Australia’s overheated property market has become a target for hackers

The scammers’ first email to Kelly and her husband arrived in the small hours of the night, when they were sleeping.

“Due to the ongoing bank audit on our account,” the email read, “please see attached our subsidiary trust account details for the payment of $25,000 deposit.”

The email address looked legitimate — it was the real estate agent’s.

Kelly and her husband, both young engineers and “tech savvy”, were at the pointy end of buying a house in Western Australia.

And so the next day, Kelly’s husband sent their hard-earned home deposit to a scammer, and never saw that money again.

Property settlement scams are becoming more common as house prices rise and scammers turn their focus to the large and often lightly protected sums of money that prospective buyers are transferring to the trust accounts of real estate agents and conveyancers.

Known as “payment redirection”, it’s part of a category of scams called “business email compromise”, where criminals hack an employee’s email account and then, impersonating that employee, send a payment request, substituting their own bank account details.

The victims tend to be individual home buyers or small business owners, for whom the consequences of a lost deposit are devastating.

Six months on, Kelly and her husband haven’t yet told their parents or their friends that they got scammed.

“It’s been very, very stressful,” Kelly said.

Real estate scams on the rise in 2022

According to national figures, plenty of others are falling for the scam too.

The Australian Competition and Consumer Commission’s (ACCC) Scamwatch receives on average about two reports per week of payment redirection scams in real estate.

March 2022 saw 14 reports alone — the highest figure in 15 months.

“Twenty-five reports were made this year, which is an increase of 25 per cent on the same period in 2021 and losses this year are up 186 per cent to $1.8 million,” an ACCC spokesperson said.

NSW, which has the nation’s most expensive property market, accounts for three-quarters of the $4.3 million lost through this scam around the country from January 2021 to the end of March 2022.

Buyers aren’t the only parties being targeted says Chris Tyler, chief executive officer of the NSW division of the Australian Institute of Conveyancers (AICNSW).

Fraudsters have even used payment redirection to scam the stamp duty a conveyancer had intended to transfer to state revenue, he says.

“Because property transactions are so high in value, all the parties in the transaction are being targeted: The real estate agents, the mortgage brokers, the conveyancer.

“Half the time the deposit could be a couple hundred thousand dollars.”

 

‘The value of houses has gone up so much’

The Sydney law firm of Clyde & Co’s cyber incident response team handles multiple business email compromise (BEC) incidents every week.

“We’ve noticed an uptick over the last three or four months,” said Reece Corbett-Wilkins, a member of the response team.

Though less “sexy” than ransomware, BEC is just as big a problem, he says.

Clyde & Co saw a 150 per cent increase in reported BEC incidents from 2018 to 2021.

In some cases, the losses are huge — a client of a client recently misdirected a $750,000 transaction.

 

“The value of houses has gone up so much. There’s a lot of cash flowing through the real estate sector,” Mr Corbett-Wilkins said.

The nature of real estate transactions, involving many parties and often not much cybersecurity, makes them a favourite target of scammers.

“These attacks are super sophisticated,” he said.

“You’ve got this combination of factors that all come together and you think, well, this is ripe for the picking.”

Scam continues after money transferred

After Kelly’s husband sent the scammers the $25,000, the scammers stayed in touch via email, maintaining the charade and allaying suspicion for long enough for the transfer to clear.

“I will issue a copy of our trust receipt once the funds hit our account,” they wrote back to the couple.

At the same time, the scammers were emailing the real estate agent, using an address that closely resembled Kelly’s husband’s, to assure them the home deposit funds were on their way.

The couple only reported they had been scammed a week later, when the real estate agent called to ask them for the deposit.

By then, the money had been transferred to another Australian bank account, and from there to a cryptocurrency exchange, where it was converted to Bitcoin.

“That’s where our bank stopped — they said we can’t pursue it any further,” Kelly said.

“We’re still waiting for the police — it took them several months to say they’re even looking into it.”

Where are the scammers located?

The FBI has coordinated several global operations, along with national police agencies like the AFP,  to disrupt BEC schemes.

Most of the arrests have been made in the United States and Nigeria.

A 2018 report by the cybersecurity company Crowdstrike also pointed to cyber criminals in Nigeria, including the “formidable criminal organisation” known as “Black Axe”.

According to the report, Black Axe “has developed a hierarchical, inter-state organisation while at the same time retaining cult-like tendencies” and its gangs are “involved in a multitude of organised crime ventures such as running prostitution rings, human trafficking, narcotics trafficking, grand theft, money laundering, and email fraud/cybercrime.”