AI raises the stakes as property payment scams grow

Artificial intelligence is making property payment scams more convincing, more personalised and harder to identify, placing fresh pressure on real estate businesses to strengthen the way financial instructions are communicated and verified.

The warning comes as payment redirection fraud continues to cause significant losses across Australia. The National Anti-Scam Centre recorded $166.8 million in combined reported losses to payment redirection scams in 2025, up 9.3 per cent on the previous year. Across all scam categories, reported losses reached $2.18 billion.

Property transactions present an attractive target. Large sums move between buyers, sellers, agents, conveyancers and financial institutions, often under strict deadlines. A criminal only needs to enter that chain at the right moment and convincingly redirect a payment.

AI is removing the old warning signs

The basic method is not new. In a business email compromise attack, a criminal may gain access to a genuine email account or create a near-identical address, then impersonate an agent, solicitor or conveyancer.

Fake instructions are introduced when a deposit or settlement payment is due, directing the victim to an account controlled by the offender.

What has changed is the quality and speed of the deception.

Scamwatch says AI can be used to create personalised messages, fake documents, cloned voices and convincing digital identities.

The Australian Cyber Security Centre has also warned that polished spelling and grammar can no longer be treated as proof that a message is genuine. AI tools allow criminals to produce professional communications at scale and adapt their story when challenged.

For property professionals, that means a familiar voice on the phone, an accurate email signature or a message containing genuine transaction details cannot be accepted as verification on its own.

Confidence is not protection

PEXA-commissioned research released in 2025 found 97 per cent of recent and prospective property buyers failed to identify dangerous scam indicators in property transaction emails.

About 40 per cent of respondents indicated they would transfer money after receiving a fraudulent settlement email.

The study also found only one in three buyers used a secure app to exchange information during settlement, while email remained the most common channel for sending bank details.

The research involved 1,030 Australians, including 474 people who had bought a property in the previous year and 556 who intended to buy within the following 12 months.

The figures expose a gap between confidence and behaviour. Recognising that scams exist is not enough when a convincing request arrives during a time-sensitive transaction.

Older Australians may face disproportionate financial harm. The National Anti-Scam Centre reported that people aged 65 and over represented about 17.1 per cent of the Australian population but accounted for 26.5 per cent of losses reported to Scamwatch in 2025.

For a seller relying on property proceeds to fund retirement, aged care or family support, a redirected payment can be devastating.

Agents are part of the security chain

Settlement security cannot sit solely with banks and conveyancers.

Agents are often one of the most trusted and visible people in the transaction, which makes agency names, email accounts and communication patterns valuable to impersonators.

Every agency should have a clear protocol for deposits, account details and any request to change payment instructions.

At a minimum, agencies should:

• tell clients at the beginning of a transaction how payment instructions will be provided
• state clearly that a change of bank details will never be confirmed by email or text message alone
• verify any new or amended account details through a separately sourced, trusted phone number
• use multi-factor authentication on email and other systems containing transaction information
• train staff to escalate urgent, unusual or confidential payment requests
• record when and how payment details were independently verified
• avoid placing unnecessary personal or transaction information in insecure channels.

Australia's Confirmation of Payee system provides another checkpoint by comparing the account name, BSB and account number before a payment is sent.

Australian Payments Plus reported in July 2026 that the service had been used more than 150 million times and was live across more than 100 financial institutions.

It is an important safeguard, but it does not replace direct verification. A mismatch or warning should stop the transaction until the intended recipient has been contacted using details obtained independently of the message requesting payment.

Speed matters after a suspected breach

If money may have been sent to a fraudulent account, the bank should be contacted immediately.

The incident should also be reported through ReportCyber and Scamwatch, while compromised passwords must be changed and affected accounts secured.

Businesses may also need to assess whether a compromised account has created obligations under the Notifiable Data Breaches scheme.

The industry's challenge is no longer simply teaching people to look for spelling mistakes or suspicious formatting. AI can produce communications that look and sound legitimate.

The safer response is to build verification into the transaction so that no email, text message or phone call can redirect a major payment without an independent check.

In property, trust remains essential. It can no longer be the only control.

Image credit: Real Estate Today