Settlement fraud
How to stop payment redirection fraud in property settlements
A property settlement moves a deposit or the balance of a purchase price, often a lifetime of savings, on instructions that usually arrive by email. That's why criminals target it. They get into an agent's, conveyancer's or client's mailbox, wait, then send convincing new bank details at the right moment. The fixes are mostly process, backed by a few system controls.
Rather just ask someone? Talk to usIn short
Payment redirection was Australia's second-costliest scam type in 2025, with $166.8 million lost. In property, criminals intercept email and send fake bank details for deposits or settlement funds. The defences: never accept bank details by email alone, confirm by phone on a number you already hold, use secure channels such as PEXA Key, and protect every mailbox with multi-factor login.
General information, current as at November 2026, not legal advice. If you think a payment has gone to the wrong account, call your bank immediately, then report it to ReportCyber at cyber.gov.au and to your professional indemnity insurer.
- What is payment redirection fraud?
- A scam where a criminal, usually after gaining access to an email account or imitating one, tells someone that bank details have changed so a payment goes to the criminal's account instead. In property it's often called settlement fraud or business email compromise. Once the money has moved it's very hard to recover.
What actually works
Assume email can be read and faked
Criminals get into mailboxes through phishing and reused passwords, then wait for a settlement. Others register look-alike domains. Treat any email that mentions bank details, especially a change, as unverified until confirmed another way.
Verify by phone, on a number you already hold
Call the agent, conveyancer or client on a number from your file or their official website, never the one in the email. Victoria's lawyers' insurer, LPLC, also recommends a file note of the call and a second person checking before funds move.
Move bank details off email entirely
PEXA Key lets parties exchange bank details through a secure app instead of email. A client portal can do the same for your own trust account details. The fewer places bank details appear in email, the less there is to tamper with.
Use Confirmation of Payee
Australian banks rolled out Confirmation of Payee from July 2025, so most payers now see whether the account name matches the account number before paying. Tell clients to stop and call if they see a mismatch warning, rather than paying anyway.
Warn clients early and often
Put your bank-details rule in the engagement letter, the email signature and the portal: 'We will never change our bank details by email.' PEXA's 2026 research found 38% of buyers would transfer funds after a scam email, so repetition matters.
Lock down your own mailboxes
Multi-factor login on every staff mailbox, alerts on new forwarding rules, and SPF, DKIM and DMARC on your domain make your practice much harder to impersonate or break into. These are usually quick for an IT provider to set up.
The settlement funds rule set
Adopt it as practice policy and tell every client.
- We never send or change bank details by email alone
- Bank details are confirmed by phone on a number already on file
- A second person checks before any trust or settlement payment
- Bank details are exchanged through PEXA Key or our secure portal
- Every staff mailbox uses multi-factor login
- Clients are warned in the engagement letter and before settlement
Where we'd tell you otherwise
Most of this is process and mailbox security, which your team and IT provider can put in place this week without us. Where we help is the software: a portal that collects and displays bank details safely, removing bank details from automated emails, and reviewing integrations that handle client data.
Tell us how your files move
Describe the software you run and where work gets typed twice, chased by phone or held up waiting on a client. We'll tell you what we'd do first, including when the answer is a setting in software you already pay for.
Common questions
Call the agent or conveyancer on a number from their official website or earlier paperwork, not from the email with the bank details, and confirm the account. Check the Confirmation of Payee result in your banking app. If anything looks different from earlier instructions, stop and ask.
Contact your bank immediately, since a fast recall request is the best chance of recovering funds, then report it at cyber.gov.au and tell the agent or conveyancer. Recovery is uncertain once money moves on, which is why prevention matters so much.
PEXA offers Key as a way for practitioners and their clients to exchange bank details securely, backed by its Secure Communication Guarantee. Check PEXA's current terms for costs and conditions, which can change.
Yes, if it's built carefully: details shown only after login, never sent in notification emails, changes requiring a second approver and logged, and a clear message that you will never change them by email. We review existing portals for exactly this.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Software and Client Portals for Conveyancers
- AML/CTF for Agents and Conveyancers: Systems
- Real Estate Agency Websites That Win Listings
- Holding client IDs and trust money? Security reviews for code, cloud and integrations
Last reviewed . General information, not legal advice. Prices are indicative Australian ranges, not quotes.