Stopping Email Fraud on Deposits and Bond Payments

Real estate offices send and receive emails about money every day. Buyers pay deposits, tenants pay rent and bonds, landlords receive their rent, and vendors wait on settlement. That steady flow of payment emails is exactly what scammers look for.

The usual version is a payment redirection scam, where someone sends a convincing email asking for money to be paid into a new bank account. Australians lost $166.8 million to payment redirection scams in 2025, according to the ACCC’s Targeting Scams report, making it the second-highest loss category that year. This guide explains how real estate email fraud works and the checks that stop it.

How the scam works in a real estate office

Scammers either take over a real email account, or set up one that looks almost identical. They then wait for a payment to be due and send an email with changed bank details. Because the email can arrive in an existing conversation, with the right logo and signature, it often looks genuine. The common versions are:

• The buyer’s deposit. A buyer receives an email that appears to come from the agency or the conveyancer, asking them to pay the deposit into a different account.
• The landlord’s rent. The property manager receives an email that appears to come from a landlord, asking for future rent to be paid into a new account.
• The tenant’s payments. A tenant receives an email that appears to come from the agency, with new details for rent or the bond.
• The supplier invoice. A tradesperson’s invoice arrives with updated bank details, and the payment goes out from the trust account.

The call-back rule

The most useful check is also the simplest. Any request to change bank details is confirmed by phone, using a number you already have on file, before any money moves. Scamwatch’s advice is to phone the business on a number you have found independently, and never use the contact details in the email itself.

This applies to landlords changing their disbursement account, suppliers sending new invoice details and anyone else asking for a payment to go somewhere new. Write it into your procedures, so a new property manager does not have to decide on the spot.

Tell buyers and tenants how you will ask for money

Clients cannot spot a fake email if they do not know what a real one looks like. A few small changes make a real difference:

• Add a line to your email signature and agency agreements saying your agency will never change its bank details by email.
• Give buyers your trust account details at the start, and ask them to call your office to confirm before paying a deposit.
• In NSW, tenants can pay their bond directly to NSW Fair Trading through Rental Bonds Online. If your agency uses it, tell tenants the bond is paid through Rental Bonds Online and never into a bank account sent by email.
• Encourage clients to check the payee name their bank shows when they pay. Most Australian banks now offer Confirmation of Payee, which checks the account name against the BSB and account number and shows whether it is a match, a close match or no match.

Make your email harder to take over

Many payment redirection emails come from a real mailbox that has been taken over, which is why the email security behind your agency matters as much as the procedures. The basics are:

• Multi-factor authentication on every account, including shared inboxes such as rentals@ and accounts@, so a stolen password alone is not enough to get in.
• SPF, DKIM and DMARC on your domain, which make it much harder for someone to send email pretending to be your agency. Our page on email security and DMARC explains how these work.
• External forwarding blocked. Scammers often set up a rule that quietly forwards your emails to them. Microsoft 365 blocks automatic forwarding to outside addresses in most accounts, but older accounts can still allow it, so it is worth checking yours.
• External email tags switched on, so staff can see at a glance when an email has come from outside the agency.
• Phishing training, so your team recognises fake sign-in pages and changed bank detail emails.

Use two people for trust account changes

Where your trust accounting software allows it, separate the person who sets up or changes a payee from the person who approves payments. A scam then needs to get past two people instead of one, and the second person is a natural point to ask whether the change was confirmed by phone.

If a payment has gone to the wrong account

Speed matters, because the sooner the bank knows, the better the chance of stopping the money. If you think a payment has gone to a scammer’s account:

1. Call your bank straight away, and ask the client to call their bank if they made the payment.
2. Report it to ReportCyber through the Australian Signals Directorate.
3. Have your IT provider secure the affected email accounts, reset passwords, check for forwarding rules and work out how the scammer got in.
4. Contact your insurer, and get advice on whether client information was exposed and needs to be reported.

Our guide to stopping payment redirection fraud in a law firm covers the same scam from a conveyancing point of view.

How Digitek helps

Digitek IT sets up email authentication, filtering and multi-factor authentication for real estate agencies, and trains your team to recognise payment redirection emails. We also help you put simple checks in place, such as phoning to confirm any change to bank details, and manage the laptops and phones your agents use on the road.

Find out more about our IT support for real estate agents, book an IT security review, or call 02 4504 8643.