It used to be enough to install an alarm and lock the door of a business so you could sleep well at night knowing intruders couldn\u2019t get in.<\/p>\n
But as an increasing number of buyers, real estate agents, conveyancers and solicitors are learning, scammers are not only opening their digital doorways but stealing vast sums of money from right under their noses.<\/p>\n
The ACCC (Australian Competition and Consumer Commission) Targeting Scams Report<\/em> released this month found Australian businesses lost $227 million to payment redirection scams in 2021, a 77 per cent increase compared to 2020.<\/p>\n Recouping funds is rare and the experts warn everyone can assume there is a scammer ready to redirect funds from legitimate transactions, into their own bank accounts.<\/p>\n Rachel Falk, CEO, CSCRC<\/p>\n<\/div>\n \u201cIt sounds very paranoid but you do have to be paranoid,\u201d Cyber Security Cooperative Research Centre CEO and one of Australia\u2019s foremost cyber security experts, Rachael Falk told Australian Property Investment Magazine<\/em>.<\/p>\n \u201cNowadays what I would be doing with a real estate agent or a law firm is ringing them up and I\u2019d also make sure I ring their number, not the number on an invoice emailed to you, because that could be hacked too,\u201d Ms Falk said.<\/p>\n In a payment redirection scam, scammers impersonate a business or its employees via email and request an upcoming payment be redirected to a fraudulent account.<\/p>\n \u201cProperty transactions, by their very nature, are for many of us are the largest single biggest transaction we\u2019ll ever do in our lives so it really matters where you\u2019re sending money to and making sure it arrives safely,\u201d Ms Falk said.<\/p>\n \u201cOften deposits are sent to the lawyer to be held in trust and a hallmark of being scammed is if there\u2019s a sudden change in bank details.<\/p>\n \u201cEven if it\u2019s not a property transaction you will suddenly find that the details of the supplier, the vendor you\u2019re dealing with, or a third party, will change.\u201d<\/p>\n Nat Anderson, iDCare\u2019s Support Team \u2013 Cyber First Aid Identity Security Operation Centre representative, is an expert in identity theft and cyber security.<\/p>\n \u201cFrom an identity point of view, real estate agents are a very attractive target to scammers, both for the value of material they hold on individuals such as rental applications, and also for the value of potential transactions that may be susceptible to business email compromise (BEC) and payment redirections,\u201d he said.<\/p>\n An iDCare client, \u2018Bob\u2019* (not his real name) was in the process of purchasing a property.<\/p>\n Nat Anderson, IDCARE, Support Team – Cyber First Aid, Identity Security Operation Centre<\/p>\n<\/div>\n \u201cHe emailed his broker for the banking details and received an email back (within the ongoing email thread), with bank account details to transfer the stamp duty of $15,000.<\/p>\n \u201cHe duly paid the money and it wasn\u2019t until speaking to the broker later that day that his broker said no email had been received and the bank account details were not his.<\/p>\n \u201cIt turned out Bob\u2019s email had been compromised and the scammers were aware of the impending transaction and struck at the appropriate time, but luckily in this case the banks were alerted and the transaction blocked,\u201d Ms Anderson said.<\/p>\n Unfortunately, that\u2019s not always the outcome.<\/p>\n John (not his real name) is another iDCare client who owns a strata management company.<\/p>\n \u201cHe had an ongoing relationship with an engineering firm and had previously made regular payments.<\/p>\n \u201cThe engineering firm sent an email to the strata accounts department informing them of a change to their banking details.<\/p>\n \u201cThe accounts department paid the next invoice of $200,000 to the new account. It wasn\u2019t until a week later when the engineering firm sent a reminder invoice that the scam was discovered.<\/p>\n \u201cJohn had cyber security insurance however the policy specifically excluded business email compromise and the money was unable to be recovered,\u201d Ms Anderson said.<\/p>\n So, who is at fault?<\/p>\n Farrah Motley, Legal Principal, Prosper Law<\/p>\n<\/div>\n \u201cThe only time when the business is actually liable for business email compromise is if they\u2019ve been negligent in protecting their business systems,\u201d explained Prosper Law legal principal Farrah Motley.<\/p>\n \u201cEven more so if it\u2019s occurred before and they don\u2019t do anything and it happens again and again.<\/p>\n \u201cSo, they might have had insufficient password protection, lack of antivirus software, saving passwords that are easily accessible, using insufficient cyber security techniques; do they have two-factor authentication? No; Do they have an external agency monitoring their systems? No.<\/p>\n \u201cIt\u2019s like there\u2019s a chain of failure and they\u2019re almost acting like you don\u2019t care, then you\u2019ve got a problem,\u201d Ms Motley said.