Safer property payments start with a supported team

A request to change bank details can arrive in the middle of an otherwise ordinary day. The practical question for an agency is whether the person handling it has a clear way to check, someone to escalate to and the backing to pause the payment.

REINSW’s 14 October update describes its involvement in a confidential national consultation with NSW Fair Trading about payment redirection in property transactions. It is a consultation update, not an announcement of new legal requirements. REINSW says the submission, vulnerabilities and measures under consideration cannot be disclosed publicly.

There is useful work agencies can do now without speculating about those proposals: make independent verification a normal, well-supported part of the day.

Build the check into the handover

Scamwatch explains that a payment-redirection message can look like a genuine request from a business the recipient already knows. It can arrive in an existing email conversation and use familiar branding. A recognisable sender name or expected invoice is therefore a poor stopping point for a check.

Before acting on payment instructions, verify the account details independently. For changed details, call using a number already verified or independently obtained from the organisation’s official website. Avoid using the phone number supplied in the message being checked.

Make the handover easy to follow. A short verification record can identify:

• the transaction or property involved

• who requested the payment or change

• who independently confirmed the details, when and through which verified contact route

• who completed the agency’s required approval

• any discrepancy that remains unresolved.

Keep that record in an appropriately restricted place. Colleagues need to see that the check happened without copying bank details into every task, email or chat.

Give people permission to slow down

A written procedure works better when the team knows what happens if verification cannot be completed.

Name the person who can resolve an exception and the backup when they are unavailable. Explain how to hold a request safely, who will update the client and how an urgent deadline will be managed. A property manager should not have to choose between following the procedure and keeping a client informed.

Agency leaders also set the tone. Thank people for raising an inconsistency. Avoid treating a verification call as unnecessary delay, particularly when a request comes from a senior colleague or a familiar supplier. Urgency needs a clear escalation route.

Australian Government cyber guidance recommends payment-change approval processes, verified callback numbers and clear reporting arrangements for pressure to act immediately or bypass safeguards. Discuss how those controls fit the agency’s actual work, including leave cover and busy payment periods.

Explain the process before clients need it

Give clients a short explanation of how the agency supplies payment instructions and how they can independently verify them. Include the advice when the relationship begins and again at the point where a payment is expected.

Check the wording across the documents and messages the team uses. If an old template gives different instructions from the current process, fix it. Make sure reception and covering staff can direct a verification enquiry to the right person.

REINSW’s guidance extends beyond sales deposits to property-management payments and strata contributions. Use that as a prompt to review the points at which your own agency communicates account details or facilitates a transfer. Ask your insurance broker to confirm the scope of any business-email-compromise and payment-redirection cover, including client or trust money, as REINSW recommends.

Practise the response as well as the check

Run a short team exercise using a fictional request. Ask who receives it, which contact source they use, where they record the check and what happens if the details do not match. The useful outcome is a clearer procedure and fewer unanswered handover questions.

If money may already have been sent to a scammer, contact the bank immediately. Escalate internally and follow the relevant incident-response and reporting steps. Government recovery guidance also covers securing affected accounts, preserving a record of events and notifying affected contacts. Keep those responsibilities clear before an incident occurs.

Clear ownership and usable records are principles we bring to Delegate. For payment safety, they need to sit alongside the agency’s verification, approval and security controls. A supported team is better placed to ask the necessary question and see it through.

Sources checked on 15 October 2026 (Brisbane). General operational guidance; seek advice relevant to your agency’s trust, insurance and reporting obligations.