Business email compromise is an email scam that uses a trusted person’s identity to redirect money or obtain information. For mortgage brokers, it can put a client’s deposit or the brokerage’s commission payment into a scammer’s account. Confirm bank details through a separate, trusted channel before anyone transfers funds. If money has already been sent, contact the bank immediately.
What Business Email Compromise is
Business email compromise (BEC) exploits trust in a business conversation. A scammer sends instructions that appear to come from a broker, conveyancer, supplier or colleague. The message asks the recipient to make a payment or change account details.
Email account compromise means someone has gained unauthorised access to a mailbox. The attacker can read correspondence and send messages from that account. Stolen sign-in details, including those collected through phishing, can give them access.
BEC can also use impersonation without a mailbox takeover. The sender might copy a display name or use a domain with a small spelling change. The Australian Signals Directorate’s business email compromise guidance covers both compromised accounts and impersonation.
Phishing is one way to steal access. BEC describes the fraud that exploits the apparent business relationship. A payment request can therefore be fraudulent even when it has no suspicious link or attachment.
How BEC Hits Brokers and Their Clients
BEC can redirect a property payment, a commission payment or an ordinary supplier invoice. A familiar message thread can make the changed instructions look credible. Scamwatch’s payment redirection guidance includes a home-deposit example where the scammer substitutes their account for the conveyancer’s.
In a hypothetical brokerage example, a client expects instructions for a $60,000 deposit. An email arrives in the existing conversation with replacement bank details. The client recognises the names and transfers the money. The conveyancer later asks why the deposit has not arrived.
The same method can affect settlement funds. A request to change where money goes needs independent confirmation, even when the message correctly names the property and settlement parties.
For commission payments, a scammer might impersonate a broker and ask the aggregator to update the brokerage’s receiving account. Invoice fraud can instead change the bank details on a genuine supplier invoice. Chief executive impersonation, often called CEO fraud, uses an owner’s apparent authority to pressure staff into paying.
Treat these as warning signs:
- Bank details change unexpectedly, particularly just before payment.
- The sender demands urgency or asks staff to bypass approval.
- The reply address differs from the address you normally use.
- A client receives payment instructions you did not send.
Good spelling and a familiar signature do not confirm who sent a message. An unchanged email address also cannot prove that its owner still controls the mailbox.
Prevention and Protection
Preventing BEC needs both protected mailboxes and a payment process that checks who authorised the transfer. Two-factor authentication reduces account takeover risk. A separate call-back check helps catch a fraudulent request from an account that is already compromised.
Check Bank Details Before Payment
Use the same process for new payment instructions and changes to existing details:
- Pause the payment or account update when the instructions arrive.
- Find the recipient’s phone number in a trusted record or their official website. Avoid the number supplied in the suspect message.
- Call the intended recipient and confirm the account details and payment purpose.
- Record who confirmed the instructions and require a separate approver where your payment process calls for one.
The ASD email attacks prevention guide recommends verified phone calls and approval processes for payment changes. Replying to the same email leaves the check inside a channel the scammer may control.
Warn clients about this process before they need to pay. Tell them to call the party receiving the money using independently verified contact details. Ask them to pause if an email announces a last-minute account change.
Protect and Review Mailboxes
Require two-factor authentication for business email and protect recovery access. Use a unique passphrase where a password is required. Include shared-mailbox access in your administrator’s review.
Review forwarding and inbox rules for unfamiliar destinations or rules that hide messages. Unexpected sign-ins, missing correspondence and unexplained sent messages also need investigation. The ASD email attacks emergency response guide describes these account-security checks.
Ask your email administrator to configure domain authentication and review suspicious messages. These controls help reduce impersonation. Keep independent payment checks in place because a genuine mailbox can still be taken over.
If It Happens
Contact the bank immediately if anyone has paid the scammer or exposed banking details. Start mailbox containment at the same time where another staff member or IT provider can help.
- Call the paying bank’s fraud team through its official contact channel. Ask whether it can stop or recover the transfer. Give it the transaction reference and receiving account details. Recovery is not guaranteed.
- Report the crime through ReportCyber. Keep the report reference with the bank’s case number and preserve the original email and payment records.
- Secure the affected mailbox with your administrator. Change the password, revoke other sessions and restore legitimate recovery details. Remove unauthorised forwarding rules and application access, then enable multi-factor authentication.
- Warn affected clients and payment partners through a trusted channel. Tell them which instructions to disregard and how to confirm genuine payment details.
- Assess what personal information the attacker could access. Include attachments and earlier correspondence, even if no money was lost.
For entities covered by the Notifiable Data Breaches scheme, notification depends on the likely harm and the effect of remedial action. An eligible breach generally involves likely serious harm that the entity has not prevented. The Office of the Australian Information Commissioner’s response guide explains assessment and notification requirements. Covered entities must take all reasonable steps to complete a suspected eligible-breach assessment within 30 calendar days. Notify affected individuals and the regulator as soon as practicable when required.
Before normal email and payment handling resumes, have your administrator confirm that unauthorised access and rules have been removed. Confirm payment instructions separately with affected parties, then record the control that failed and who will correct it.
