Westpac published a case this month that everyone buying a house this spring should read.
A young mum walked into the bank's Riverton branch, in Perth's southern suburbs, to move the money for her first home.
Settlement was that afternoon. She had the email from her settlement agent with the account details on it. She had $1.2 million to send — the whole purchase, the deposit, the loan, the lot.
The email was fake.
According to Westpac's account, scammers had got into the settlement agent's email account and sent her their own payment instructions. Not a rough imitation from a stranger - a message inside the real conversation she'd been having for weeks, from the agency she'd actually engaged, about the settlement that was actually happening that day.
The address it came from was off by one letter.
The reason she still owns her house is that Neet Kukreja, the personal banker who took the transfer, stopped. In Westpac's account of it, the thing that made her pause wasn't the address = it was the writing. "The tone was slightly different," she said. "It didn't read like the previous emails, and that made me pause."
So she checked. The staff member the email claimed to be from was on leave. The payment method didn't match how these normally run. She spoke to her branch manager, rang the settlement agent directly, and got the answer: nobody there had sent it.
The transfer didn't go.
That's the good version of this story. We are writing about it because most of them don't end there, and because the spring selling season starts this week.
Why this is the worst one
There is a whole category of scam that works by getting you to send money to the wrong bank account. The National Anti-Scam Centre calls it payment redirection. Australians lost $166.8 million to it in 2025 - the second-largest loss category in the country after investment scams, ahead of romance scams and more than every phishing scam in Australia put together.
Property settlement is the version that can take everything.
Think about what's different about this transfer compared to every other payment you make:
It's the biggest amount you'll ever move. Not $400 to a tradie. Not a $2,000 deposit. The entire purchase price, in one go.
It's a one-way door. There is no chargeback on a bank transfer and no automatic refund. The money lands in a mule account and it is moved out - often offshore, often into crypto — within minutes. Recovery depends almost entirely on how fast somebody makes a phone call, and the window is measured in minutes and hours, not days.
It's uninsured in the way that matters. Your home insurance doesn't cover it. Your conveyancer's professional indemnity might, eventually, after a fight. And in the meantime the settlement doesn't happen, you are likely in default under the contract, and most contracts of sale entitle the vendor to default interest.
Everyone is expecting it. That's the part that makes it work. On settlement day, an email arriving with bank details on it isn't suspicious. It's the thing you have been waiting for.
You are not the one who gets hacked
Here's the bit almost everyone gets wrong, and it matters for how you defend yourself.
In a settlement scam, the criminal usually doesn't break into your email. They break into your conveyancer's. Or your settlement agent's, or the real estate agency's, or the mortgage broker's - one of the three or four small businesses handling dozens of these transactions at once.
Then they sit there and read. For days or weeks. They learn the file names, the language, the signature block, the person who signs off, the rhythm of the conversation. They watch a settlement date get set.
And on the day, they send you an email that is correct in every respect except one - where the money goes.
Sometimes it comes from a lookalike domain, one letter out, as it did in Riverton. Sometimes it comes from the real account, with a mailbox rule quietly deleting the replies so nobody at the agency ever sees your response. Sometimes there's a follow-up phone call to smooth it over.
Which means all the advice about protecting your accounts - a strong password, two-factor authentication, a password manager - is good advice that will not save you here. You did nothing wrong and there was nothing to do differently. The compromise happened in an office you have never visited.
You cannot secure your way out of this one. You can only verify your way out of it.
What the new research says about your odds
The property exchange PEXA published the second edition of its Settlement Scams Index last week - a national survey of 1,028 Australians, run by research firm Nature, split between people who bought property in the past year and people planning to buy in the next twelve months. So this is not the general public being tested. These are people in the middle of the transaction.
The findings are worth sitting with.
92% know property scams exist. Awareness is not the problem. It hasn't been for a while.
41% felt confident they could spot one - down from 51% a year ago. People are getting less sure, not more. Given what's happened to the quality of fake emails in twelve months, that drop looks less like a loss of nerve and more like an accurate read of the situation.
42% could not identify any warning signs when shown a simulated fraudulent settlement email.
And the one that should end the argument: 99% failed to spot the fraudulent email address — after being told the email was a scam. Not caught out cold. Told in advance that something on the screen was fake, asked to find it, and still 99 out of 100 missed it.
