The property transfer fraud that starts inside a real email thread.
Why estate agencies and conveyancers are targeted, and the one control that stops it.
This is the most profitable fraud in South African property, and almost nothing about it looks like an attack while it is happening. There is no suspicious attachment, no misspelled domain and no obvious warning sign. That is the design.
How it actually works
An attacker compromises one mailbox in the chain, most often at the agency or the conveyancer, then reads quietly for weeks. They are not looking for anything to steal yet. They are learning the language of the transaction, the names, the timing and the amount.
When a transfer or deposit is due, they send the buyer new banking details from a genuine account, in a genuine thread, at exactly the right moment. The buyer pays. The money is gone within minutes, and by the time anyone in the chain compares notes it has moved through several accounts.
Why the agency, when the conveyancer holds the money
Because the agency is usually the softest entry point into the conversation and the most trusted voice in it. Buyers act on what their agent tells them.
An attacker does not need access to the trust account to redirect a payment. They only need access to the thread in which the payment is being discussed. That is a much lower bar, and it is why the agency is targeted even though the money sits somewhere else.
The one control that stops it
Telephone verification of any banking detail, on a number obtained independently before the transaction began, and a written warning to every buyer at the start that banking details will never change by email.
Both are process controls rather than technical ones. Together they defeat an attack that no email filter alone can reliably catch, because the email is genuine, sent from a real account, by someone who has been reading the thread for a month. There is nothing for a filter to object to.
The detail that makes it work is the phrase obtained independently. A number in the signature of the email asking you to verify is not verification.
The signal that a mailbox has been compromised
A mailbox rule automatically files or forwards incoming mail. Attackers create one immediately after compromising an account, so that replies from the real party are hidden from the account owner while the fraud runs.
An unexplained new rule is one of the clearest signals of compromise available, and it is specifically worth monitoring for. It is also invisible to the person whose account it is, which is precisely why somebody else has to be watching.
What POPIA adds
An agency holds identity documents, income verification, bank statements and contact details for buyers, sellers and tenants. That is a substantial concentration of personal information, and Section 19 requires documented access control, encryption, tested backup and an incident response process. A breach involving FICA documentation is a serious one.
What to put in place
Enforced multi-factor authentication and monitoring for mailbox rule changes. Email security that flags a first-ever banking change. Encrypted devices for agents working from cars and show houses. Independent Microsoft 365 backup. Dark web monitoring. And awareness training built around this scenario specifically, rather than phishing in the abstract.
More of what that looks like for an agency is on the real estate and property page, or start with the free health check.
A free dark web scan
and thirty minutes.
We scan for your company email addresses, passwords and customer data in the places stolen and leaked data gets traded, then spend thirty minutes walking you through what came back and what it actually means. No pressure, no jargon, no obligation. You keep the report either way.
Worried about what it takes to move?
Changing IT provider is the single biggest reason businesses stay somewhere they have outgrown. We plan the move around your working week, and we help carry the cost of getting across. Ask us how that works when we speak.