A buyer is expecting an urgent email. The agency is expecting money. A criminal inside the conversation needs to change only one thing: the destination account.
The buyer has inspected the property, signed documents and spoken with real people. When an email arrives naming the address, amount and deadline, it lands inside an established relationship. That context is what makes property-related business email compromise so effective.
The Australian Cyber Security Centre warns that criminals target property transactions by compromising email accounts and sending altered payment instructions. Smart Property Investment has also reported criminals mimicking agency emails, while REIQ guidance treats cybercrime as a practical agency risk. These sources establish the pattern without suggesting every delayed or changed instruction is fraudulent.
The dangerous test is therefore not “does this email look professional?” A patient intruder can inherit the real signature, thread and language. The safer question is “have we confirmed this instruction outside the channel that delivered it?”
The fraudulent message is stage three, not the beginning. Seeing the whole chain shows where a simple independent check can still stop the loss.
A criminal gains access to an agency, conveyancer or buyer mailbox through stolen credentials, phishing or another account takeover. They do not need to alter the whole transaction; they need a trusted view of it.
The intruder quietly reads the thread. Names, property address, deposit amount, expected date and the writing style of the real agent turn a generic scam into a message that belongs in the conversation.
Near the deadline, the criminal replies from the compromised account or a convincing lookalike. A matching call may add urgency. The bank details are new, but almost everything around them is true.
Interrupt here: pause before accepting the identity claim or account details. Move to a contact record the message did not supply.
The buyer pays the substituted account. The agency sees no problem until the expected funds fail to arrive, by which time the criminal may have moved the money through other accounts.
Buyers face a deadline, a large unfamiliar payment and instructions from professionals whose processes they may not know. They can be hurried into treating a reply in the existing thread as confirmation.
They need a clear rule before deposit day: never rely on an email alone for account details, and independently contact the agency before transferring. A warning buried in a footer is weaker than a spoken, repeated procedure.
An agency can lose control of a mailbox or have its name copied without knowing it. Even when the buyer’s inbox was compromised, the false instruction trades on the agency’s authority and can damage the relationship.
Agencies should protect mailboxes, minimise exposed transaction detail, define who may issue payment instructions and make verification easy to recognise. The control must work when the email looks completely normal.
Verification is strongest when it uses a trusted record established before the suspicious instruction. Replying to the email, calling its signature number or asking the sender “is this correct?” stays inside the potentially compromised channel.
Tell buyers at engagement how genuine payment instructions will be delivered and that any new or changed account must be checked through a known channel.
Treat bank details as an instruction to verify, even when the thread, sender and timing look right. Do not use the phone number contained in the message under review.
Contact the agency through the number already held or independently published. Read the BSB and account number out and back in full; record who checked, when and the outcome.
Stop the payment, preserve the email and escalate. A failed verification is not a cue to try a new number supplied by the correspondent.
Tell every buyer, in person or through a separately established channel, that the agency will never rely on an emailed account change. Give them the agency’s independently published number and name the team or role authorised to confirm details.
Before payment, the buyer should call that trusted number and read the full BSB and account number aloud. The agency representative reads it back and records the check. If the supposed agent discourages a call, changes the callback number or invokes urgency, the buyer stops.
Vericode can add a separate agency-side caller check alongside this buyer procedure. Staff highlight a phone number already visible in a browser-based CRM, portal or email client, right-click and send a one-time SMS code through MobileMessage using the ACMA-registered sender ID VERICODE. The caller reads it back. Each check is logged with who requested it, the masked target number, its time, method and outcome. Authorised-contact register events also form a per-contact hash chain.
That check does not validate bank ownership or recover money, and it does not replace dual approval, mailbox security or a trusted callback. Its narrow job is to test possession of a known contact point before the agency accepts an instruction or discloses information.
ACSC
Smart Property Investment
REIQ
These public sources are cited as industry evidence only. No endorsement of Vericode by the ACSC, Smart Property Investment or REIQ is implied.
Define how your agency issues payment details, how buyers confirm them and what staff record when identity or instructions do not check out.