The renovation scam nobody warns you about

Everyone watches the wrong end of the job

Warnings about tradies are all about the beginning. Don't pay a big deposit. Get three quotes. Check the licence. Be careful of the bloke who knocks on the door with a folder and a price that is only good today.

All of that is good advice, and none of it protects the money most likely to be lost. By the time a job is at frame or lock-up stage, the person who was cautious in week one has stopped being cautious. The builder is known. The invoices are familiar. The payments have gone through fine. That is precisely the moment the pattern is built for.

What actually happens

Somewhere between your second and third payment, the builder's email account is compromised — usually a reused password, or a phishing email they clicked months ago. Nothing visible changes. Their mail still works. They have no idea.

Someone else is now reading that mailbox, waiting. When the next progress claim goes out, they send their own copy: the builder's real letterhead, the real job number, the correct amount, the same wording as last time. One thing is different. The BSB and account number belong to a mule account that will be emptied within hours.

There is nothing to spot. No urgency, no threat, no bad grammar, no suspicious link, no unfamiliar sender. Every instinct people are taught to rely on is looking for something that is not there. The email is genuinely from your builder's address, because it genuinely came from your builder's mailbox.

Why the builder's compromised inbox is not your builder's fault

It is worth saying plainly, because the aftermath is often uglier than the loss. Small trades run on one email account, usually without two-factor authentication, often shared between a partner doing the books and a phone in a ute. They are targeted for exactly that reason.

When the money goes, the customer and the builder each believe the other should have caught it. The builder has done the work and has not been paid. The customer has paid and still owes the money. Both are out of pocket and the relationship is finished. Nobody involved did anything obviously careless.

The habit that catches it

You do not need to become suspicious of your builder. You need one rule that does not depend on how you feel on the day:

Before any progress payment, compare the bank details to the payment that actually left your account last time. Not to the last invoice — to your own banking history, which is the one record whoever sent the email cannot edit.

If anything differs — the BSB, the account number, the account name, or a note explaining that details have changed — stop. Ring the builder on the number you have had all along, from your own contacts, and read the digits back to them. If it is genuine, that is a thirty-second call and you pay as normal. If it is not, you have just saved a payment you would never have recovered.

What about the bank's name check?

Australian banks now check the account name you type against the name on the account and warn you when they do not match. It is genuinely useful, and it is worth paying attention to when it fires. But understand what it is: a check on the name, at the last second, as you key the payment. It has never seen your invoice, it does not know what you paid last month, and a fraudster who opens an account in a close-enough name can pass it.

Treat it as the last net rather than the first. The check that matters happens when the invoice arrives, not when the transfer is keyed.

If you have already paid the wrong account

Move before you are certain — speed matters more than confirmation.

1. Ring your bank now and ask them to attempt a recall. Same-day requests have a meaningfully better chance.
2. Tell the builder. Their mailbox is compromised and their other customers are about to receive the same invoice.
3. Report it to Scamwatch, the ACCC's National Anti-Scam Centre reporting service.
4. Call IDCARE on 1800 595 160 if any of your own details may have been exposed. It is Australia's free national identity and cyber support service.

It is not really about renovations

If you run a business rather than a household, the same fraud has its own guide: the email that says your supplier's bank details have changed, and for settlements and aged-care deposits, the version that never claims anything changed at all.

The pattern is repeat payments to a business you have learned to trust: a funeral plan on instalments, monthly aged-care fees, a wedding venue, school fees, a solar installation, a long treatment plan at the vet. Anywhere the same counterparty bills you more than once, the same window exists — and it opens at exactly the point where you have stopped checking.

Common questions