Payment redirection scams in property sales: the checks that stop them

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

A property sale asks ordinary people to do something they almost never do: send a very large sum, by bank transfer, to an account they have not paid before, by a date fixed in a contract. Payment redirection scams are built around that moment. The buyer or seller is not tricked into a payment they did not owe. They make a payment they do owe, and it goes to the wrong place.

This guide explains, at the level of a consumer warning, how these scams deceive, where in a Queensland sale the risk sits, what the checks are and who is expected to make them. It draws on the public guidance of the Queensland Law Society, the Residential Tenancies Authority, Scamwatch and the National Anti-Scam Centre. It is general information about how the risk works, not advice on any one transaction.

Source: National Anti-Scam Centre, Targeting Scams report for calendar 2025. Australia, all sectors, reported losses only.

What a payment redirection scam is

Scamwatch uses "payment redirection" for any scam in which a person or business is persuaded to send a genuine payment to an account controlled by a criminal. Banks and police often call the same thing business email compromise, because the usual starting point is an email account that someone else has gained access to.

The category is broad. It covers a company paying a supplier's invoice, a family paying a builder and a tenant paying rent. In its report on calendar 2025, the National Anti-Scam Centre put reported losses across all of these at $166.8 million, second only to investment scams at $837.7 million, within total reported scam losses of $2.18 billion. Those are national figures for every sector. The Centre does not publish a separate count for property, or for Queensland.

Property matters inside the category for one reason: the size of a single payment. A diverted invoice might be a few thousand dollars. A diverted deposit is commonly tens of thousands, and the balance a buyer contributes at settlement can be several hundred thousand. One case can outweigh hundreds of ordinary reports.

How the deception works

The method can be described without any technical detail, and consumer warnings do so.

Someone obtains the ability to read the email passing between two parties to a sale. It may be the mailbox of a law firm, an agency or a mortgage broker. Just as often it is the client's own personal email, which is usually the least protected account in the chain. The intruder does nothing at first. They read, and learn who is buying what, for how much, through whom and when.

When a payment falls due, a message arrives that fits the conversation. It may come from the real mailbox, or from an address that differs from the real one by a single character. It carries the right names, the right property, the right amount and often the firm's usual signature and logo. One thing is different: the BSB and account number. Sometimes the message is framed as a correction ("please disregard our earlier details"), sometimes as the first and only instruction.

The Queensland Law Society's guidance to the public makes the point that explains why this works. It says email can often be intercepted, even where a firm has security measures in place. A message can look right, and be right in every detail the reader is able to check by eye, and still have been altered or invented.

A newer variation uses the phone. A caller claiming to be from the firm or the bank reads out details or asks the client to confirm a transfer. The principle is the same: the approach comes to the client, at a moment the client is expecting something, through a channel the client did not choose.

Why property sales are exposed

Four features of a sale line up in the scammer's favour.

The payee is unfamiliar. Few people have paid their conveyancer's trust account or an agency's trust account before, so there is no earlier payment to compare with and the bank sees a first transfer to a new recipient, which is exactly what a genuine payment looks like.

The date is fixed. Under the standard REIQ contract for houses and residential land, the deposit is payable at the times stated in the contract and the balance is due at settlement. A buyer who believes settlement is tomorrow does not want to be the cause of a delay.

Many parties are writing to each other. A single purchase can involve a selling agent, two legal practices, a lender, a broker and sometimes a buyer's agent. An instruction from any of them seems plausible.

And most of it happens by email. Contracts are signed electronically, documents are exchanged as attachments, and account details have traditionally travelled the same way.

None of this reflects carelessness by a profession or by clients. It is the ordinary shape of a modern sale, and it is why the published advice concentrates on one or two specific checks and not on general alertness.

The moments of risk in a Queensland sale

In a typical Queensland purchase, money moves by direct transfer at a small number of points. Each has its own version of the risk.

The deposit is the first exposure and the one buyers think about least. It is usually paid to the seller's agent, whose trust account details may be written into the contract or sent separately. The buyer has often never dealt with the agency before the week of the sale.

The balance is the largest. Most Queensland settlements are now completed electronically, with the practitioners for each side and the lenders lodging through a shared online workspace. Money already held in a firm's trust account or drawn from the buyer's loan moves inside that system. The buyer's own contribution still has to reach their solicitor's trust account first, and that transfer is made by the buyer from their own bank.

The sale proceeds are the reverse case. Here the criminal imitates the client. A firm receives an email, apparently from its seller, asking that the proceeds be paid to a different account. The check is the same, made by the firm.

The checks that stop a redirected payment

The published guidance is short, and consistent across sources.

The Queensland Law Society tells clients not to transfer large sums to a firm's trust account, or anywhere else, unless they have confirmed the bank account details with a person known to them at the firm, either by phone or in person. It tells them, when calling the firm, to use its real number and not to be misled by false details in an email. And it suggests involving the bank in the transaction so that the deposit account details are confirmed independently before funds are sent.

