Australian Cyber Security Centre alert
The ACSC warns that property-related business email compromise uses altered payment details and recommends independently verifying account information.
Read sourceMortgage broker guide · Printable checklist
Settlement week is a scam window. Close it deliberately.
From ten days out to final reconciliation, map every sensitive touchpoint to a verification action and a piece of evidence. A remembered callback policy is not enough under deadline pressure.
Operationalise “call back on a known number”
Property transactions bring unfamiliar parties, large transfers and legitimate last-minute changes into one compressed week. Business email compromise exploits that ambiguity. A convincing message can arrive in a genuine thread, while a follow-up call supplies urgency.
The familiar advice is to call back on a known number. The control only works when “known” is defined before the suspicious request. Numbers inside the email, attachment, text or caller ID belong to the same untrusted channel.
Use this checklist to nominate the trusted record, the person who verifies, the second approver and the evidence retained. Print it for a file review or translate each row into your own workflow.
Settlement rule
The closer the deadline, the less discretion staff should have to skip the check. Urgency is a reason to follow the procedure, not suspend it.
T-10 days to settlement day
For each stage: identify the touchpoint, name the attack, perform the check and retain the record.
- 1
T-10 days
- Touchpoint
- Confirm the settlement team, trusted phone numbers and expected payment path with the client.
- Scam
- An attacker introduces a new contact early, then uses that identity throughout the transaction.
- Verification action
- Check the client on the known number already held in the file. Record who may give instructions and tell the client that changed details will trigger another check.
- Evidence
- Recorded check outcome, approved contact list and dated client warning.
- 2
T-7 days
- Touchpoint
- Deposit, contribution or shortfall instructions arrive.
- Scam
- A compromised mailbox substitutes an account while preserving the real subject line, names and transaction details.
- Verification action
- Do not verify using the reply thread. Contact the responsible party through a separately sourced number and complete your checks before discussing or accepting the instruction.
- Evidence
- Verification outcome, source of the trusted number and instruction version retained with the file.
- 3
T-5 days
- Touchpoint
- A lender, conveyancer or settlement agent calls for documents or information.
- Scam
- A caller quotes accurate loan and property facts to extract one missing detail or accelerate a fraudulent request.
- Verification action
- Treat the inbound call as an identity claim. End it if necessary, use the number already held in the firm's records and complete an independent possession check.
- Evidence
- Timestamped record of requester, masked target, method and outcome; note any failed attempt.
- 4
T-3 days
- Touchpoint
- Discharge payout, sale proceeds or disbursement destinations are finalised.
- Scam
- A late request changes the destination account and uses the approaching deadline to bypass dual control.
- Verification action
- Require verification and a second-person approval for every changed destination. Compare against the last approved instruction; never accept a screenshot as account ownership proof by itself.
- Evidence
- Old and new instructions, verifier record, approver name and reason for change.
- 5
T-1 day
- Touchpoint
- The client receives a final confirmation call, text or email.
- Scam
- A fake broker or lender tells the client that earlier details were wrong and supplies a replacement account or callback number.
- Verification action
- Remind the client to ignore contact details inside an unexpected change message. Reconfirm your standing verification rule using the established channel.
- Evidence
- Dated pre-settlement confirmation and the contact path used.
- 6
Settlement day
- Touchpoint
- Funds move, final figures change and urgent calls arrive.
- Scam
- The criminal creates a last-minute exception: a failed account, delayed settlement, changed payee or immediate top-up.
- Verification action
- No exception without a fresh verification against known records and dual approval. If verification fails or the story changes, stop, escalate and contact the bank or settlement party independently.
- Evidence
- Final verification result, approval trail, exception notes and any incident record.
- 7
After settlement
- Touchpoint
- The client and parties confirm completion and reconcile disbursements.
- Scam
- A missing or redirected payment is disguised as ordinary processing delay, losing time for recall.
- Verification action
- Confirm receipt through known contacts. If money is missing, call the sending bank's fraud team immediately, preserve communications and follow the firm's incident procedure.
- Evidence
- Receipt confirmations, reconciliation, bank reference and escalation record.
What a Vericode check leaves
Highlight the phone number already visible in a browser-based CRM, lender portal or email client, then right-click to send a one-time code by SMS. The person reads the code back during the live interaction.
Every result adds a timestamped, hash-chained entry to Vericode's authorised-contact register, showing who requested it, the masked target, method and outcome. Compliance-authorised users can export the record as PDF or CSV, giving the file a durable artefact rather than a note saying “called client”.
The browser-extension mechanic is CRM-agnostic. It does not claim a direct integration with a named broker platform.
A failed check is a stop signal
Do not explain which answer was wrong or reveal another number. End the request, preserve the message and route it through the firm's escalation path.
If money has moved, contact the sending bank's fraud team immediately. Timing affects the chance of a recall. Record the incident and follow relevant reporting, insurer and client-notification procedures.
Sources
Mortgage broker data-breach risk
Mortgage Professional Australia examines why client data exposure creates practical risk for mortgage brokers and their customers.
Read sourceGeneral information only. Adapt this checklist to your firm's approved procedures. It is not legal, financial, cyber-incident or compliance advice.
Build the repeatable pause