Changed bank details are among the most ordinary-looking emails a legal or conveyancing practice receives, and that ordinariness is exactly what payment redirection fraud relies upon. A request to update an account for a refund, a deposit or the proceeds of a sale rarely arrives with any visible warning, and the person who opens it is usually managing several matters at once, working to a settlement date and trying to remain responsive to a client. As our previous article, The moment a property settlement scam succeeds, and how to catch it sooner, explained, the loss occurs in the gap between a fraudulent instruction arriving and someone verifying it. This article focuses on that gap, and on what staff should do when a client’s bank details in an email look slightly different from the details the practice already holds.

What should staff do first when a client's bank details change by email?

Staff should stop and take no action on the changed bank details until the client has confirmed them by telephone, using a number already held on the matter file rather than one supplied in the email. No payment should be prepared, and no record should be updated, until that call has taken place. The sequence below turns that principle into a routine.

Pause the matter. Do not prepare, approve or release a payment using the new details, and do not update the bank details recorded in the practice management system.
Call the client on a known number. Use the number recorded at onboarding or in the engagement letter, and never a number, link or contact detail from the email itself. Replying to the email to ask whether it is genuine simply returns the question to the person who may have sent it.
Confirm the details aloud. Read back the account name, BSB and account number, and ask the client to explain why the details have changed.
Record the verification on the file. Note the date, the time, the person who spoke with the client and the number that was called, so the check can be demonstrated later.
Obtain second approval. A second member of staff should review the verification record before the changed bank details are used for any payment.

Both outcomes in the cases described previously turned on this routine. One purchaser’s client queried a change in bank details after receiving a hacked email demanding $75,000 be paid to a new account, and that single call meant most of the money was frozen and recovered. In a matter recorded by the Legal Practitioners’ Liability Committee, a firm instead acted on fraudulent instructions and paid more than $600,000 held on trust into an account controlled by criminals, discovering the fraud only weeks later.

How can staff recognise bank details that look slightly different?

The most reliable sign is any difference from the details the practice already holds, however small, because a convincing email is not evidence that an instruction is genuine. The following checks help staff identify a suspicious message before the call is made, although they never replace the call.

The full sender address. Staff should look beyond the display name and read the complete address, since criminals register domains that differ from the real one by a single character.
A new participant or reply address. An unfamiliar person joining an existing thread, or a reply-to address that differs from the sender, warrants the same scrutiny as a changed account number.
Details that do not fit the client. An account name that does not match the client or their entity, or a bank that differs from earlier correspondence, should prompt questions.
Timing and pressure. Changes that arrive close to settlement, or that stress urgency or discourage a phone call, are consistent with the pattern the Australian Signals Directorate describes in property-related business email compromise.

A message sent from a genuinely compromised mailbox will pass every sender check, because it comes from the real address. For that reason, the telephone call, rather than inspection of the email, is the control that carries the weight.

Why should a second person approve every change to bank details?

A second approver ensures that no single member of staff, however experienced, is the only barrier between a fraudulent instruction and the movement of funds. Staff handling several settlements in a day are working under time pressure, and a two-person rule removes the expectation that any individual will catch every anomaly alone. The approval should apply to every change to payee details, including those affecting trust account payments, and the verification record from the earlier step gives the second approver something concrete to review rather than a general assurance.

What should a practice do if changed bank details have already been acted on?

The practice should contact its bank immediately to request a recall of the payment and treat the first few hours as the period in which recovery is most likely. In the cases examined in our previous article, the difference between a recovered loss and a permanent one was rarely the sophistication of the fraud, and almost always the speed of detection and reporting. The following steps should follow without delay.

Contact the bank that sent the payment and ask for it to be recalled.
Report the incident through ReportCyber, the Australian Government’s cybercrime reporting service.
Notify the practice’s professional indemnity insurer and any relevant regulator or liability scheme, in line with its obligations.
Telephone the client on a known number, as their own email account may also be compromised.
Preserve the original emails and reset the credentials of any mailbox that may have been accessed.

The Legal Practitioners’ Liability Committee also cautions against assuming that an overdue transfer is simply delayed, since a few days of waiting has repeatedly given criminals the window they need to move funds beyond recovery.

Setting expectations with clients before settlement

Verification is far easier when the client has been told to expect it. The engagement letter is the natural place to state that trust account details will never change by email, and that any message appearing to alter payment instructions should be checked by telephoning the practice on a known number. Practices that confirm a client’s bank details by telephone at onboarding also create a verified reference point against which any later change can be measured. Where a transaction begins with an agent, platforms such as Securexchange allow bank details to be exchanged inside a verified workspace rather than by email, which removes one of the most exposed steps from the process.

Making the verification call routine

A five-minute call is a small cost when set against the losses described above, and it becomes easier to make when it is simply how the practice operates rather than a response to suspicion. Practices that document the steps, train every member of staff on them and apply them to every changed bank detail, regardless of how legitimate the email appears, remove the judgement call that fraudsters depend upon.

This Cyber Security Awareness Month, build the habits that keep your practice and your clients secure. In our webinar, The checklist trap: Why top firms build a security culture instead, cyber security leader Chirag Joshi joins InfoTrack’s Jerome Boutelet to discuss business email compromise, settlement redirection and the practical steps smaller firms can take without a dedicated security team.

About Vishal Duggal

Vishal Duggal is a technology leader with 20+ years of experience, overseeing IT & Security operations across four geographies. He partners with leadership teams to turn technology strategy into outcomes, covering cloud, infrastructure, cybersecurity, and IT service management, while leading teams through change and maximising ROI.

{{ index + 1 }}
{{ track.track_title }} {{ track.track_artist }} {{ track.album_title }} {{ track.length }}

{{list.tracks[currentTrack].track_title}}{{list.tracks[currentTrack].track_artist && typeof sonaar_music.option.show_artist_name != 'undefined' ? ' ' + sonaar_music.option.artist_separator + ' ' + list.tracks[currentTrack].track_artist:''}}

{{classes.speedRate}}X