The Fraud Was Almost Perfect. Then Someone Checked Who Was Rostered On.

A young mother in Perth was days away from buying her first home. The money was ready, settlement was close, and an email arrived from the settlement agent with the account details for the transfer. She took it into the Westpac branch at Riverton, which is the sensible, slightly old-fashioned thing to do when you are moving $1.2 million, being every cent you have plus a loan on top. That decision is the only reason this is a story about a near miss and not about a family losing everything.

Her personal banker, Neet Kukreja, read the email and did not like the feel of it. The tone was a little different from the earlier correspondence and the urgency didn't match how these payments normally work, so instead of processing the transfer she went back through the previous messages. Two things failed to line up. The staff member named in the reply was on leave, and the sender's address carried one extra letter that nobody would notice unless they were looking for it. Eagle-eyed Kukreja rang the customer, then the branch manager, then the settlement agent, and the agent confirmed that no request for payment had been made. The agent's email account had been hacked, and whoever was inside it had been reading the thread, learning the house style and waiting for the week a large sum was due to move.

Why this matters to your business

The settlement agent in this story is a small professional services firm of the sort with a handful of staff, a shared inbox and a trust account. It did not lose a cent of its own money, and it very nearly cost a client everything she had.

Business email compromise works like this: Someone gets into an account, usually through a phished password or one reused somewhere that was later breached, and then they wait and watch. They read your invoices, copy your sign-off, work out which supplier you pay on the fifteenth, and register a domain that differs from yours by a single character. When the timing is right they send one email changing the bank details, and it looks exactly like you because most of it is you.

If a client wires money to a criminal because of an email that came out of your account, you will spend the next year explaining it to them, to their lawyer and possibly to a regulator, whoever ends up wearing the loss. Your reputation and your professional indemnity cover sit inside that mailbox.

Three things to actually do this week for reassurance

1. Turn on multi-factor authentication for your business email today if it is not already on. Every version of this attack starts with someone else being able to log in as you, and this is the control that stops it.
2. Make a rule that bank details never change on the strength of an email, and tell your clients and suppliers in writing. Any change gets verified by phone on a number you already had on file, never the number in the message, and a line in your invoice footer means your customers know to ring you without feeling awkward about it. See the suggested email text at the very bottom of this page for this.
3. Look at your mailbox's forwarding rules and connected apps. People who get in almost always leave a quiet rule behind that copies or hides certain messages so you never see the replies going back and forth, and checking takes about two minutes.

By the numbers

• Business email compromise fraud with a financial loss: 15% of the top cybercrimes reported by businesses, with a further 19% for email compromise where no money was lost [ASD Annual Cyber Threat Report 2024-25]
• Cost of cybercrime to the average Australian small business: $56,600 AUD per incident, up 14% [ASD Annual Cyber Threat Report 2024-25]
• Small and medium businesses exposed to a scam in the past year: 82%, with 1 in 5 reporting an actual cyber incident [Australian Banking Association, reported by Cyber Daily, 1 September 2026]

Sources

• Buyer nearly loses $1.2m after fake settlement email (Cyber Daily)
• Buyer nearly loses $1.2m after fake settlement email (Smart Property Investment)
• Annual Cyber Threat Report 2024-25 fact sheet for businesses and organisations (ASD, October 2025)
• 4 in 5 SMEs report being exposed to scams (Cyber Daily, 1 September 2026)