver CPP41419 Certificate IV in Real Estate Practice or CPP51122 Diploma of Property (Agency Management) in Victoria. [V4]
  • A contractor or agent of an eligible organisation can also provide CPD activities. [V4]

What we do, and what you do.

We

  • Write the course content from published rules and guidance, and check it word for word against stored copies.
  • Give you the files, and a new edition each year.
  • Answer questions about the files.

We do not, and you do

  • We never run live sessions. Your presenter delivers. For the Victorian activity the BLA says it must be delivered by or with an expert working in cyber security.
  • We do not enrol participants, mark assessments or issue certificates. You issue them.
  • We do not notify the regulator. You do. We do not promise that the BLA or anyone else will accept an activity.
  • The BLA outline says the activity must be delivered by the CPD provider by or in conjunction with an expert working in cyber security. [V1]
  • Conferences, self-study and pre-recorded webinars do not count as CPD activities under the new rules. [V3]
  • A provider that delivers a mandatory activity must follow the BLA’s activity outline and attach a course outline and assessment to the CPD activity form. [V4]

Price.

A$1,500 a year per organisation, including GST. That covers all your presenters and learners, and the yearly update.

Or A$15 for each certificate you issue, including GST.

Nothing is for sale yet. Tell us you are interested and we will write when licences open. The draft terms are plain: one organisation, no resale, yearly updates.

Talk to us

A sample from the Victorian pack.

Real material from the pack. Every name, business, address and bank detail in it is invented.

Three of the 36 slides

Scenario 1: the settlement funds emailSlide 8 · Part 1: What BEC is

Invented example. From: Linden & Moss Conveyancing <settlements@lindenmoss-legal.example>
To: Dev Okafor
Subject: RE: 12 Wattle Grove – final settlement funds – UPDATED ACCOUNT

Hi Dev,

Following our bank’s security audit our trust account has changed. Please send the balance of $187,400 to the new account below by 3pm Thursday so settlement is not delayed.

Account name: L&M Trust Services

BSB 000-123 Account 0000 1234

Please do not reply to the old account details. Call the office only if urgent; we are in settlements all day.

Regards, Linden & Moss Conveyancing

  • Dev (the buyer) forwards this to you: “Is this right?”
  • Discuss with the person next to you (2 minutes): what would you check first? what would make you stop?
Presenter notes: Read the email aloud, slowly. Give pairs two minutes.
Verifying payment details: the call-back ruleSlide 25 · Part 3: Reducing the risk
  • 1. Any request to change payee or bank details is a stop sign
  • 2. Do not reply to the email or use a number in it
  • 3. Phone the person on a number you already hold or find yourself
  • 4. Check the new details against the old, aloud, with the right person
  • 5. Record who you spoke to, when, and what was agreed
  • 6. For larger amounts, a second person approves
Presenter notes: This is the core control and the focus of outcome 3. Scamwatch: contact the business you normally deal with by phone using a number you have sourced independently; do not seek verification via email; do not call any number listed in the email; consider multi-person approval for transactions over a threshold; have a clearly defined process.
Poll 2: which one is the phish?Slide 17 · Part 2: Spotting phishing

Which message has the strongest signs of a phish?

  1. A. Calendar invite from your principal, normal address, no links
  2. B. Portal message with a link to confirm your listing within 24 hours
  3. C. Tenant maintenance request through the usual software
  4. D. Supplier invoice that matches the quote, sent to the usual contact
Presenter notes: The answer is B. Talk through why: pressure, a link to log in, a consequence.

