A Lookalike Email Diverted an $813,000 House Payment
The email address was one letter different from the real one. The woman paid her deposit to the account it gave. Two days later she realized, and her speed mattered.
By Siddharth ShankarUpdated October 11, 2026The AFP says a South Australian woman buying a home sent $813,000 to a fraudulent account after criminals used a near-identical email address to impersonate her conveyancer. She told her bank and police through ReportCyber two days after the transfer. About $777,000, roughly 96%, was returned in March 2024. See how to tell a real email from a fake.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Buying a home involves sending the largest payment many people will ever make, usually to a bank account given in an email. That is why criminals target the moment the details arrive.
What happened
According to the AFP, a South Australian woman buying a home sent $813,000 to a fraudulent account instead of her conveyancer's. Criminals had created a fake email address with one letter different to the legitimate business email.
She told her bank and police via ReportCyber two days after the transfer. In March 2024, $777,000 was returned. The AFP release is dated October 1, 2024, and the transfer took place in May 2023.
How it worked
No hack was involved. A near-identical email address impersonated the conveyancer and supplied new bank details. To the buyer, the message appeared to arrive in the usual thread from a trusted professional.
The recovery involved several organizations. The AFP-led Joint Policing Cybercrime Coordination Centre worked with South Australia Police, Operation DOLOS partners, the cryptocurrency exchange Binance and Pakistan's National Response Centre for Cyber Crime.
What was exposed
The release does not describe any data breach. The important facts were a transaction in progress, a professional's name and a plausible email thread. The criminals acted at the point where a large payment was about to be made.
How it ended
This is a good ending, with caveats. The $777,000 returned is about 96% of the amount sent. $505,000 was recovered from the first account, and about $300,000 had already gone to cryptocurrency, of which $272,000 was retrieved with help from Binance and the Pakistani agency. The Pakistani agency identified a suspected money mule. The wider investigation is ongoing.
A timeline of the case
The transfer took place in May 2023, and the victim told her bank and police two days later. In March 2024, $777,000 was returned. The AFP published its account on October 1, 2024, and said the wider investigation is ongoing.
The recovery took about ten months, even with the quick report. That should set realistic expectations: speed makes recovery possible, but it does not make it instant.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Amount sent: $813,000
- Returned: $777,000, about 96%, in March 2024
- Recovered from the first account: $505,000
- Moved to cryptocurrency: about $300,000, of which $272,000 was retrieved
- Reported: two days after the transfer
- Release date: October 1, 2024
Why this case matters
Recovery rates for payment redirection scams are often low because money moves quickly. This case succeeded because the victim reported within two days, banks froze funds and international partners acted. Speed was the difference.
It also shows that an email can look right and still be wrong. A single character in an address is easy to miss, especially on a phone.
What you can do
1Confirm bank details by phone on a known number
Do this before any large payment, even if the email looks normal.
2Check the sender address character by character
Look especially at the domain after the @ sign.
3Report within hours
Tell your bank and report to ReportCyber immediately.
4Be careful about what is public
Details about a property purchase can be used to time such scams. See how property records make your address public.
Why the victim's speed counted
The release says the scammer's account was frozen and $505,000 retrieved after the victim sought help quickly. Another portion had moved on to cryptocurrency, and part of that was traced and retrieved.
If you ever realize you paid the wrong account, call your bank first, ask it to start a recall and then report to police. Each hour of delay gives criminals more time to move money out of reach.
What the release does not say
The release does not say how the criminals knew the purchase was under way. For a similar US email scam in a property sale, see the fake escrow case.
Want to apply this to your own situation? These explain how to prevent identity theft, how to tell a real breach notice from a phishing message and how property records make your address public in plain language. You can also try our free email exposure check.
Sources
- Australian Federal Police: Police recover $777,000 of a victim's funds stolen in BEC scam ($813,000 sent, $777,000 returned, $505,000 and $272,000 recovered)
Frequently asked questions
How did the scam work?
Criminals used an email address one letter different from the conveyancer's to send new bank details, and the buyer paid $813,000 to the wrong account.
How much was returned?
$777,000, about 96%, returned in March 2024, according to the AFP.
Why was recovery possible?
The victim reported within two days and banks, police and international partners froze and traced funds.
How can I avoid this scam?
Confirm bank details by phone on a number you already know, and check the sender's address carefully before any large payment.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.