Payment redirection and settlement fraud: how buyers and sellers lose their money

How the fraud works

The criminal does not hack a bank. They compromise an email account — often the client's own personal email, sometimes an agent's — and then simply watch. They read the thread, learn the file reference, the names, the settlement date and the amounts, and wait.

At the right moment they send an email that appears to come from the solicitor or the agent, attaching an updated trust account authority or a revised settlement statement with different bank details. Sometimes they register a domain one character different from the firm's and send from that. Sometimes they set a mail rule so the real firm's replies are hidden from the client while the fraud runs.

The three points of maximum exposure are the initial deposit, the seller's net proceeds after settlement, and any pre-settlement payment such as a payout figure. Once the funds land, they are moved through mule accounts within minutes.

Why it is so hard to recover

Australian domestic transfers settle in near real time and there is no general right to reverse a payment the customer authorised. The bank did what it was told. Recovery depends entirely on speed — if the receiving bank can freeze the account before the funds are moved on, some or all may be recovered, and that window is typically hours.

If you suspect a redirected payment, call your bank immediately, ask for the funds to be recalled and the receiving account frozen, then report to ReportCyber and to Scamwatch. Then call us. Do not spend the first hour trying to work out how it happened.

Who bears the loss

This is the part clients find hardest. If a buyer sends the deposit to a fraudster's account, the deposit has not been paid. The buyer still owes it, and can be in default of the contract on top of losing the money. If a seller's proceeds are redirected after settlement, the buyer has still paid, the transfer still registers, and the loss sits with the seller.

Liability can shift where a professional's conduct caused the loss — a firm with poor email security, or an agent who forwarded unverified bank details, may face a claim. But litigating that is slow and uncertain, and the money is usually not coming back from the criminal. Prevention is the only reliable strategy.

The rules we work by, and the rules we ask you to work by

Payment redirection fraud is defeated by process, not by vigilance. The process is simple and it is not negotiable on our files.

• Our trust account details are given to you verbally or in person at the start of the matter, and they never change during a file. If you receive an email saying our bank details have changed, it is fraud. Not a possibility — fraud.
• Before you transfer any money to us, call our office on the number you already have and confirm the account details with a person. Do not use a phone number contained in the email you are checking.
• Send a small test transfer first, confirm receipt by phone, then send the balance. It costs nothing and it has saved clients hundreds of thousands of dollars.
• We confirm your account for the net proceeds with you by phone before settlement, and we will not change it on an emailed instruction alone.
• We do not accept changed banking instructions by email from any party — buyer, seller, agent or incoming mortgagee — without independent verbal verification on a number we hold on file.

What clients should do to protect their own email

In most of the matters we see, the compromised account was the client's, not the firm's. A conveyancing file is a criminal's ideal target precisely because it is a short window with a very large number attached to it.

• Turn on multi-factor authentication for the email address used for the transaction. This single step defeats the great majority of these attacks.
• Never send bank details, identity documents or contracts over public wi-fi.
• Check your mailbox rules during the transaction — a hidden auto-forward or auto-delete rule is the classic sign of a compromise in progress.
• Be suspicious of urgency. Real settlements do not require you to send funds within the hour to a new account.
• Treat any change to payment arrangements, from anyone, as fraud until you have confirmed it by voice.

For real estate agents

Agents are increasingly in the chain, both as a target and as a conduit. A deposit paid to the agency trust account, and a solicitor's details forwarded by the agent to the buyer, are both points criminals attack.

The safe practice is to never forward banking details in a document you did not create, to give trust account details verbally, and to tell buyers at the point of contract that details will never change by email. Agencies now carrying AML obligations should treat payment verification as part of the same control environment, not a separate issue.

Settlement fraud and payment redirection — common questions