Those three sentences contain the whole method. Set out as a routine, they look like this.

Two points deserve emphasis. The first is that the phone number must come from somewhere other than the message being checked. A false email will carry a false number, and the person who answers it will confirm whatever the email said. A number from the firm's own printed letterhead, from an earlier genuine call, or from the professional register is independent. The Queensland Law Society maintains a public register of solicitors, and the Office of Fair Trading maintains a licence register for real estate agencies.

The second is that the check is made at the time of payment, not weeks earlier. Details confirmed at the first meeting are a useful reference. They do not confirm a message that arrives later.

In person is as good as by phone, and for many people simpler. A buyer who collects trust account details on paper across the desk at the first appointment, and later pays to exactly those details, has an independent reference for every later message.

What firms and agencies do on their side

The check does not rest on clients alone. Practices that handle trust money have their own routines, and a client will see signs of them.

Many Queensland firms state in their first letter how they will provide trust account details, and that they will not change them by email. Many print a warning to the same effect at the foot of every message. When a client asks to change the account into which sale proceeds are to be paid, a firm will normally ring the client on a number already on file before acting. A seller who receives such a call is seeing the profession's side of the same check.

Agencies holding deposits work under the Agents Financial Administration Act 2014, which requires trust money to be kept in a dedicated trust account and subjects that account to independent audit. The Act deals with how money is handled once received. It cannot protect a payment that never reaches the account because it was sent elsewhere.

Banks are a further layer, with limits. A bank may question an unusual transfer or hold it briefly under its own policies. The Australian Banking Association says its member banks have added warnings, questions and delays for some payments to new recipients. From the customer's side these can feel like friction on an urgent day. They are aimed at this scam among others.

What the rules do not yet cover

On 28 May 2026 the Assistant Treasurer designated banks, telecommunications companies and key digital platforms as the first sectors under the Scams Prevention Framework, and released draft codes for consultation until 25 June 2026. According to the Treasury release, those sectors must have systems to prevent, detect and disrupt scams by 31 March 2027.

Two things follow for property. The duties are not yet in force, so a bank's handling of a diverted payment today is judged by its existing obligations and its own policies. And the one concrete reimbursement proposal in the package, automatic repayment of verified losses, applies only below $3,000. A settlement payment is far above that line. For large losses the framework will ask whether each business met its obligations, which is a different question from whether the customer gets the money back.

Real estate agencies and law firms are not designated under the framework. They are regulated on these questions by their own bodies: the Queensland Law Society and the Legal Services Commission for solicitors, and the Office of Fair Trading for agents.

Every published warning arrives at the same instruction. The account number is confirmed by voice, with a known person, on a number the payer found for themselves.

If the details change close to settlement

The hardest case is a message that arrives late, with settlement a day or two away, saying the trust account has changed.

The general position under the standard Queensland contract is that time is of the essence: a party who is not ready on the settlement date is in default. That is the pressure the scam relies on. It is also why the answer is a phone call and not a postponement. Confirming account details by voice takes minutes. A solicitor asked to read back a BSB and account number will do so at once, and a genuine firm will not object to being asked twice.

If the firm cannot be reached and the deadline is close, the question of what to do about settlement is one for the buyer's own solicitor, who can speak to the other side. A request to move settlement by a day is an ordinary event in conveyancing. A payment to a false account is very difficult to reverse.

If a payment has already gone

Speed decides how much, if anything, can be recovered. Scamwatch's guidance puts the bank first: call it immediately, report the scam and ask it to stop the transaction. A payment that has not yet left, or has not yet been withdrawn at the other end, has the best chance of being held.

The Queensland Law Society's guidance for clients of a firm lists the next steps: speak to the firm directly, by phone or in person and not through an email account that may be compromised, notify Queensland Police, alert the bank, and then explore compensation if the funds cannot be recovered. Scamwatch adds a report through ReportCyber, which creates a police record, a report to Scamwatch itself, and a call to IDCARE, the national identity and cyber support service, on 1800 595 160.

Who bears a loss that is not recovered depends on the facts: whose email was compromised, what each party was told, what checks were made and what each bank did. Those questions are decided case by case, sometimes by a court, and no general rule gives the answer in advance.

Scamwatch also warns that one in three people who have been scammed are scammed again. After a loss, offers to trace or recover the money for a fee are a known second scam.

A short list to keep

For a buyer or seller about to start a transaction, the published guidance reduces to a few habits.

• Collect the firm's and the agency's phone numbers and trust account details at the start, in person or from a source chosen independently.
• Treat any account details received by email as unconfirmed until read back by voice.
• Regard a change of details as a warning sign in itself.
• Allow a day's margin before settlement for the transfer and the confirming call.
• If something seems wrong, ring the bank first.

None of these depends on technology, on either side being free of intruders, or on the client being able to tell a false email from a real one. That is their strength. The scam succeeds by being indistinguishable on the screen. The check works because it does not use the screen.

Kooky, from Shaka

Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →