How can a real estate agency actually prevent settlement fraud and invoice scams, given how convincing these attacks have become? The most effective control is a strict verification process: confirm any change to payment or settlement details by phone using an independently sourced number, never a number supplied in the email, which is the ACCC’s core advice for stopping payment redirection fraud.
The ACCC specifically names real estate as one of the top industries targeted by this exact type of scam, alongside legal and construction.
For real estate agencies handling settlements and invoices—and for small to medium-sized businesses moving large sums – this matters because a single redirected payment can cause major financial loss.
This guide explains how the attack actually works, why real estate is a prime target, what it costs Australian businesses each year, how to build a verification process that genuinely stops it, what to do immediately if fraud occurs, and how that process fits into broader IT and cybersecurity controls.
Key Takeaways of How to Prevent Settlement Fraud and Invoice Scams
- The ACCC explicitly identifies real estate as one of the top three industries targeted by payment redirection scams, alongside legal and construction firms that regularly handle large money transfers.
- Payment redirection scams, also called business email compromise scams, caused $166.8 million in reported losses across Australia in 2025. That made them the second largest category of scam loss after investment scams.
- Attackers get in one of two ways. They either hack into a real business email account, or they impersonate it using a lookalike domain that changes as little as one letter.
- The single most effective defence is a verification process the ACCC itself recommends. Call the business on a number you found yourself, never a number from the email, before acting on any change to payment details.
- Once a payment has been sent to a fraudulent account, the window to recover it closes fast. Speed matters more than almost anything else in the response.
Quick Answer of How to Prevent Settlement Fraud and Invoice Scams
Settlement fraud and invoice scams work in a simple way. An attacker either hacks into a real estate agency’s email account or impersonates it with a near identical domain, then sends altered payment details for a deposit or settlement. The single most effective prevention is a strict verification process.
Any change to payment or settlement details must be confirmed by phone, using a number sourced independently, never a number or link from the email itself. This one control, recommended directly by the ACCC, blocks the overwhelming majority of these attacks before money ever moves.
Why Real Estate Is a Prime Target
The ACCC has been direct about this. Its own guidance states that the industries most commonly targeted are those that regularly deal with large transfers of money. It names real estate specifically, alongside legal and construction.
That makes sense once you consider how a typical property transaction works. Deposits, settlement funds, and final payments regularly move in amounts of tens or hundreds of thousands of dollars.
Those transfers happen between parties who are often communicating primarily by email, frequently for the first and only time in that relationship. A buyer or vendor has no existing pattern of communication to compare against, which makes a convincing fake email much harder to spot than it would be in an ongoing business relationship.
How Settlement Redirection and Invoice Fraud Actually Work
According to the ACCC, attackers gain access in one of two main ways.
The first is a genuine account compromise. The attacker actually gains access to a real email account inside the agency, a conveyancer’s office, or another party in the transaction. This usually happens through a phishing email or a reused, compromised password. From inside that real account, they watch the conversation and insert themselves at the right moment.
The second is domain impersonation. The attacker registers a lookalike domain that changes as little as a single letter from the real one. They then send an email that looks, at a glance, identical to a genuine message from the agency or conveyancer.
Both methods lead to the same outcome. The victim receives what looks like a legitimate email with updated bank details for a deposit or settlement payment, and pays it without realising anything is wrong. The fraud is often not discovered until the real business asks why an expected payment has not arrived.
The Financial Scale of the Problem
This is not a minor or rare category of fraud. According to the National Anti-Scam Centre’s 2025 Targeting Scams report, payment redirection scams caused $166.8 million in reported losses across Australia in 2025 alone. That places it as the second highest category of scam loss nationally, behind only investment scams, and the average loss per incident in payment redirection or business email compromise cases can be substantial.
Total combined scam losses across all categories reached $2.18 billion in 2025, an increase of 7.8 percent on the year before. Payment redirection scams, along with investment scams, romance scams, phishing, and remote access scams, accounted for 60 percent of that total.
One documented case illustrates how convincing this can be, even outside real estate specifically. A man buying a car had already paid his deposit securely through the dealership’s official website. He then received what looked like a genuine follow-up email requesting the remaining balance, with bank details that had been quietly altered.
He paid it, and only discovered the fraud when he arrived to collect the vehicle. He lost more than $35,000 in the process. The same pattern plays out constantly in real estate settlement, often for larger amounts.
Building a Verification Process That Actually Works
The ACCC’s own advice on this is simple and specific. If you receive an invoice or payment details by email, call the business on a number you have found yourself. Never use a number provided in the email itself.
That single control is worth building into a formal, written process for every agency, not just informal advice staff are told once and expected to remember. A verification process that actually holds up in practice generally includes a few concrete elements. Use secure document and communication portals for sensitive information instead of relying only on email.
Every change to bank or payment details, no exceptions, triggers a phone call before any payment proceeds. The number used for that call needs to come from an independent, previously verified source.
A business card, a prior signed agreement, or the agency’s own records all work, but never a number or link contained in the email raising the change. Regular audits of supplier databases can help identify fraud risks before payment changes are acted on.
Staff are trained specifically on this pattern, not just generic phishing awareness. Settlement and deposit payments are a specific, high value target, and staff handling them need to recognise the particular signs of this scam, not a generic list of phishing red flags.
Strict email authentication using SPF, DKIM, and DMARC helps prevent fraud by blocking spoofed emails before they reach staff.
Large or unusual payment changes require a two-person approval process before they proceed. A simple rule that any change above a set dollar threshold needs sign off from a second staff member closes a gap that a single distracted or rushed employee can otherwise fall through.
What to Do If You Suspect Fraud Has Occurred
If a payment has already been made to what turns out to be a fraudulent account, speed genuinely matters. Contact your bank immediately and ask about a recall or hold on the transaction. Preserve all documents related to the transaction as evidence. Banks have windows in which a fraudulent transfer can sometimes be stopped or reversed if reported quickly enough.
Report the incident to Scamwatch and, if it involves a cybercrime element such as a compromised email account, to ReportCyber as well.
Notify every other party in the transaction immediately through known contacts rather than any details in the suspicious message, since a compromised email account may still be actively used to target other people in the same deal.
If your own agency’s email account was the one compromised, treat it as a security incident, not just a financial one.
Change credentials and enable multi factor authentication if it was not already active. Have your IT provider check for other signs of unauthorised access before assuming the incident is fully contained.
How This Connects to Your Agency’s Broader IT Setup
Settlement fraud prevention is not just a staff training issue. It sits directly inside the broader IT and security requirements covered in our guide to Ray White franchise IT requirements, particularly the email security and MFA sections.
An agency with multi factor authentication enforced on every email account makes the first attack method, genuine account compromise, significantly harder to pull off. Email filtering tuned to catch lookalike domains helps catch the second. If your agency is heading into a cyber insurance renewal, this matters even more.
A documented verification process for payment changes is exactly the kind of control we cover in our guide to cyber insurance for real estate agencies. Insurers increasingly ask about it directly.
Not sure where your agency’s current setup actually stands?
Take our two-minute Ray White security self-assessment and get an instant result.
Frequently Asked Questions of How to Prevent Settlement Fraud and Invoice Scams
- 8+ Best Cybersecurity Companies in Brisbane (2026 Guide for SMBs) - November 7, 2026
- 20 Best Managed IT Service Companies in Brisbane (2026 Guide for SMBs) - November 7, 2026
- Co-Managed IT: How It Works With Your In-House IT Team - November 4, 2026
