An urgent alert to the WA real estate and settlement industries, as well as to buyers and sellers of properties, has been issued by Consumer Protection after three recent cyber-attacks have resulted in almost $590,000 being stolen in property-related scams.

In the worst case, an 83 year old property buyer in Perth’s western suburbs has lost $557,000 after the fraudsters intercepted email communications between her son, who was acting on her behalf, and their settlement agent. It is not yet known if the scammers hacked into the email account of the buyer’s son or the settlement agent or both.

On 8 September 2017 the buyer’s son received an email from who he thought was his mother’s settlement agent asking him to deposit the final payment on a property amounting to $558,000 into a new bank account which he did. When the fraud was discovered, he contacted the bank involved but it was too late, all but $1,000 had already been withdrawn from the account. The buyer may face further financial losses as the settlement could not go ahead as planned.

In the second case, two clients of another western suburbs’ settlement agency lost a total of $25,658 after the agency’s email account was hacked in late August 2017 and three payments towards property purchases from the clients were directed to a different bank account set up by scammers.

In the third case, a western suburbs’ real estate agent/property manager had her email account hacked on 13 September 2017 and three prospective tenants received emails from scammers purporting to be the agency. The tenants had already been told by the agent that their rental applications had been successful and the scam email requested them to deposit their bond payments into a new bank account. A total of $7,300 had been transferred to the bank account before the scam was discovered. Luckily this scam was detected early because the property manager’s father was one of the tenants who received the email and he became suspicious.

Officers from Consumer Protection’s Property Industries Branch and WA ScamNet are investigating all three incidents. The Australian Cybercrime Online Reporting Network (ACORN) and the WA Police Major Fraud Squad have been notified. It is not clear if the three incidents are linked but it appears they have all been carried out by overseas criminals.

Commissioner for Consumer Protection David Hillyard said there is now an urgent need for everyone involved in property transactions in WA to be on high alert.

“Buyers, sellers and tenants need to double check any email purporting to be from their real estate or settlement agent requesting funds be sent to a bank account,” Mr Hillyard said.

“As the scammers could have hacked into the client’s or the agency’s email server, it may appear genuine so we recommend that the change is confirmed with a phone call to the agency’s previously known number to verify if the request is authentic. Don’t reply to the email or use any numbers provided in the email as you could be communicating with the scammers.

“The same applies to agents, as clients’ email accounts could have been hacked and payments may be inadvertently diverted to the hacker’s account.

“For the property industry, it is imperative that all real estate and settlement agencies use the highest possible security software to protect the integrity of their computer systems and email servers.

“It’s believed the hacking may have occurred as a result of accessing email accounts via public Wi-Fi and consumers and industry professionals are cautioned about the dangers of using your email on open networks such as these when arranging important transactions.

“Regular changing of passwords for email and bank accounts and independent verification of requests for changes to bank or contact details should be normal practice, especially in wake of these recent cases. This advice really applies to all businesses, not just the property industry.

“With large amounts of money often involved, property transactions are always going to be a lucrative target for scammers who will attempt to intercept the payments, so we all need to exercise extreme vigilance.

“Already one elderly member of our community has lost a substantial amount of her life’s savings to these cruel criminals and others have suffered losses as well, so we need to ensure that emails requesting payments be made to a different bank account are treated with suspicion and these requests need to be independently verified and come under increased scrutiny.”

Cyber-attacks and scam losses should be reported to Consumer Protection by email wascamnet@dmirs.wa.gov.au or by calling 1300 30 40 54.

<ENDS>

Media Contact: Alan Hynd, (08) 6552 9248 / 0429 078 791 / alan.hynd@dmirs.wa.gov.au