That is not a failure of attention. It's a task human eyes are bad at. `settlernents` and `settlements`. `.com.au` and `.com`. An `l` where an `I` should be. You are not going to win this by looking harder.
87% of respondents also said buying or selling property is among the most stressful experiences of their lives, and 62% said they're worried about AI voice cloning being used against them. Both of those are the right instinct.
The one rule
If you remember nothing else from this page, remember this:
Never take bank details from an email. Not once. Not ever. Not even from someone you have emailed forty times.
Email is not a channel that can prove who sent something. It never was. Everything else below is just how you put that rule into practice.
Six things to do before you transfer a cent
1. Get the account details by voice, on a number you found yourself.
Ring your conveyancer or settlement agent and have them read the BSB and account number to you out loud. Get the number from the contract you signed, the firm's website that you navigated to yourself, or a card they handed you in person. Never the number in the email - that's part of the same message you're trying to verify.
Do this even if the emailed details look identical to what you already have. Especially then.
2. Read the numbers back to them.
Digit by digit, both ways. This catches the version where one character has been altered.
Digit by digit, both ways. This catches the version where one character has been altered.
3. Treat any change of details as fraud until proven otherwise.
A late change to bank details is the single strongest signal in this entire crime. Legitimate firms almost never change account details mid-transaction, and when they genuinely do, they will not be remotely surprised that you rang to check.
If an email says the usual account is "under audit," "temporarily unavailable," "with a new trust provider," or that the details have changed "due to a system upgrade" - that is the scam. Those are the standard lures.
4. Send a test transfer first.
One dollar. Ring and confirm it landed. Then send the rest. It adds fifteen minutes to a process that has already taken three months.
One dollar. Ring and confirm it landed. Then send the rest. It adds fifteen minutes to a process that has already taken three months.
5. Stop when your bank warns you.
Most Australian banks now run Confirmation of Payee, which checks the account name you've typed against the name on the receiving account before the money moves. The Australian Banking Association reported in March that it had been used more than 100 million times since launching in July 2025, across 83 institutions and more than 143 million accounts. One bank alone recorded over 450,000 payments abandoned after a "no match" result.
If you get a "no match" or "partial match" on a seven-figure transfer, do not click through it. Stop, and go back to step 1.
A match is reassuring but not a guarantee, and no bank warning replaces the phone call.
6. Do it in a branch if you can. For an amount this size, sitting in front of a human is a genuine control, not an inconvenience. The Riverton settlement was saved by a banker who read the email and thought the wording was slightly off. An app cannot do that.
The moments to be paranoid
The fake email doesn't arrive at random. It lands at the points where money is expected to move, because that's when it won't look strange:
-Deposit day, right after the contract is signed
-Any request for stamp duty or fees ahead of settlement
-The 24 hours before settlement, which is the big one
-Settlement day itself, usually flagged urgent, usually with a deadline
-The rental bond, if you're renting rather than buying - the same scam runs against tenants for a smaller amount
-The final tradie invoice on a build or renovation
Same structure every time. Real transaction, real relationship, real timing, wrong account.
If it's already gone
Speed is the only thing that matters here, and shame is the thing that costs people the money. Do these in order, and do them now.
- Ring your bank immediately - the number on the back of your card, or walk into a branch. Say the words "payment redirection scam" and "please attempt a recall." Australian banks can sometimes freeze or claw back funds if they hear about it fast enough. Fast means minutes and hours, not tomorrow morning.
- Ring the receiving bank too if you know which one it is. A second institution acting on the same account improves your odds.
- Ring your conveyancer or settlement agent on a number you look up yourself, and tell them their email may be compromised. You will not be their only client.
- Report it to ReportCyber at cyber.gov.au - this is the police reporting channel, and your bank and insurer will ask for the reference number.
- Report it to Scamwatch at scamwatch.gov.au so it feeds the national picture.
- Call IDCARE on 1800 595 160. Free, Australian, and they will build you a written response plan. If identity documents were caught up in the compromise, this matters even more.
- Write down the timeline while it's fresh - every email, every call, every timestamp. If there's a dispute later about who was responsible for the compromised mailbox, that record is your case.
