The invoice scam that empties settlements and aged care deposits

This is the scam that takes a house deposit, a settlement, or the money set aside for a parent's aged care room. In Australia it goes by the name payment redirection, and it cost people here $166.8 million in 2025 — the second-largest category of scam losses in the country, behind investment scams and ahead of romance, phishing and remote-access scams.

What makes it different from most scams is that it does not need to find you. It waits until you are already about to move a very large sum, and then it takes all of it.

The case that shows why the usual advice fails

Scamwatch publishes an account from a couple who lost more than $800,000 while finalising a property settlement. In their own words: "The email came from my solicitor's legitimate email address."

They went on to explain that the bank details in it were wrong without their knowledge — and that the confirmation email they later received, apparently from their legal team acknowledging the funds, had been intercepted too.

Look at what that single case breaks:

• "Check the sender's address." It was the solicitor's real address. The firm's mailbox had been compromised, so there was no misspelling to spot.
• "Does it look like their other emails?" It arrived inside the existing conversation, with the right signature, the right tone and the right timing.
• "Wait for confirmation." The confirmation arrived. A criminal wrote it.

Scamwatch adds one more, and it is the one that catches careful people: if you reply to the email to query the account details, the scammer replies and explains the change. Verifying by email means verifying with the criminal.

Almost nobody spots it — including the confident

You may be reading this thinking you would notice. Nearly everyone does.

PEXA, the platform that handles most property settlements in Australia, showed mock settlement emails to more than a thousand people who had either bought a property in the past year or were about to. 97% failed to spot the scam markers. Four in ten said they would have transferred the money.

The finding worth sitting with is this one: the people who were most confident in their ability to spot a scam were more likely to say they would have paid — 41%, against 33% of those who admitted low or no confidence.

The version that never claims anything changed

Almost every warning about this scam describes the same thing: an email saying the bank details have changed. That pattern is real, and it is worth knowing. But the most expensive version never claims anything changed, because it does not have to.

When you buy a house, you have never seen your conveyancer's trust account before. When you pay an aged care deposit, you have never seen that provider's account. When a builder sends the first progress invoice, there is no earlier invoice to compare it with.

So the criminal does not need a story. They simply supply the details. There is nothing to notice, because there is nothing to compare it against.

There is nothing wrong with that email. That is the point. It is polite, it is expected, it uses your name and the right address, and it carries a real deadline. The only thing wrong with it is the account number — and no amount of reading will tell you that.

The aged care deposit nobody writes about

Nearly all the public warning about this scam is aimed at home buyers. There is a second Australian life event that puts families in front of exactly the same danger, and it gets almost no attention at all.

A refundable accommodation deposit — the lump sum for a room in residential aged care — commonly runs from around $300,000 to over $1 million, with a national median somewhere in the $400,000–$575,000 range depending on the source. Providers can charge up to $750,000 without seeking approval.

Every condition a criminal wants is present:

• A very large sum, paid once.
• Invoiced by email, like everything else in the process.
• A deadline — families have 28 days from entry to decide how to pay.
• An account the family has never paid before, so nothing looks unfamiliar.
• Often paid by an adult child or someone holding power of attorney, during one of the hardest weeks of their life.
• And frequently funded by selling the family home — which means the same family moves six figures twice within a few weeks: once at settlement, once to the aged care home.

This is not hypothetical. In Western Australia, about $375,000 intended for the aged care costs of a 102-year-old woman was stolen after criminals intercepted email between her granddaughter, who held power of attorney, and the aged care home. The money was the proceeds of selling her house. The email appeared to come from the nursing home, advising a change of bank account details.

Australia's Department of Health and Aged Care has issued its own warning that scammers are impersonating aged care providers and stealing refundable accommodation deposits. Their advice matches ours: find the provider's number yourself, from an official source, and confirm before transferring anything.

Your bank now checks the name — and criminals have an answer for that

Since 2025, Australian banks have been rolling out Confirmation of Payee. By March 2026 it was live across more than 80 financial institutions, covering over 143 million accounts. When you pay a new BSB and account number, your bank compares the name you typed with the name on the receiving account and shows you a match, a close match, or no match.

It is a genuinely useful last line of defence and you should read it every single time. But two things are worth understanding.

It is advice, not a barrier. A "no match" does not stop the payment. You can proceed anyway — and if you do, the loss will generally be treated as yours.

Criminals have already adapted. In the UK, where this check has been running for years, banks report two counter-moves. One is opening an account in a name that matches the business being impersonated, so the check comes back clean. The other — more common, and more relevant to you — is telling the victim in advance to expect a mismatch:

The check that actually works

Ring them. Not on the number in the email — on a number you find independently: their website, a letter, your own records, the number already saved in your phone. Then read the BSB and account number back and have them confirm it aloud.

That is the whole defence. It takes about four minutes, and it beats every version of this scam, including the ones where the sender's address is completely genuine.

A few things that help alongside it:

• Use a secure channel where one exists. For property settlements, PEXA Key is a free app built specifically for exchanging bank details instead of emailing them.
• Read the name-check result and never override it on someone else's say-so.
• Send a small test amount first — then ring and confirm it landed before sending the rest.
• Treat a deadline as a reason to slow down, not speed up. These emails are timed to settlement dates and admission dates on purpose. The rush is a tool.

If the money has already gone

Speed decides this more than anything else, and it is worth being blunt about how sharp the difference is.

The AFP has described two cases side by side. In one, a client settling a property from overseas received a fraudulent $338,000 invoice after the conveyancing firm's email was compromised — the payment was intercepted and the full amount recovered. In the other, a Tasmanian woman lost $120,000 to an almost identical scam involving a renovation company, and because reporting was delayed, none of it came back.

1. Ring your bank now and say it is a scam payment. Ask them to attempt a recall and to contact the receiving bank. Do this before you are certain — being wrong costs you a phone call.
2. Report it to ReportCyber at cyber.gov.au, and to Scamwatch.
3. Call IDCARE on 1800 595 160, Australia's free national identity and cyber support service.
4. Tell the real business — the solicitor, provider or builder. Their mailbox may still be compromised, and their next client may be about to pay the same account.
5. Keep every email. Do not delete the thread, and do not reply to it.

Do not count on being reimbursed. Australia's Scams Prevention Framework began applying to banks from 1 July 2026 and opens a formal complaints path through AFCA from January 2027, but unlike the UK scheme it does not guarantee that victims get their money back — redress depends on whether the bank met its obligations, not simply on the fact you were deceived. On payments this size, prevention is doing nearly all of the work. There is more detail in our guide on getting money back after a scam, and on what to do in the first hour.

Why this lands hardest on older Australians

Not because of capability. Because of what is in front of them.

People aged 65 and over make up roughly 17% of the Australian population, but accounted for 26.5% of all scam losses in 2025. Downsizing, deceased estates and aged care deposits mean this age group is repeatedly standing in front of the largest transfers of their lives — and this is a scam that only ever visits people who are about to move a lot of money.

If a parent of yours is selling a house or entering care, the single most useful thing you can do is agree one rule with them in advance, before any invoice arrives: no large payment goes out until somebody has read the account number aloud to a human being on a phone number we looked up ourselves.

Common questions