Payment redirection cost Australians $166.8 million in 2025. In a property settlement the loss usually lands on a buyer who paid what looked like your firm's instructions. There are three ways that email reaches them, and your firm can switch off exactly one.
Three Routes, One Loss
The National Anti-Scam Centre's Targeting Scams report for 2025 ranks payment redirection second only to investment scams by money lost. WA Consumer Protection's description is blunt: "The scammers may appear to take control of the business' email address or create a new, almost identical, email address that is difficult to distinguish from the original." That sentence covers three techniques, and each needs a different defence.
Route 1: Your Exact Address, Forged
Email was built without a check that the sender is who the From line says. The Australian Signals Directorate's cyber security centre describes the result: criminals modify "the sender's address, or other parts of an email header to appear as though the email originated from a different source". No mailbox at your firm is touched. The message simply says it is from you, and a receiving mail server will accept that unless your domain tells it otherwise.
Telling it otherwise is what DMARC does. It is a public record on your domain that, in the ASD's words, lets you ask receiving mail servers to "allow, quarantine or reject emails that fail SPF and DKIM verification". Set to reject, it tells your client's mail provider to discard mail claiming to be from your domain that did not come from your systems, provided the provider honours the record, which the ASD notes it must. It is a DNS change, and your clients see nothing.
This is the one route your firm can switch off. Of the 154 licensed WA settlement firms we scanned in June 2026, 71.4% had no DMARC record at all, or one set to monitor only. For those firms, nothing stops route 1 today.
It is also the only route DMARC addresses. The standard describes itself as designed "to prevent the unauthorized use of the Author Domain", and says display-name tricks are "out of scope for DMARC". A message from a hijacked real mailbox, or from a domain the criminal owns, is not an unauthorised use of your domain, so it passes.
Route 2: A Real Mailbox, Taken Over
"The fraudsters behind this scam hack into email accounts and get information about financial transactions underway," WA Consumer Protection warned in July 2024. The mailbox can be yours or your client's. The criminal reads the thread, waits for the funds request, then sends the "updated" account details from the genuine account, often inside the existing conversation. Nothing about the message is forged, so no authentication check can flag it.
The controls here are account controls. CommBank's October 2026 guidance lists "Turning on multi-factor authentication for email accounts as well as banking", and WA ScamNet gives the same advice for every online account. Add a rule that no change to bank details is accepted on the strength of an email alone, however genuine the sender looks.
Route 3: An Address You Don't Own
The third route is a lookalike: a domain one character away from yours, or a free webmail account carrying your firm's name. CommBank describes "an address that looks almost identical to a genuine one, perhaps with a letter or two swapped so it passes at a quick glance". The WA buyer who lost about $732,000 in 2022 received the fake instructions "via a generic Hotmail email address that used the agency's name".
Your DMARC record governs your domain and no other, so it cannot touch this route. What can is your client, if you have told them what to expect. WA ScamNet puts the onus on firms: "Establish a system for clients to double-check that payments are being sought by the agency." That means a written note at engagement saying your bank details will not change, that any email saying otherwise is fraud, and that before paying they must call you on the number in that note, never the one in the email.
The Call-Back Rule Covers All Three
Every source above ends with the same control. Scamwatch: "Contact the business you normally deal with by phone using a number you have sourced independently." WA Consumer Protection: "Call the sender to confirm the authenticity of the request and the account details, using previously known contact numbers." A call on a known number defeats all three routes, so it belongs in your client letter and in your own payments procedure.
What to Do This Month
- Find out whether route 1 is open. Our free self-check for conveyancers reads your domain's public records and tells you in about ten seconds whether a forged email in your name would be rejected. No signup, and your result is not published: check your firm's domain.
- Turn on multi-factor authentication for every mailbox at the firm, starting with anyone who sends funds requests.
- Put the call-back rule in writing, for clients at engagement and for staff handling any change of payee.
None of this stops payment redirection fraud outright. Routes 2 and 3 will still be tried, and the call-back rule is what defeats them. But route 1 is the one a criminal can use without hacking anyone or registering anything, and it is the one you can close with a DNS record.
References and Further Reading
- ACCC, Continued action critical to combat fraud as annual scam losses exceed $2 billion (media release, 30 March 2026) and National Anti-Scam Centre, Targeting scams: report on scams data and activity 2025
- WA Consumer Protection, Losses to payment redirection scams skyrocket (11 July 2024) and Property settlement payment scam results in a $732,000 loss (3 May 2022)
- WA ScamNet, Payment redirection scams in property transactions
- Scamwatch, Business email compromise scams
- CommBank, Why payment redirection scams are getting harder to spot (19 October 2026)
- Australian Signals Directorate, How to combat fake emails
- RFC 9989 — Domain-based Message Authentication, Reporting, and Conformance (DMARC), sections 2.2, 4.7 and 11.4
- DMARC Busta, Conveyancing Sector Email Security 2026: the June 2026 scan behind the WA figures above, aggregates only
This article is general information, not legal or financial advice. The WA figures are aggregates from 154 licensed Western Australian settlement firms scanned in June 2026 using public DNS records only; no firm is named and no per-firm data is published. Quotations are from the sources listed and were checked on 12 November 2026.
