:quality(82))
A Sydney couple unknowingly transferred $970,000 to scammers during what they believed was a routine property settlement.
A West Australian home buyer lost $732,000 after crooks intercepted emails and inserted false bank details.
These are just two examples of “payment redirection” scams that last year cost Australians at least $152 million. That was a 66 per cent increase on 2023, making payment redirection our third most common rip-off after investment ($945 million) and romance ($156 million) scams.
The businesses most commonly targeted are those that regularly deal with large transfers of money, such as the real estate and legal sectors. “Property transactions involve large sums, short timeframes and routine reliance on email – the exact scenario scammers like to exploit,” states this year’s PEXA White Paper on the subject. The victims are usually clients responding to fake invoices that sometimes arrive late in the day and demand urgent payment.
“This scam is hard to detect because the scammer will either hack into the email system of the business or impersonate the business’ email address by changing as little as one letter,” says ACCC Deputy Chair Catriona Lowe.
Often the victim won’t find out it has happened until they get a formal demand for payment of a bill they believe they’ve already paid.
“If you receive an invoice via email, take the time to call the business on a number you have found yourself to confirm that the payment details are correct,” Ms Lowe says. The advice is ‘stop, check, protect’. Did I expect this request for payment? Are the bank details correct?
Look up the business yourself and call them. Don’t rely on links or phone numbers in the invoice or email.
Be suspicious of last-minute changes to settlement instructions, particularly if they involve new bank account details.
If a client suspects they’ve been scammed, they should contact their bank immediately. Sometimes they can freeze or recover funds before they are moved beyond reach.
Clients should also pay attention to Confirmation of Payee (CoP) warnings.
Banks alert customers if the account name they enter doesn’t match the account number. Any client seeing such a warning this should stop and check.
Be aware that scammers are becoming smarter, often “grooming” clients involved in a transaction.
They might not ask for money in the first email, but wait to the fifth, when trust has been established.
“Criminals know they don’t need to compromise systems, they just need to compromise trust,” says PEXA.
Most conveyancers already warn clients in bold red type along these lines:
“CYBERSECURITY ALERT: Cyber fraudsters are currently targeting Australian legal practitioners, conveyancers and real estate agents. Always confirm bank account details with us by telephone before transferring any money.”
It’s a message that should be in every email and on every website.
§ A DUTY OF CARE
Conveyancers and lawyers need to do more than just warn clients. They should also ensure their own systems are secure, using strong passwords and the latest security updates.
“A compromised conveyancer’s email or practice management system can enable fraud, so their cyber hygiene is critical,” states PEXA’S White Paper.
Banks generally won’t reimburse lost funds. But they do help by flagging unusually large transfers, checking for mismatched accounts (CoP), and issuing warnings on high-risk transactions.
Most also remind customers of the potential scam risks when they elect to transfer funds to a new payee.