Conveyancing Scams and Fraud: How to Avoid Them

Picture the last hour before a property settlement. The buyer is refreshing their inbox, nerves jangling, waiting for one final email from the solicitor: the trust-account details to transfer the balance of a life's savings. The email arrives. The letterhead is right, the matter reference is right, the solicitor's name is right. There's a short, friendly note — "please note our updated account details below" — and a BSB and account number. The buyer transfers the money. And it's gone, to an account that was never the firm's, emptied and closed within the hour.

Nobody was careless, exactly. The email really did come from a compromised mailbox in the conveyancing chain. This is a conveyancing scam — officially a payment redirection scam, or business email compromise pointed at a property deal — and in Australia it is not rare or exotic. Payment redirection was the country's second-largest category of scam losses in 2025 at $166.8 million, and Scamwatch has reported averaging around two reports a week tied specifically to real-estate transactions. Buyers lose their deposits. Law firms and conveyancers sit right in the blast radius.

The attacker doesn't break the settlement. They wait for it, and redirect it.

Why property settlements are the perfect target

Start with the economics, because they explain everything else. Most fraud is a numbers game of tiny thefts — a stolen card here, a $200 gift-card scam there. Conveyancing fraud is the opposite: a single successful strike moves a deposit or settlement balance, which in this market means anywhere from tens of thousands to well over a million dollars, in one irreversible transfer. The attacker needs to win once, occasionally, to run a very profitable operation.

Now layer on what a property matter looks like from the outside. It's conducted almost entirely over email. It involves a large payment on a date everyone knows in advance. The parties — buyer, solicitor or conveyancer, agent, broker — often haven't met in person and don't recognise each other's voices. And there's a powerful script running: everyone expects account details to arrive by email near settlement, so an email with account details near settlement doesn't trip a single alarm. The scam isn't beating your defences. It's wearing the costume of a completely normal Tuesday.

How the attacker actually gets inside

The redirection is the last act. The quiet part comes first, and it usually starts with one phished password. Someone in the conveyancing chain — the solicitor, a paralegal, the agent, even the buyer — clicks a convincing login page and hands over their email credentials. No malware, no alarms; just a working username and password sold or used directly.

Here's the clever, patient bit. The attacker rarely strikes straight away. They log into the mailbox and read — sometimes for weeks — learning the firm's tone, the matters in flight, the settlement dates. Very often they quietly set up a mailbox rule: auto-file or delete replies containing words like "invoice", "trust", "account" or "settlement", so the real owner never sees the conversation the attacker is about to hijack. From the inside, they're not impersonating the firm. For the purposes of that email thread, they are the firm.

The fake settlement email, timed to the minute

When a settlement approaches, the attacker steps into the existing email thread — the genuine one, with its real history and signatures — and sends the buyer "updated" trust-account details, often with a plausible reason ("our usual account is undergoing an audit"). Because it's the same thread from the same address, it clears every instinctive check. The buyer pays. The money hits a mule account and is gone before anyone reconciles.

The timing is deliberate and cruel: right on settlement day, when everyone is stressed, moving fast, and desperate not to be the one who holds up the deal. Urgency isn't a side effect of the scam — it's the main ingredient, and property settlement supplies it for free.

The twist: it might not be your mailbox at all

So you lock down the firm's email perfectly — and you should. But here's the wrinkle that makes this genuinely hard: the compromised mailbox might belong to the other side. The buyer's personal Gmail. The real-estate agency. A mortgage broker. Any weak link in the chain lets the attacker forge the same email, and the loss still lands on your client and, by reputation and often by professional-indemnity claim, on your firm.

That's why the defence can't be purely technical and purely yours. It has to include the humans on the other end of the transaction — which starts with knowing what a fake looks like.

Warning signs of a conveyancing scam

None of these is proof on its own. Any one of them is reason enough to stop and pick up the phone before money moves.

• Bank details that "change" by email — especially in the last few days before settlement. A genuine firm almost never changes its trust account mid-matter.
• A reason that sounds like admin — "audit", "our bank is changing", "the usual account is frozen". It's there to pre-empt your question.
• Pressure to pay now — "settlement will fail unless funds arrive today" is the oldest lever in the book.
• A request not to call — "I'm in court all day, just reply by email" quietly closes the one channel that would expose the fraud.
• An account name that doesn't match the firm, or an account at a different bank from earlier correspondence.
• A slightly different sender address — one swapped letter, an extra hyphen, or a different domain ending. (If the real mailbox is compromised, there won't even be this — which is why the phone call matters more than the squint.)
• Replies that go missing. For firms: a client says they emailed you and you never saw it. That's the hidden mailbox rule at work, and it's a five-alarm fire.

"Just look for the dodgy grammar" is dead advice

For years the standard warning was to spot the clumsy English — the typos and odd phrasing gave scammers away. That advice is now worse than useless, and it's worth being clear about why. We built AI tools that produce flawless, perfectly formatted, on-brand English for free, and some of the keenest early adopters turned out to be the people writing the scams. The fake settlement email now reads exactly like your best paralegal wrote it — because, functionally, an AI trained on a million of them did. The tell is gone. The defence has to move from "does this look right?" to "have I verified this through a second channel?"

It's worth a pause on how we got here. We took the most significant financial moment in most people's lives — buying a home — and moved it entirely onto email, a system with no built-in way to prove who actually sent a message. Then we handed everyone a tool that writes a perfect impersonation on request. We can run a nation's property settlements this way. Whether we should have, without building the verification step in first, is a question the industry is, uh... answering the expensive way.

