Home buyer nearly lost $1.2 million to a settlement scam over one letter

By Fiona Sterling · 2026-08-12

The email looked right. One letter gave it away.

Settlement day is the most financially exposed moment in a property buyer's life. Hundreds of thousands of dollars move on a hard deadline, following instructions that arrive by email from people you have spent weeks trusting. Payment redirection scammers count on exactly that combination.

Earlier this month, a Western Australian first-home buyer walked into Westpac's Riverton branch to make what she believed was a routine transfer ahead of her property settlement later that day. The amount sitting ready to move was $1.2 million.^[1] She had the email in hand, the account details were there, and the clock was ticking.

Personal banker Neet Kukreja sat across from her and started to read.

The moment something felt wrong

Kukreja did not raise an alarm straight away. It was a small friction, a sense that the email did not quite match what had come before. "The tone [of this email] was slightly different," Kukreja said. "It didn't read like the previous emails, and that made me pause."^[1]

Kukreja looked harder at the sender's address. Buried in the string of characters was a single extra letter, enough to make the address appear legitimate at a glance, but not to someone reading carefully.^[1] The urgency of the request also did not match the tone of earlier conversations with the settlement agent.^[1]

Further checks confirmed the worst. The settlement agent's email account had been compromised, enabling scammers to send fake but convincing payment instructions directly from an address the buyer already trusted.^[1] The transfer did not go through. The $1.2 million stayed where it belonged.

How the scam is built to succeed

Payment redirection fraud, also called business email compromise, follows a consistent pattern. Criminals break into the email account of a conveyancer, solicitor or settlement agent, then monitor correspondence until they find a live transaction approaching its deadline.^[1]

At the right moment they send a message, from the real account or from a near-identical fake address, asking the buyer to use new banking details. The timing is tight by design: a settlement deadline gives victims no room to slow down and check.

Sometimes criminals register a domain that differs from the real one by a single character, so the substitution survives a casual glance. Sometimes they work from inside the legitimate inbox itself, as appears to have happened in Riverton. Either way, the buyer sees an email from a trusted professional, with account details and a deadline attached.

$166.8 million lost last year

According to data from the National Anti-Scam Centre, Australians lost $166.8 million to payment redirection scams last year.^[1] Property settlements sit at the high end of the loss distribution: a single successful hit can clear out everything a buyer has saved, and the funds move fast enough that recovery is not guaranteed.

The National Anti-Scam Centre figure also captures only reported losses. Many victims do not report, either because they do not realise fraud has occurred until after reconciliation, or because they feel too embarrassed to disclose what happened.

Ben Young, Westpac's head of fraud prevention, said the core defence is deceptively simple. "A quick phone call can make all the difference and help prevent life-changing losses," Young said.^[1] The emphasis on the phone is deliberate. Replying to the email hands your response directly to the person who may have written the fraudulent instructions.

Why conveyancers' inboxes remain a weak link

Property professionals handle dozens of transactions simultaneously, often under pressure from lenders, agents and clients all at once. Their inboxes carry six- and seven-figure payment instructions as a matter of routine, which makes them a high-value target for credential theft.

Some settlement agents now use dedicated payment platforms that sit outside email altogether, or send payment details through a separate secure channel. Others have adopted multi-factor authentication. Adoption is uneven, though, and the Riverton case shows that a hacked inbox remains a live risk even when buyers and their bankers are paying close attention.

A first-home buyer making the largest financial transaction of their life, under a deadline, receiving an email from someone they have worked with for months, faces conditions that are nearly perfect for a successful redirect. Kukreja pausing long enough to read carefully was the exception, not the rule.

What to do before, during and after settlement

The practical protection is simple, and it has to be set up before settlement day. At the start of any property transaction, call your conveyancer or solicitor and confirm their bank account details verbally. Write those details down. If any email during the process asks you to use different account numbers, call your conveyancer back on the number you already hold, not a number provided in the email.

The same rule applies to any instruction that arrives with urgency attached. Urgency is a pressure technique. A legitimate conveyancer who needs to change payment details will understand why a buyer needs five minutes on the phone before transferring seven figures.

If funds have already been sent to a fraudulent account, contact your bank immediately. Banks can sometimes halt or reverse a transfer if the receiving institution is notified quickly enough. Report the incident to ReportCyber, the Australian Cyber Security Centre's online reporting platform, as soon as possible.

Fiona Sterling

Fiona Sterling writes about superannuation, tax and personal finance. She takes rules that are written to be confusing and explains what they mean for the money in your account.