- Know your escalation paths, because they differ. If your bank's response isn't good enough, the Australian Financial Complaints Authority is the place to take it - and since 12 March 2026 AFCA can also consider complaints against the bank that received the money, even if you have never been their customer. That's a genuinely new avenue and most people don't know it exists. AFCA does not cover conveyancers, settlement agents or real estate agents, though: complaints about a law practice or licensed agent go to your state's legal services commissioner or licensing body, and the OAIC handles the privacy side only where the firm is actually covered by the Privacy Act - many small firms are exempt.
And say this part out loud, because it's what stops people from ringing the bank in the first ten minutes: this is not a failure of intelligence. Ninety-nine per cent of people who were in the middle of buying a house, warned in advance and asked to look, could not spot the fake address. You were not the exception. You were the rule.
It isn't only houses
The same machinery runs against much smaller amounts, all week, everywhere.
The builder's progress claim with new account details. The school fee invoice. The wedding photographer's final payment. The invoice from a supplier your small business has paid for six years. The bond for a rental, sent by an agency whose inbox got popped.
The mechanics never change: someone reads a real inbox, waits for a real invoice, and changes the numbers. The rule doesn't change either.
Bank details come from a phone call, not an email.
One conversation this weekend
It's Father's Day on Sunday. There's a reasonable chance you'll be in a room with the people this crime works best on.
Australians aged 65 and over make up 17.1% of the population and account for 26.5% of everything lost to scams reported to Scamwatch. And older Australians are also the ones downsizing, settling estates, helping the kids with a deposit — moving large sums, on a deadline, for the first time in decades.
So if the conversation lands somewhere near it, try this. Not a lecture. One sentence:
"If anyone ever emails you bank details, ring them on a number you looked up yourself before you send a dollar."
That's it. That's the whole defence against a $166.8 million crime, and it costs you nothing but the fifteen minutes you were going to spend on hold anyway.
The young mum in Riverton got her house because somebody stopped and made a phone call.
Be the person who makes the phone call.
SelfCybr helps Australian individuals and families see what's exposed, fix it, and learn how to stay ahead of it. No jargon, no shame, no data sold — ever. Australian-owned, Australian-hosted.
Sources and further reading
The Riverton case
- Westpac - https://www.westpac.com.au/news/money-matters/2026/08/westpac-bankers-instinct-saves-customer-from-1-million-scam/, 6 August 2026
- Smart Property Investment - https://www.smartpropertyinvestment.com.au/finance/28018-buyer-nearly-loses-1-2m-after-fake-settlement-email
The research
- SecurityBrief Australia - https://securitybrief.com.au/story/pexa-flags-drop-in-scam-confidence-among-homebuyers, 24 August 2026 - PEXA Settlement Scams Index, second edition; 1,028 respondents, fieldwork by Nature
- Mortgage Professional Australia - https://www.mpamag.com/au/news/general/property-buyers-failing-to-detect-scams-despite-awareness/587327, 26 August 2026
- PEXA Group - https://www.pexa.com.au/scam-safety/ (consumer guidance and whitepaper). Note: PEXA's 2025 first-edition release reported a 97% failure rate on 1,030 respondents — the 99% figure above is from the 2026 second edition.
Scale
- ACCC / National Anti-Scam Centre - https://www.accc.gov.au/media-release/continued-action-critical-to-combat-fraud-as-annual-scam-losses-exceed-2-billion, 30 March 2026
- National Anti-Scam Centre - https://www.nasc.gov.au/system/files/targeting-scams-report-2025.pdf
Bank protections
- Australian Banking Association - https://www.ausbanking.org.au/banks-hit-major-milestones-as-scam-fighting-technology-stops-thousands-of-risky-transfers/, 10 March 2026
- Australian Banking Association - https://www.ausbanking.org.au/scam-safe-accord/confirmation-of-payee/
Where to get help
- ReportCyber / Australian Cyber Security Centre - https://www.cyber.gov.au/
- Scamwatch - https://www.scamwatch.gov.au/report-a-scam
- IDCARE - https://www.idcare.org/, or 1800 595 160
- Australian Financial Complaints Authority — https://www.afca.org.au/, and https://www.afca.org.au/about-afca/receiving-banks-and-unauthorised-opening-of-accounts (AFCA's expanded scam jurisdiction, effective 12 March 2026)
- ANZ - https://www.anz.com.au/security/types-of-scams/payment-redirection-scam/