How to avoid conveyancing fraud: layers, not a single wall

No one control stops this, because it attacks people, process and technology at once. You defend it the same way — in layers, so that any single failure is caught by the next.

• Verify every account detail by phone — this is the one that actually works. Any bank details, and any change to them, get confirmed by calling the firm on a number you already have (never the number in the email). Tell clients in writing at the start of the matter: "our trust-account details will never change by email; if you receive such an email, phone us before paying a cent." That one sentence, sent early, defeats the entire scam.
• Turn on multi-factor authentication everywhere — every mailbox in the firm, no exceptions. A phished password on its own then buys the attacker nothing, which cuts off the whole attack at its root. Microsoft's research puts MFA's effectiveness against account compromise above 99%.
• Authenticate your outbound email with SPF, DKIM and DMARC configured properly, so attackers can't spoof your domain to your clients — and so your legitimate mail isn't the thing that trains people to trust look-alikes.
• Watch the mailboxes. Managed detection and response flags the tell-tale signs of compromise — a new mailbox rule that hides "invoice" and "settlement" emails, a login from an unusual country — often before a cent moves.
• Train the whole firm, then test it. The person who processes a trust payment matters more than any firewall. Structured security awareness training turns staff from the soft target into the alarm that catches what the filters miss.

None of this is exotic or expensive. It's MFA, a correctly configured Microsoft 365 tenant, monitoring, and one firm-wide habit about verifying payments. The firms that get hit are almost never the ones that couldn't afford the defence — they're the ones who hadn't turned it on yet.

Already paid a scammer? Do this in the first hour

Speed is the whole game here. Mule accounts are emptied fast, and banks can only freeze money that's still sitting there.

1. Call your bank immediately — the fraud line, not a branch email. Ask for an urgent recall and trace on the transfer and give them the receiving BSB and account number.
2. Call your solicitor or conveyancer on a number you already had, not one from the suspicious email, so they can alert the other parties and the receiving bank.
3. Report it to ReportCyber, which routes cybercrime to police, and to Scamwatch.
4. Get free support from IDCARE on 1800 595 160 to plan your next steps and lock down your accounts.
5. Change your email password and turn on MFA — your own inbox may be how the attacker found the deal.

For the firm, the checklist is different: notify your professional-indemnity insurer, preserve the evidence (don't delete the attacker's mailbox rules or sign-in logs — they're the forensic trail), reset credentials and revoke sessions on the affected accounts, and work out which other matters that mailbox could see. This is where having an incident-response partner on call pays for itself.

What this means for a NSW law firm or conveyancer

For an Australian practice this isn't only a financial risk — it's a professional one. The Law Society of NSW and your professional-indemnity insurer both expect you to be protecting client funds and communications, and trust-account rules leave little room for "we got tricked". A redirection incident can mean notifying clients, notifying your insurer, a hit to the firm's reputation in a referral-driven business, and hard questions at your next PI renewal. This is exactly the scenario our IT support for law firms and conveyancers is built around — the email hardening, monitoring and staff training that keep a settlement from becoming a claim. It's the text-based cousin of the voice-cloning fraud we cover in the deepfake CEO scam, and it shares its DNA with the tax-time ATO email scams that spike every July: same playbook, different costume.

Frequently asked questions

Are there any scams I should watch out for during conveyancing?

Yes — the big one is payment redirection. A criminal who has broken into an email account in the transaction sends you "updated" bank details just before settlement, so your deposit or balance goes to them instead of your solicitor's trust account. Watch for bank details that change by email, urgent pressure to pay, and requests not to call. Always confirm account details by phoning your conveyancer on a number you already have.

What is conveyancing fraud?

Conveyancing fraud is any scheme that steals money or property during a property transaction. In Australia it's overwhelmingly payment redirection — a form of business email compromise — and it was the country's second-costliest scam category in 2025, at $166.8 million in reported losses.

What should I do if I've sent settlement money to a scammer?

Call your bank's fraud line straight away and ask for an urgent recall of the payment, then call your conveyancer on a known number. Report it to ReportCyber and Scamwatch, and contact IDCARE on 1800 595 160 for free support. The faster the bank hears about it, the better the chance some funds can be frozen.

Who is liable if a client's settlement money is stolen this way?

It depends on where the compromise occurred and the facts of the matter, but even when the breached mailbox wasn't the firm's, a law practice can face reputational damage, a professional-indemnity claim and awkward questions from the Law Society. Prevention is dramatically cheaper than arguing liability after the money's gone.

How can a law firm or conveyancer prevent it?

Layered defence: MFA on every mailbox, properly configured email authentication (SPF, DKIM, DMARC), mailbox monitoring via managed detection and response, staff training, and one non-negotiable habit — verify every bank detail by phone on a known number, and warn clients in writing up front that your trust details never change by email. A cyber security assessment will show where your gaps are.

The scam email had no spelling mistakes — how would we spot it?

You increasingly can't, by eye — AI writes flawless fakes now. That's exactly why the defence has shifted from "does it look right?" to verifying payment details through a separate channel every single time, regardless of how legitimate the message appears.

Local IT and cyber security support across NSW

Chewing IT provides IT support, email hardening and cyber security for law firms and conveyancers across the Central Coast, Newcastle, Lake Macquarie, Hornsby and the wider Sydney North Shore. Most work is delivered remotely with same-day turnaround, and on-site support is dispatched from our Wyong office on the Central Coast and our Hornsby office in Sydney.

Not sure whether a spoofed settlement email would get past your firm? Get in touch for a straight conversation about protecting your trust account — before a criminal tests it for you.