A settlement payment can be stolen without anyone breaking into the bank or the settlement system. The fraud can run through an ordinary email account, in the right thread, with a familiar signature. The only thing that changes is the bank account.
Read the transcript
The email looked exactly like it came from the law firm. Same signature. Same thread. Same friendly tone. The only thing that changed was the bank account. And by the time anyone noticed, the money was gone.
In 2025, Australians reported losing $166.8 million to payment redirection scams. That's the ACCC's figure, and it's only what people reported. Payment redirection is the scam where someone pretends to be a business you trust and gives you new bank details.
Property settlements are a known target for payment-redirection scams. The amounts are large, the dates are known in advance, and everyone is expecting an email about money.
Here's how it actually happens, step by step.
These frauds don't have to start with clever hacking. They can start with an ordinary-looking email: a shared document, or a voicemail notification. Someone at the firm, or someone at the client's end, clicks the link and lands on a page that looks exactly like their normal email sign-in. They type their password. Now the attacker has it.
Sometimes they don't even need the fake page. People reuse passwords, and passwords from old website breaches are bought and sold in bulk.
This is the part people may not expect. The attacker doesn't have to strike straight away. They can sign in quietly and read, for days, sometimes weeks.
They learn who the clients are, which matters are about to settle, who sends the trust account details, and how the firm writes. The signature. The sign-off. Whether people write "Hi" or "Dear".
Before they strike, they can set up an email rule. It's a normal feature, the same one you'd use to file newsletters into a folder. But this rule takes any reply that mentions "bank", "account" or the client's name, and moves it somewhere nobody looks.
So when the client replies with a question, the real person at the firm never sees it. The attacker does.
A day or two before settlement, the client gets an email. It's in the right thread, from the firm's real address, or from one that's a single letter different. It says: "Please note our trust account details have changed. Updated details attached." Sometimes the attachment is a real document from the firm, with only the account number changed.
The client pays. The money moves to an account the criminals control, and then on again. Scammers can move the money quickly, making it difficult to recover.
Notice what didn't happen. Nobody hacked the bank. Nobody broke into the settlement system. The attacker hacked the one thing everyone relies on: trust in an email thread.
That's actually good news, because it means there are practical steps you can take.
Here are four practical steps to reduce the risk.
One: protect every sign-in. A password on its own isn't enough. Turn on multi-factor authentication, or MFA, the code or approval on your phone, for every account, including people who only check email now and then. Use phishing-resistant MFA wherever it's supported. Some fake sign-in pages can steal your password and one-time MFA code, which is why the next three still matter.
Two: watch for rules and odd sign-ins. Get alerted whenever someone creates a rule that forwards, moves or deletes email, and whenever there's a sign-in from somewhere unusual. An unexpected rule that hides bank or payment emails is a red flag that needs investigating.
Three: the call-back rule. Any first-time or changed payment instructions, from anyone, get a phone call before money moves. Call a number you already have on file, never one from the email that sent the instructions, and confirm who answers. Make it a firm rule, and make it apply to the partners too.
Four: tell your clients. Put one line in every email, cost agreement and set of settlement instructions: "We will never change our bank details by email. If you receive an email saying our details have changed, call us on our usual number before you pay." That gives clients a clear way to check suspicious payment instructions.
Payment redirection is one of Australia's costliest reported scams, and law firms sit right in the middle of it. Practical defences start with a few settings and one habit: pick up the phone.
CRYPTON has a Law Firm IT Health Check. Answer 10 plain-English questions, enter your contact details, and see what to sort out first. Your answers stay on the page. We receive only your contact details. Or if you'd rather talk it through, talk to CRYPTON. Both links are in the description.
In 2025, Australians reported losing $166.8 million to payment redirection scams, according to the National Anti-Scam Centre's Targeting Scams report (PDF). That figure covers all payment redirection, not property settlements alone, and only what people reported.
Property is a known target. The Australian Cyber Security Centre has warned that cybercriminals impersonate parties to a property transaction and insert false bank details for settlement payments, with a particular focus on conveyancing lawyers and their clients.
It can start with one password
This fraud doesn't have to begin with clever hacking. Someone clicks a link in an ordinary-looking email and lands on a page that looks like their normal sign-in. They type their password, and the attacker has it.
Sometimes the fake page isn't needed. People reuse passwords, and passwords from old website breaches are bought and sold.
Then the attacker can wait
An attacker doesn't have to act straight away. They can sign in quietly and read, for days or sometimes weeks, to learn which matters are about to settle, who sends the trust account details and how the firm writes.
Read the transcript
When fraudsters get into a law firm's email, they don't have to steal anything straight away. They can read, for days, sometimes weeks. They learn which matters are about to settle, who sends the trust account details, and how you sign off. So when the fake email arrives, it can sound exactly like you. That's why "it looked real" isn't the client's failure. It's the plan. One defence is catching the break-in early, with alerts on unusual sign-ins and new email rules.
Try the Law Firm IT Health Check, or talk to CRYPTON. The link is below.
A hidden rule keeps replies out of sight
Before they strike, an attacker can set up an email rule that moves certain messages somewhere nobody looks. If a client replies with a question, the real person at the firm may never see it. Our note on finding a hidden email rule shows what to check.
The fake bank details arrive
Close to settlement, the client receives an email saying the firm's account details have changed. It may come from the firm's real address, or from a domain with swapped or added characters. The attachment may even be a real firm document with only the account number altered.
The client pays, and the money moves on. The ACSC notes that a successful scam can go unnoticed for weeks, until someone follows up a missing payment.
Four steps that reduce the risk
None of these removes the risk, but each one makes the attack harder to complete or easier to notice.
- Protect every sign-in. Turn on multi-factor authentication for every account. Our email and sign-in checks for law firms go through what to confirm.
- Watch for rules and odd sign-ins. Get an alert when someone creates a rule that forwards, moves or deletes email, or signs in from somewhere unusual.
- Use a call-back rule. Any first-time or changed payment instructions get a phone call to a number you already hold. See our payment check for changed bank details.
- Tell your clients. Say in writing that your bank details won't change by email, and how to check if they appear to.
The bank and the settlement system can both work exactly as designed while this happens. What the attacker abuses is trust in an email thread, so the practical defences sit with your email accounts and your firm's habits.
General information only, not legal or professional advice.
For help with email and sign-in protection, see email security.