<\/p>\n Once a problem is identified, time is of the essence.<\/p>\n \u201cThere\u2019s often quite a delay between when the problem actually happens and when someone\u2019s taking the time to investigate.<\/p>\n \u201cEveryone tends to spend a long time blaming each other but by that time, the digital trail that might allude to who was at fault, or whose systems have been compromised, is often lost,\u201d Ms Motley said.<\/p>\n \u201cAs an example, Outlook is usually one of the culprits in the chain of compromise.<\/p>\n \u201cIt might have a retention rule that says, we\u2019re going to keep the backend email records for 30 days, or whatever it is, and if you don\u2019t jump on to that quickly, that 30 days has expired, and then you\u2019ve lost the ability to get a conclusive answer, so, you really have to jump onto the investigation quickly,\u201d she said.<\/p>\n \u201cBecause it\u2019s an international problem, once the money\u2019s gone, that\u2019s it.\u201d<\/p>\n Masks and spoofs<\/strong><\/p>\n It\u2019s not always money that\u2019s at stake.<\/p>\n A franchise office of a major real estate organisation was hit by a ransomware attack last year that was brought to iDCare\u2019s attention. As part of the attack, the ransomware group infiltrated sensitive data from the real estate office and published it on the dark web.<\/p>\n \u201cDetails published included sensitive corporate information such as the entire internal password collection of all staff along with hundreds of applications for rental properties with full name, email, phone numbers, current and previous addresses, bank details and other personal identifiable information (PII) exposed.<\/p>\n \u201cAside from the cost of trying to regain the IT network, the organisation also had to manage the data breach, with the associated cost and reputational damage,\u201d he said.<\/p>\n On the occasion a business is not negligent, there are two techniques that could be at play.<\/p>\n Spoofing involves scammers finding a business email online and mimicking it closely.<\/p>\n \u201cIt might have a dot in the wrong place, or an extra letter somewhere and they\u2019re pretending to be the agent and a customer doesn\u2019t pick up on it,\u201d Ms Motley said.<\/p>\n Alternatively, it could be masking.<\/p>\n \u201cThere might be a random email address from Russia and then they put a mask over it and it looks like the legitimate business email.<\/p>\n \u201cYou can\u2019t tell unless you go into the email coding that it\u2019s not actually coming from that email address.<\/p>\n \u201cIn that case it\u2019s not the business\u2019 fault and it\u2019s not the customer\u2019s fault so neither has legal rights against the other but unfortunately no one\u2019s at fault except the scammer and nobody can find the scammer,\u201d Ms Motley explained.<\/p>\n Nowhere to turn<\/strong><\/p>\n CSCRC\u2019s Ms Falk says the law is not necessarily on the consumers\u2019 side.<\/p>\n \u201cUnfortunately, as a buyer, the current condition is you need to satisfy yourself that you\u2019re paying the money to the right entity.<\/p>\n \u201cMy advice to people is take the time, check with the real estate agent before you pay them, ring their front office up but not the number on the invoice sent to you, because again, that could be hacked; make sure you\u2019ve got all the details and speak to someone there who knows the accountant or finance person.<\/p>\n \u201cMake sure your settings are up to date on your email, make sure you have up to date antivirus, that you do check emails that come into you, that you do check the sender\u2019s address and other giveaway clues, check punctuation, check spelling,\u201d Ms Falk said.<\/p>\n \u201cRemember in these kinds of things email is not your best friend, be suspicious of emails with bank details but be super suspicious of emails with bank details that have changed quickly and unexpectedly,\u201d Ms Falk advised.<\/p>\n Ms Motley said since covid hit, the incidence of BEC has \u201cexploded\u201d.<\/p>\n \u201cIt\u2019s almost scary how easy it is.<\/p>\n \u201cI do think the government could be doing more to educate people and really get into people\u2019s faces about this.<\/p>\n \u201cOf all the people I know in my professional capacity who might have experienced business email compromise, it might not be significant amounts of money, but it is significant to them and there\u2019s just no recourse, there\u2019s no-one there to help you.\u201d<\/p>\n Do you think you\u2019ve been scammed?<\/strong><\/p>\n Source: Australian Competition and Consumer Commission<\/em><\/p>\n Prevention<\/strong><\/p>\n![\"Rachel](\"https:\/\/www.apimagazine.com.au\/media\/misc\/Rachel-Falk-CEO-CSCRC.jpg\")
<\/p>\n![\"Nat](\"https:\/\/www.apimagazine.com.au\/media\/misc\/Nat-Anderson-IDCare.jpg\")
<\/p>\n![\"Farrah](\"https:\/\/www.apimagazine.com.au\/media\/misc\/Farrah-Motley-Legal-Principal-Prosper-Law.jpg\")
<\/p>\n\n