Guide · Real estate and property management

A landlord calls to change the account their rent goes to

They know the property, the tenant and the rent amount, and the next disbursement is days away. That still isn't enough to change where an owner's money goes. Here is what Queensland and NSW regulators, ASD and REINSW say, and a short routine your property managers can use before anything changes.

The short version

Hang up, call the owner back on the number you already hold, and keep checking and paying separate.

This six-step routine is our suggestion, drawn from the guidance cited below. Queensland OFT describes an owner impersonation scenario, and ASD recommends confirming bank-detail changes on an established phone number. The cited bodies do not prescribe or endorse this routine.

What's being reported

Queensland's regulator names this exact scenario.

What the guidance says

Confirm the change through a contact route you already hold.

Trust account rules, briefly (general information)

A fraud check sits alongside your trust account rules. It doesn't replace them.

  • Queensland: trust money may only be paid out as the Agents Financial Administration Act permits, and OFT guidance says withdrawals of rent monies need written authorisation from the client or their representative. A written instruction can also be fraudulent, so it still needs checking.

    Queensland OFT: Handling trust money in the property industry

  • Queensland: section 16 sets out trust account cash-book requirements for payments. For EFT payments other than the specified bill-payment-platform exception, the required particulars include the destination account holder's name, financial institution identifier, account number and transaction reference. Recording a supplied account holder name does not confirm account ownership.

    Agents Financial Administration Regulation 2014 (Qld), s 16

  • NSW: Fair Trading says client funds must be disbursed as the client directs, and only the licensee in charge may authorise trust account withdrawals. Editing an owner's account details is a separate step from authorising a withdrawal.

    NSW Fair Trading: Real estate trust accounts and audit requirements

  • The 2026 Scams Prevention Framework designation covers banking, telecommunications and specified digital platform services. It doesn't designate real estate agency or property management services. That doesn't change any of your other obligations.

    Federal Register: Scams Prevention Framework, Regulated Sectors Designation 2026
A suggested routine

Six steps for the person who takes the call

  1. 01Pause the change. A short line for staff: "We check changes to owner bank details independently. I'll call you back on the details we already hold." If a payment is due before the concern is resolved, escalate promptly to the principal or licensee in charge to determine how to handle it under the agency agreement and applicable trust account rules. Do not treat this guide as authority either to release the payment or to withhold it indefinitely.
  2. 02End the incoming call. Call the owner on a number established before the request and recorded on their file. Don't use a new number supplied with the request.
  3. 03If the owner is changing their phone or email at the same time as their bank details, treat that as a reason to escalate, not to proceed.
  4. 04On the call-back, ask the owner to state the new account details and the reason for the change themselves. Knowing the property address or tenant's name doesn't establish who is calling.
  5. 05Treat checking the request, entering the details and authorising payment as separate tasks. Check the entered details against the independently confirmed instruction and obtain the required withdrawal authorisation. In NSW, only the licensee in charge authorised for that trust account may authorise withdrawals.
  6. 06If you suspect fraud and details have already been changed or rent has been sent, escalate immediately, contact the bank, preserve the evidence and review potentially affected email accounts. ASD advises reporting suspected business email compromise immediately to your financial institution and ASD.

Our suggestion, drawn from the sources on this page. It isn't an OFT, NSW Fair Trading or REINSW procedure, and it doesn't replace your agency agreement or state trust account requirements.

The file note

Record the check

  • How the request arrived, and exactly what was asked for
  • The number you called back on, and where that number came from
  • The old and new details, and who entered the change
  • Who approved it, and anything left unresolved

Your trust account records still need what your state's rules require. This note about the change itself is our suggestion, not a sourced requirement.

Where Vericode fits, and where it stops

A matching code is an additional observation. It does not replace independent contact, authority checks or approval.

Vericode sends a one-time SMS code to a mobile number selected by staff, checks the code read back and logs the outcome. For this routine, staff must use the owner's independently established number already on file. A match does not establish identity, authority or ownership of the destination account. Using Vericode does not, by itself, satisfy AML/CTF, verification of identity, SPF, licensee or other legal obligations.

Scamwatch identifies a caller asking for a password, PIN or one-time code as a warning sign. An agency saying it has just sent the code does not establish that the caller is genuine. Never ask for a bank, lender, login or payment-authorisation code. Do not ask owners to disregard an SMS warning against sharing its code.

Our suggested safeguard: explain the code process in advance through an independently established channel. If the owner is unsure, stop the check and let them contact the agency using details they independently trust. Only request the specific Vericode code after that contact is established. A matching code can still be relayed by someone else and does not prove who received the SMS. If anything remains uncertain, leave the payment change paused.

Sources (checked 31 October 2026)

These organisations are cited for general guidance, not as endorsers of Vericode.

Before the next request

Hold a call-back number for every owner, and note where it came from.

Establish it independently when you take on the property, record its source, and resolve any doubts about it before proceeding. A call-back alone does not establish identity, authority or who owns the new account.

Deposit day and agency email compromise Trust accounts and Tranche 2 for real estate
General information only. This guide is not legal advice. Follow your agency's procedures, your state's trust account rules and current regulator guidance.