Money sent to the wrong account: the first hours and who to tell

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

The moment someone realises a payment has gone to the wrong place is usually quiet. The agent rings to ask where the deposit is. The solicitor says the trust account shows nothing. A second email arrives asking for a further amount. Whatever the trigger, the person is now working against a clock they cannot see, because the money is only recoverable while it is still sitting in the account it was sent to.

This guide sets out what the published guidance says to do, in what order, when a payment connected with a Queensland property has been sent to a false account. It covers the call to the bank, the reports, the people in the transaction who need to know, what happens to the sale or the tenancy in the meantime, and the routes for a complaint afterwards. It draws on Scamwatch, the Queensland Law Society, the Residential Tenancies Authority and the Australian Banking Association. It is general information, and anyone in this position should get advice on their own case.

Source: Scamwatch, "What to do if you've been scammed".

Why the first hours matter

A bank transfer cannot be cancelled by the sender once it has been processed. What can sometimes happen is that the receiving bank freezes the money in the destination account before it is moved on, and returns it. That depends on the money still being there.

Accounts used to receive stolen payments are emptied quickly. The funds are split, sent to other accounts, withdrawn or converted. Each step makes recovery less likely. The practical consequence is that an hour spent working out what happened, or waiting to see whether the payment "turns up", is an hour of the only period in which the banks can act.

That is why every official source puts the bank before everything else. Scamwatch's guidance is direct: call the bank or card provider immediately, report the scam and ask them to stop any transactions.

There is a human reason people lose time, and the guidance acknowledges it. Scamwatch's guidance says plainly that being scammed happens to hundreds of thousands of Australians a year and carries no shame, because embarrassment is one of the main reasons people delay. The banks' fraud teams deal with these calls every day. Nobody who rings one is the first.

The call to the bank

The first call is to the bank the money was sent from, on the number printed on the back of the card or shown in the bank's own app, not on any number in a message. Most banks have a dedicated fraud line and treat a report of a scam payment as urgent.

The bank will ask for the facts, and it helps to have them ready: the date, time and amount of the transfer, the BSB, account number and account name it was sent to, and the message that gave those details. The request to make is plain. The payment was made as a result of a scam, and the bank is asked to attempt to recall it and to notify the receiving bank.

Ask for a reference number for the report and write down the time of the call and the name of the person spoken to. If there is a later dispute about how the bank responded, that record is the starting point.

It is worth asking the bank one further question: whether the receiving bank has been told, and how. The Australian Banking Association says that all of its member banks, and those of the Customer Owned Banking Association, have joined the Australian Financial Crimes Exchange and its Fraud Reporting Exchange, a shared system for passing scam reports between banks so that funds can be frozen faster. The customer does not use that system. They can ask that it be used.

What a recall can and cannot do

A recall is a request, from one bank to another, to return funds. It does not reverse the payment automatically.

If the money is still in the receiving account, the receiving bank can freeze it and, after its own checks, send it back. If part has gone, part may be returned. If the account is empty, there is nothing for the recall to bring back, and the matter becomes one of tracing by police and of working out whether anyone is liable for the loss.

The process is not instant. A customer may hear within a day or two that funds have been frozen, and wait longer for their return. A bank will not usually tell the customer who holds the receiving account, for privacy reasons, though it will give that information to police.

There is a distinction worth knowing, because bank staff may raise it. Under the ePayments Code administered by ASIC, a "mistaken internet payment" is one where the customer typed the wrong account number or picked the wrong payee by accident. The Code sets out a recovery process for those. A payment sent deliberately to details supplied by a scammer is not a mistaken payment in that sense, and is handled as a scam. The customer should describe it as a scam from the first call, so it is sent to the right team.

Westpac described a case on 6 August 2026 in which the transfer never left. A first-home buyer in Western Australia came into a branch to send $1.2 million for a settlement on emailed instructions, and the banker noticed that the sender's address had one extra letter. The case is a reminder of the other half of the timeline: the best point of recovery is before the payment is made, and a bank that pauses to ask about a large transfer is doing what this guide hopes will not be needed.

Telling the people in the transaction

The second set of calls goes to the genuine parties, and the Queensland Law Society's guidance is specific about how. A client affected by a cyber incident involving a law firm should speak to the firm directly, by phone or in person, and not through an email account that may be compromised.

This matters for three reasons. The firm or agency needs to know that someone is sending false instructions in its name, because other clients may be receiving them. It needs to check whether its own systems were the source. And the transaction itself is now in question: a deposit that was due has not arrived, or settlement funds are short.

Until it is known whose email was read, both mailboxes should be treated as unsafe. That includes the payer's own. A common pattern is that the intruder set up a rule in the victim's personal email to hide or forward messages, and it stays active after the theft. Passwords should be changed from a different device, any forwarding rules or unknown logins removed, and two-step sign-in turned on. If the firm's systems are involved, the firm has its own obligations to its regulator and its insurer, and will usually bring in specialists.

For a tenant who has paid rent or a bond to a false account, the equivalent call is to the real agency or the real owner, on the number in the tenancy agreement.

