Settlement and deposit payments at your agency are often arranged and confirmed by email. One altered email with “updated” bank details can send a buyer’s or vendor’s funds to a criminal, damaging client trust and disrupting the settlement. This type of attack is known as business email compromise (BEC), and in real estate it targets the moment money changes hands.
This page explains how these attacks work, which layers of protection can help reduce the risk, and the first steps to take if you suspect an email has been changed. Catalyst Computers helps Sydney agencies assess and strengthen their email setup so your team can handle payments with more confidence.
Why Are Real Estate Agencies a Target for Business Email Compromise?
Your agency handles large deposit and settlement amounts, and much of the arrangement happens over email. A single thread can include buyers, vendors, conveyancers, property managers and your own sales staff. Every one of those people is someone a criminal can impersonate.
Settlement periods are also busy and deadline-driven. When a “change of bank details” email arrives close to a deadline, it is easier to act on it without stopping to check. Criminals rely on that pressure, and on the fact that payment emails between agents and conveyancers are routine.
National data shows how common these attacks are for Australian businesses. In ASD’s ACSC Annual Cyber Threat Report 2024-25, email compromise resulting in no financial loss was the most reported cybercrime by businesses, at 19% of business cybercrime reports. BEC fraud resulting in financial loss was second, at 15%.
These figures describe cybercrime reports from Australian businesses across industries, rather than real estate agencies alone. They still show why real estate email scam protection deserves a place in your agency’s planning, because your payments are exactly the kind these attacks are designed to redirect.
How Do Criminals Intercept Settlement and Deposit Emails?
The ACSC has described how property-related business email compromise works in Australia, with criminals impersonating agents and conveyancers to insert false bank details for settlement or rental payments. Most attacks follow one of three routes.
Mailbox Compromise
A staff member’s email password is captured, often through a phishing email or a fake login page. The criminal then signs in quietly and may set up rules that forward copies of incoming emails to another account. The ACSC advises checking for and deleting any forwarding rules you did not create when recovering a compromised account.
From there, the criminal watches threads until a payment is due. Because the fraudulent email is sent from your real account, it looks genuine to the person receiving it. The ACSC notes that successful attacks can go unnoticed for weeks, until someone follows up on a missing payment.
Domain Spoofing and Lookalike Domains
Criminals may forge emails so they appear to come from your domain. They may also register a lookalike domain that swaps letters or adds extra characters, or create a Gmail, Yahoo or Outlook address that uses your agency’s name.
At a quick glance, especially on a phone, these addresses can look legitimate. Checking the full sender address before acting on a request is a simple habit that helps.
Thread Interception
The criminal replies inside a genuine email thread at the payment stage, with “updated” bank details and urgent but plausible wording. Because the earlier messages in the thread are real, the request feels like a natural next step.
Conveyancers are often on these threads, and the ACSC has noted a particular focus on impersonating conveyancing lawyers. That is why conveyancing email fraud protection matters to your agency as well as to the conveyancers you work with.
Email Fraud Prevention for Real Estate Agencies: The Layers That Reduce Risk
No single control removes the risk of email fraud. Several layers working together can help reduce it, with each layer addressing one or more of the attack routes above.
Email security for real estate agencies usually combines these measures:
- Multi-factor authentication (MFA) on every email account. A stolen password alone is then less likely to give a criminal access to the mailbox.
- Monitoring for unusual sign-ins and new forwarding rules. This can help your team spot a compromised mailbox early, before a payment email is altered.
- SPF, DKIM and DMARC records on your domain, plus email filtering. The ACSC recommends these records to help reduce the chance of criminals sending fake email that appears to come from your domain.
- Staff awareness training with settlement-themed examples. Phishing protection for real estate agencies works well when your team can recognise fake login pages and suspicious bank-detail requests.
- A call-back process for any bank-detail change. Confirm the change by calling a phone number you already hold, never one supplied in the email itself.
The first three layers are technical controls that your IT provider can set up and monitor. The last two depend on your people and processes, which is why they matter just as much.
You can also tell clients early in each transaction that your agency will not change its bank details by email. This simple step supports settlement fraud prevention for real estate agencies, because it gives clients a reason to question an unexpected request.
What Should You Do If You Suspect a Settlement Email Has Been Changed?
A fast, calm response can help limit the damage. These first steps focus on banking, reporting and IT only:
- Contact your bank immediately, and ask the affected client to contact theirs.
- Report the incident to ASD’s ACSC through ReportCyber at cyber.gov.au/report, or call 1300 CYBER1 (1300 292 371).
- Reset the affected account password and sign out of all active sessions.
- Review the mailbox for forwarding addresses or rules you did not create, and remove them.
- Keep the suspicious emails rather than deleting them, and check other staff accounts for signs of the same activity.
Speak with your IT provider promptly so they can review sign-in records and help secure the mailbox. For questions about your legal or contractual position, seek appropriate legal advice.
Where Email Protection Fits in Your Agency’s Wider IT Security
Email is one entry point among several. Email hacking protection for real estate agencies works well alongside device security, reliable backups, careful account management and ongoing support for the whole team.
When a staff member leaves or a laptop is lost, the same account controls that protect email also help protect your other systems. Treating email as part of your wider security, rather than a separate project, keeps those protections consistent.
Catalyst Computers supports agencies with IT support for real estate agents and IT security services that cover the agency’s wider systems as well as email. Our Sydney-based team works with agencies across Greater Sydney, serving the Sydney CBD, Parramatta and Penrith.
Frequently Asked Questions About Real Estate Email Fraud
Can email security stop settlement fraud completely?
No single measure can remove the risk completely. Business email compromise in real estate often relies on people as much as technology, so layered controls such as MFA, mailbox monitoring, DMARC and staff awareness can help reduce the risk. A call-back process for bank-detail changes adds a check that does not rely on email at all.
Does protecting your agency’s email also help buyers, vendors and conveyancers?
Yes, in part. When correctly configured with SPF and DKIM, a DMARC policy can make it harder for criminals to send email that appears to come from your exact domain, although it does not stop lookalike domains. Telling clients how your agency confirms bank-detail changes also helps them recognise a fake request when one arrives.
Speak With Catalyst Computers About Email Fraud Protection
Layered email protection and clear verification steps can help protect client funds, client trust and the smooth running of each settlement.
Contact Catalyst Computers for a free IT assessment, or call 02 9698 4050 to speak with our team about email fraud prevention for real estate agencies.
This page provides general IT information only and is not legal, financial or compliance advice.