The mapping table

Part of the one-page mapping table. The pack’s version also names every slide, exercise and question.
Point of the BLA outlineTeaching slidesExercise slidesAssessment questions
Overview: understand the current risks from BEC scams and best practice strategies to mitigate them3, 5, 6, 7, 10, 324all forms
Learning outcome 1: understand and describe the nature of BEC scams targeting the real estate sector, including specific examples3, 5, 6, 7, 9, 10, 15, 324, 8, 11, 12, 18, 20, 26A: A01, A02, A03 · B: B01, B02, B03 · C: C01, C02, C03
Learning outcome 2: the ability to identify suspicious emails and other phishing attacks3, 9, 14, 15, 328, 12, 13, 16, 17, 18, 19A: A04, A05, A06 · B: B04, B05, B06 · C: C04, C05, C06
Learning outcome 3 (multi-factor authentication): the ability to implement mitigation strategies including multi-factor authentication3, 21, 22, 3216, 23A: A07 · B: B07 · C: C07
Learning outcome 3 (email security): the ability to implement mitigation strategies including email security3, 21, 24, 28, 29, 3220A: A08 · B: B08 · C: C08
Learning outcome 3 (verification of payment details): the ability to implement mitigation strategies including verification of payment details3, 9, 25, 27, 28, 29, 3211, 19, 26, 30, 31A: A09, A10 · B: B09, B10 · C: C09, C10
Assessment: a written assessment of understanding and the ability to apply it to practical scenarios33-3 forms of 10 scenario questions
Assessment: a sufficiently high pass mark33-80% (8 of 10)
Assessment: participants who do not meet the standard complete the assessment again, with limited re-attempts33-2 re-attempts: forms B and C
Assessment: participants who complete the course successfully are given a certificate of completion33-certificate generator and checklist

One of the 30 assessment questions

An invoice from Brightwater Plumbing for $2,860 arrives from the usual contact. The quote number matches, but the bank details are new.

What is the correct step before paying?

  1. Phone the plumber on the number in your supplier file and confirm the new details
  2. Pay, because the quote number matches
  3. Reply to the email asking if the new details are right
  4. Phone the number in the email signature
Show the answer and the reason

A. Verify a change of bank details by phone using a number you already hold or found independently. A reply goes to whoever controls the mailbox, and the number in the email may be the scammer’s.

How the rules are checked.

86 statements about the rules and about scam guidance, each tied to one of 21 stored pages from the BLA, Consumer Affairs Victoria, Scamwatch, the Australian Cyber Security Centre, the OAIC and training.gov.au. Last read on 2026-11-02.

  • Property professionals must complete at least 5 CPD activities each CPD year, and a CPD year runs from 1 April to 31 March. [V3]
  • At least 2 of the 5 activities must be from the BLA’s list of mandatory activities, and the mandatory activities must include a written assessment. [V3]
  • The certificate must include the activity title, the participant’s name, the provider’s name, the date or dates completed, and the provider’s certification that it is genuine. [V4]
  • Only CPD activities on the BLA’s public register can be used to meet the CPD requirements. [V5]
  • When the register page was read (page dated 19 October 2026), the BLA was still reviewing provider notifications. [V5]

Written with AI from the official sources listed on this page, and checked word for word against them.

See every source

Questions.

Will the BLA accept this activity?

We cannot promise it. Only the BLA decides, and only activities on its public register count. You send the BLA the course outline and the assessment; the pack gives you both and a guide to the form.

Do we need our own cyber security expert?

Yes, for the Victorian activity. The BLA’s outline says delivery is by the provider by or in conjunction with an expert working in cyber security. We do not supply a presenter, and the BLA pages we stored do not define “expert”.

Can a recorded version count?

Not in Victoria. The BLA says pre-recorded webinars and self-study do not count as CPD activities under the new rules. The SCORM package is for the BSBXCS402 resources and for workplaces, not for the Victorian CPD activity.

Do you issue the unit BSBXCS402?

No. Your RTO assesses and issues. We supply learner resources mapped to the unit. Unit details come from training.gov.au, which shares its content under Creative Commons Attribution 4.0.

What if the rules change?

The yearly update covers that. Each licence year includes a new edition checked against the pages as they then stand. You must also tell the BLA about changes to your activity.

Do you see our participants’ details?

No. The files run on your own computers. We do not receive names, results or certificates.

Talk to us.

Leave your work email and we will write to you about the licence. We keep only your email and the one choice. No cookies, no tracking.

What happens to your email