Conveyancing guide · Incident timelines

Anatomy of a settlement redirection

From mailbox or account compromise to vanished purchase funds: three public Australian incident patterns, annotated at the moment an independent check could interrupt them.

Payment redirection scamsBusiness email compromise
Read the sequence, not just the final email

The visible instruction is the last controllable moment.

Settlement redirection is often described as a suspicious email problem. By the time that email appears, the criminal may already understand the parties, property, amount, deadline and writing style. The message succeeds because it arrives where a genuine instruction belongs.

The three timelines below use only facts and patterns stated in the linked public reporting and alerts. Where a source does not publish technical or recovery detail, this guide does not fill the gap with invented specifics. The annotation is the control analysis: the exact point where a trusted-number callback and complete read-back tests the payment destination.

No check guarantees recovery or prevents every account takeover. Its value is narrower and earlier: it moves the decision away from the channel that delivered the changed instruction.

Three sourced timelines

Follow the instruction to its interrupt point

Timeline 01 · Buyer payment email

A property buyer receives the wrong destination inside a trusted exchange

Lawyers Weekly
  1. 1.1

    Mailbox access

    The public report describes scammers hacking email accounts connected with property purchases. Access gives the criminal real transaction context rather than a cold list of targets.

  2. 1.2

    Convincing instruction

    The buyer receives payment directions presented as if they came from the conveyancer. Real names, timing and matter detail make the destination account feel like the final administrative step.

  3. 1.3

    Funds sent

    The buyer transfers purchase money to the criminal-controlled account. The mismatch appears only when the legitimate party looks for funds that never arrived.

Verification interrupt

Before transfer, the buyer independently calls the conveyancer on a number established earlier and reads the complete BSB and account number out and back. The payment email is not used to source the number.

Timeline 02 · PEXA account compromise

A compromised conveyancer account reroutes a family’s home-sale funds

iTnews
  1. 2.1

    Account compromised

    iTnews reported that a conveyancer’s PEXA account was allegedly compromised. The attacker obtained access to a legitimate settlement environment rather than merely copying a logo.

  2. 2.2

    Destination changed

    Property settlement funds were rerouted. The report’s essential fact is the changed destination inside a genuine transaction; this guide does not add technical detail that the source does not state.

  3. 2.3

    Loss discovered

    The family did not receive the expected home-sale funds. PEXA asked its security team to undertake detailed monitoring across accounts following the incident.

Verification interrupt

A second-channel confirmation of destination details with the client, using a trusted number and documented full read-back before settlement authorisation, challenges the account change even when platform access appears legitimate.

Timeline 03 · Trust-account impersonation pattern

An active email scam substitutes trust-account details

ACT Law Society
  1. 3.1

    The relationship is observed or imitated

    The ACT Law Society’s trust-account alert recognises active email scams aimed at legal payments. A criminal uses a familiar firm or transaction context to make substituted details plausible.

  2. 3.2

    The payment message arrives

    The recipient is directed to account information under time pressure. Replying to the message, relying on the signature block or calling a supplied number leaves the attacker’s channel unchallenged.

  3. 3.3

    Payment follows the false detail

    Once money is sent, speed works against recovery. The practical control belongs before payment, not in the investigation that begins after a failed reconciliation.

Verification interrupt

The firm and client agree at engagement that trust-account details are confirmed by calling the independently published office number. Any change triggers a stop, fresh verbal check and recorded escalation.

Across all three

The absent control is out-of-band verification.

Context is not identity

Property, client and timing details can come from a compromised account. More correct facts in the message do not authenticate the sender.

A reply is not a check

Replying, calling a signature number or accepting incoming caller ID keeps the verification inside infrastructure the criminal may control.

Evidence matters

A trusted-number call, full read-back and record of person, time, method and outcome lets the firm show how the instruction was tested.

The operational rule is consistent: capture trusted contact details before the high-value instruction, require independent confirmation for every new or changed account, and stop when the contact or details do not match. This is the procedure described in the companion call-before-you-pay guide.

PEXA Key: scope and gap

Protect the platform and the conversation.

PEXA describes PEXA Key as a secure way for buyers and sellers to share financial details rather than relying on ordinary email. Keeping sensitive details inside that controlled experience reduces exposure to email interception and substitution.

Conveyancing still includes interactions outside the platform: an incoming phone call, a client who cannot or does not use the app, an unrepresented party, an ordinary email, or a request that asks staff to step around the expected workflow. Those channels need their own control.

Vericode complements PEXA Key; it does not compete with it and no partnership or endorsement is implied. PEXA Key protects details inside its platform. Vericode checks possession of a known phone contact when the instruction or conversation occurs outside it. Neither product replaces full account read-back, payment approvals or professional judgement.

PEXA scam-safety guidance
Additional alert source
Law Society of NSW trust money and fidelity fund scam alerts

Public reporting and guidance are cited as evidence of the threat pattern only. No endorsement of Vericode by the publications, law societies or PEXA is implied.

Before settlement authority

Put an independent check between the instruction and the funds.

Use the trusted record, check the caller, read the destination details in full and keep the result with the matter.

Vericode for conveyancing Suspicious activity playbook
General information only. This guide is not legal, financial or incident-response advice. Follow your firm’s procedures and seek professional advice for your circumstances.