The reports to make

Several bodies take reports, and each does something different.

The police report matters most after the bank. It is what allows police to obtain information about the receiving account, and banks and insurers will ask for the report number. Scamwatch does not investigate individual cases or recover money. Its reports feed the National Anti-Scam Centre's work on disrupting scams and its published statistics.

The Residential Tenancies Authority gives the same list for rental scams: ReportCyber, local police on 131 444, the bank, and the Office of Fair Trading if a real estate agent is involved.

What happens to the sale or the tenancy

The contract does not pause because a payment was stolen.

A buyer whose deposit went to a false account has, from the seller's point of view, not paid the deposit. Under the standard REIQ contract for houses and residential land, the deposit is dealt with in clause 2, and failing to pay it when due is a default that can give the seller the right to terminate. A buyer whose settlement funds were diverted may be unable to settle on the date, and time is of the essence under the same contract.

What happens next depends on the parties. In practice the buyer's solicitor explains the position to the seller's solicitor at once. Sellers often agree to a short extension while the buyer's bank attempts a recall or the buyer arranges replacement funds. They are not obliged to. A buyer in this position needs their solicitor's advice the same day, before the due time passes, on what to ask for and what the contract allows.

A tenant who paid a "bond" to a false landlord before any tenancy existed has no tenancy and no bond lodged. A tenant with a real tenancy who paid rent to a false account still owes that rent to the lessor. The practical course is to tell the agency or owner immediately, provide the letter or message and the payment record, and agree how the shortfall will be handled while the bank's recall is under way.

Who may be responsible for the loss

If the money does not come back, the question becomes who bears the loss. There is no single rule, and the answer depends on facts that take time to establish.

The first question is where the breach occurred: in the firm's or agency's systems, or in the client's own email. The second is what each party did. Did the firm warn its client, at the start, how account details would be given and never changed by email? Did the client receive that warning? Did anyone confirm the details by phone? The third is what each bank did, and whether the payment or the receiving account showed signs that should have prompted action.

The Queensland Law Society's guidance tells clients who cannot recover their funds to explore compensation options, without promising any particular outcome. Depending on the facts, that may involve a claim against a business whose systems were compromised, which its professional indemnity insurer would handle, a complaint about a bank, or both.

Complaining about a bank's response

A customer who believes their bank handled the matter poorly, whether by failing to warn, by delaying the recall or by refusing to help, has a defined path. The first step is a complaint to the bank's own internal dispute resolution team, in writing, stating what happened and what is sought. Banks are required to respond within set timeframes.

If the response is unsatisfactory, the complaint can go to the Australian Financial Complaints Authority, the external dispute body for banks, which Scamwatch names for disputes about how a financial institution responded to a scam. Its service is free to consumers. It considers what the bank knew, what its obligations were at the time and whether it met them.

The law in this area is changing. On 28 May 2026 the Assistant Treasurer designated banks, telecommunications companies and key digital platforms as the first sectors under the Scams Prevention Framework, with systems to be in place by 31 March 2027, according to the Treasury release. Until those duties begin, a bank's conduct is measured against its existing obligations. The one reimbursement measure proposed in the package, automatic repayment of verified losses, applies only below $3,000 and was still a proposal when the consultation closed on 25 June 2026.

Identity documents and follow-up scams

A payment scam is often an identity problem as well. If the false correspondence asked for a licence, passport, Medicare card or bank statement, or if the payer's email was read for weeks, the person on the other end has material that can be used again.

IDCARE, which Scamwatch describes as Australia and New Zealand's national identity and cyber support service, provides free help on 1800 595 160. Its case managers work through what was exposed and what to do about each item, from replacing a licence to placing a ban on a credit report.

Then there is the second approach. Scamwatch states that one in three people who have been scammed are scammed more than once. Soon after a loss, the person may hear from a "recovery agent", a "law firm" or an "investigator" who says the funds have been traced and can be released for a fee. Banks, police and the real authorities do not charge to recover stolen money. An unsolicited offer of that kind is a new scam aimed at someone known to be vulnerable.

Looking after the person

The official guidance gives as much space to the person as to the money, and with reason. Losing a deposit or the proceeds of a home is among the most distressing financial events a household can face, and it arrives with a sense of self-blame that the facts rarely justify. These messages are built to be indistinguishable from the real thing.

Scamwatch lists free support: Beyond Blue on 1300 22 4636 and Lifeline on 13 11 14, both around the clock, and financial counsellors, reachable through the Moneysmart website, for those facing debt as a result.

The call to the bank is the only step with a deadline nobody can see. Everything else can be done properly afterwards.

The checks that make this guide unnecessary

Every source that explains what to do after a loss says the same thing about prevention. The Queensland Law Society tells clients not to transfer large sums unless they have confirmed the account details with a person they know at the firm, by phone or in person, on the firm's real number. The National Anti-Scam Centre's version is three words: stop, check, protect.

For a property payment, that comes down to one habit. Account details received in writing are confirmed by voice, with a known person, on a number found independently, at the time of payment. A person who has done that has very little chance of needing the rest of this guide.

Kooky, from Shaka

Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →