In this article
Kooky
Builder of Shaka, the payment router that pays every agent their commission on closing date.
About Kooky and Shaka →Only 41 per cent of Australians who have just bought a property, or are about to, feel confident they could recognise a scam aimed at their settlement money. A year ago the figure was 51 per cent. The finding comes from the second annual Settlement Scams Index published by PEXA, the company that operates the electronic network through which most Australian property settlements are lodged, and reported by the trade publications Real Estate Business on 25 August and MPA on 26 August 2026.
The survey is national and its published results are not broken down by state. It lands in the same week as official half-year scam figures, and three weeks after Westpac described how one of its branch staff stopped a first-home buyer from sending $1.2 million to a criminal's account. Together they describe a risk that every Queensland buyer meets at least twice in a purchase, when the deposit is paid and when the balance is sent.
Source: PEXA Settlement Scams Index 2026, as reported by MPA and Real Estate Business. More than 1,000 respondents, Australia.
What the survey measured
According to MPA, the index is built from the answers of more than 1,000 Australians who bought a property in the past year or plan to buy in the next. It asks what they know about scams aimed at property payments and then tests them with a simulated email of the kind a buyer might receive before settlement.
Awareness is close to universal. MPA reports that 92 per cent of respondents recognised at least one type of property scam. Recognition in practice was much weaker. Shown the simulated email, 42 per cent did not identify any of the signs that it was false, and 99 per cent missed the altered email address even though they had been warned that the message might not be genuine.
Related readProperty spruikers in Queensland: seminars, commissions and the rulesReal Estate Business adds detail on what people did notice. A request to transfer funds made by email was treated as a red flag by 32 per cent of respondents. An unprofessional look or tone was flagged by 19 per cent. And 62 per cent said they were concerned about voice cloning, the use of software to imitate a known person's voice on a call.
"As scammers get more sophisticated, they are becoming harder to detect," PEXA's group chief information security officer, Graham Fairley, told Real Estate Business.
Awareness is high, recognition is not
The distance between knowing that a scam exists and recognising one on the screen is the survey's main result.
Source: PEXA Settlement Scams Index 2026, via MPA and Real Estate Business. The last bar is the remainder of the 99% who missed the address.
The fall in confidence, from 51 to 41 per cent, can be read as bad news or as realism. A person who doubts their own ability to tell a false email from a real one is more likely to check by another route, and the survey suggests many now do: 84 per cent told the researchers they confirm payment instructions by phone or in person before sending money.
That answer is self-reported, and it sits awkwardly beside the email test, in which nearly everyone missed the detail a phone call would have exposed. The two are not contradictory. A buyer can intend to confirm by voice and still be caught, if the number they ring is the one printed in the false message.
The transfer a banker stopped
Westpac published an account on 6 August 2026 of a case at its Riverton branch in Western Australia. A first-home buyer came in to send $1.2 million for a property settlement, following payment instructions received by email. The personal banker handling the transfer noticed that the sender's address contained one extra letter, and that the message did not read like the earlier emails in the same chain.
Related readRental scams in Queensland: the warning signs before you pay a bondAccording to the bank, the settlement agent's email account had been compromised, and the instructions had been sent by someone impersonating the firm. The security publication Cyber Daily, reporting the same case, adds that the staff member whose name appeared on the false email was on leave at the time. The payment was not made.
The case is from another state, and the pattern is the one Queensland's legal profession has warned about for years. In Western Australia a settlement agent does the work that a solicitor or conveyancer does in Queensland. In both places the buyer is told, close to settlement, where to send a large sum, and in both places that instruction usually arrives by email.
"A quick phone call can make all the difference," Westpac's head of fraud prevention, Ben Young, said in the bank's account.
How a false request is made to look real
At the level of a consumer warning, the method is simple to describe. Someone gains the ability to read the emails passing between a firm and its client, or between an agent and a buyer. They wait until a payment is due. Then they send a message that fits the conversation exactly, with one change: the account number.
Everything else in the message tends to be correct, because it has been copied from the real correspondence. The property, the amount, the settlement date, the names and the signature block are right. That is why the survey's respondents did so poorly on the email test, and why the published warnings focus on the route used to confirm the details and not on the appearance of the message.
Related readTitle fraud: how Queensland's register protects an owner's homeThe National Anti-Scam Centre's Targeting Scams report for 2025 put reported losses to payment redirection scams of all kinds at $166.8 million, the second most costly category after investment scams. That figure covers businesses paying invoices as well as households paying deposits, and it is the figure Westpac quoted when it published the Riverton case.
What the Queensland profession tells clients
The Queensland Law Society's public guidance on cyber fraud sets out the check in plain terms. A client should not transfer a large sum to a firm's trust account, or anywhere else, unless they have confirmed the account details with a person known to them at the firm, by phone or in person. They should ring the firm on its real number, and not be drawn into using details that appear in an email. The Society also suggests involving the bank, so that the destination account is confirmed independently before funds are sent.
The same guidance is frank about the limits of technology on the firm's side. It says email can often be intercepted even where security measures are in place. The check it describes does not depend on either party's systems being secure, only on the client hearing the account number from a voice they know, on a line they chose.
A change of account details by email is the warning sign
Law firms and agencies do not, as a rule, change their trust account in the middle of a sale. An email announcing new details, or correcting earlier ones, is the moment to stop and ring the firm on a number found independently, however genuine the message looks.
In a Queensland purchase the check is needed at two points. The deposit is paid first, usually to the trust account of the seller's agent, an office the buyer may have dealt with for only a few days. The buyer's contribution to the balance follows weeks later and goes to the trust account of their own solicitor or conveyancer. The second payment is larger, and the first is the one made with the least familiarity, since the buyer has no earlier correspondence from the agency to compare a message with. The Office of Fair Trading's public licence register gives an independent route to an agency's details, as the Law Society's register does for a law firm, and a number taken from either is one the sender of a false email does not control.
For sellers the risk runs the other way. A firm asked by email to pay sale proceeds to a new account is expected to confirm that instruction with its client directly. A seller who receives a call from their solicitor reading back an account number is seeing the same check from the other side.
What comes next
Scams Awareness Week ends on Friday 28 August. The official half-year figures released for it on 24 August put reported scam losses across Scamwatch and ReportCyber at $554.1 million for January to June 2026, with reports down 11 per cent and losses up 1 per cent on a year earlier.
Further out, banks have until 31 March 2027 to put in place the systems required by the Scams Prevention Framework, under which the banking sector was designated on 28 May 2026. What the Riverton banker did by instinct, noticing a payment that did not fit, is close to what the framework will ask banks to do by design. The framework's codes were still in draft when the survey was published.
Nearly every buyer knows these scams exist. The survey's test email shows that knowing is not what stops one.
Kooky, from Shaka
Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.
