Payment diversion fraud: how it hits property sales and what estate agents can do

What payment diversion fraud is

Payment diversion fraud is when a criminal persuades someone to send a genuine payment to the criminal’s account instead of the right one. In property it targets deposits, completion money, rent and agents’ invoices. Because the victim authorises the transfer, banks record it as authorised push payment (APP) fraud.

You may also hear it called conveyancing fraud, mandate fraud or “Friday afternoon fraud”, because many completions happen at the end of the week. The National Crime Agency (NCA) describes payment diversion fraud as “one of the highest harm types of fraud experienced by victims”.

How it happens in a property transaction

A typical case follows a simple pattern. The fraudster gains access to an email account, or creates one that looks genuine, watches the conversation, then sends a message at the moment money is due with “new” bank details. The email looks routine and often comes from what appears to be a real address.

Common routes in:

• A hacked mailbox. Someone gets into a real email account at the agency, the conveyancer or the client, often through a stolen password. Their messages come from the genuine address.
• A spoofed address. The email claims to be from your domain but was sent from somewhere else. Strict SPF, DKIM and DMARC settings make this much harder.
• A lookalike domain. One letter changed, a hyphen added or a different ending, such as .co instead of .co.uk.
• A fake change of bank details. A letter, call or message saying the firm’s account has changed “because of an audit” or “a problem with our bank”.

The SRA notes that law firms and their clients are “an attractive target because transactions often involve large sums of money”, and that firms have been shut down after being tricked into paying money out to fraudsters. Estate agents sit in the same email chains. The fraudster may impersonate your branch to a buyer, or the vendor to your team.

The latest UK figures

APP fraud cost UK victims £576.4m in 2025, up 19%, across 248,070 cases. Fraud that started by email was only 1% of cases but 7% of losses, which fits payment diversion: few cases, high values. Property-linked reports to Action Fraud averaged about £82,000 per victim.

The NCA and Law Society found that 32% of victims were aged 40 to 49 and 27% were aged 30 to 39. City of London Police put total reported losses at £11.7m, of which £10.97m came from 140 residential cases. These are reported cases only. UK Finance’s data covers a wider range of payments and accounts than the reimbursement rules.

Confirmation of Payee and its limits

Confirmation of Payee (CoP) is a name check your bank runs when you set up a new payee. It compares the name you type with the name on the account. It helps catch a diverted payment where the fraudster’s account is in a different name, but it does not confirm that the person asking for the money is genuine.

Pay.UK says CoP launched in 2020, and more than 300 organisations have implemented it. The payer sees one of four results:

Pay.UK is clear about the limits. CoP is “not a silver bullet to eradicate fraud”, it “does not automatically guarantee that a fraudulent payment will be detected”, and “payments to existing recipients and standing orders may not be checked”. A match only tells you the name fits the account. It cannot tell you the account belongs to your conveyancer.

APP reimbursement: what the rules cover

Since 7 October 2024, banks must reimburse victims of APP fraud on UK bank transfers. Individuals, micro-enterprises and charities can claim up to £85,000 if they report within 13 months. Banks can refuse if the customer was complicit or grossly negligent, and the gross negligence exception does not apply to vulnerable customers.

What the Payment Systems Regulator (PSR) rules say:

• Limit: £85,000 per claim. Higher losses can go to the Financial Ombudsman Service, whose limit is £455,000 for complaints referred from 1 April 2026.
• Who is covered: individuals, micro-enterprises and charities. A micro-enterprise has fewer than 10 staff and an annual turnover or balance sheet total of no more than €2 million, judged when it opened the account (Payment Services Regulations 2017, regulation 2). Larger businesses are not covered by these rules.
• Payments covered: UK bank transfers (Faster Payments and CHAPS). Card, cash and cheque payments have separate protections.
• Time limit: report to your bank within 13 months of the payment.
• Excess: firms may apply an optional excess of up to £100, but not for vulnerable customers.
• Timescale: reimbursement within 5 business days of the claim, or up to 35 business days if the bank needs more information.

The PSR’s dashboard shows that 89% of the value of claims was reimbursed in the first quarter of 2026. The government plans to move the PSR into the Financial Conduct Authority (FCA). The Financial Services and Markets Bill [HL], which would transfer its functions, was still before Parliament on 25 October 2026, so the PSR’s rules apply for now.

Delays on completion day. Since 30 October 2024, a bank with reasonable grounds to suspect fraud can hold an outgoing payment until the end of the fourth business day after receiving it, and must tell the payer why (SI 2024/1013). Build a little slack into completion plans and tell clients this can happen.

A prevention checklist for your firm

The most useful rule is one applied every time: bank details are never changed by email, and any payment details are confirmed by phone on a number you already hold. Put that rule in writing, tell clients at instruction, and check your own email settings.

1. Put your bank details policy in writing. Say in your terms, your email signature and your first letter that you will never change bank details by email or phone.
2. Confirm by phone, every time. Before paying out, call the payee on a number from your file or their website, never from the email asking for payment.
3. Check your email security. Run your domain through our free email security checker and fix SPF, DKIM and DMARC with your IT provider. The NCSC says DMARC tells receiving servers how to handle email that fails these checks.
4. Protect mailboxes. Turn on multi-factor authentication (also called 2-step verification) for every mailbox and remove leavers’ access promptly. The NCSC says 2-step verification “keeps cyber criminals out of your accounts even if they know your passwords”.
5. Watch for lookalike domains. Read the sender’s full address on any email about money.
6. Keep ID documents out of email. Passport scans and bank statements in inboxes give fraudsters material to impersonate clients. With AML Buddy, clients verify through one secure link and you get a timestamped PDF report.
7. Train staff. Everyone who handles money or client email should know the warning signs: urgency, secrecy, new bank details, a change of tone or a different sign-off.
8. Test large payments. Where practical, send a small amount first and confirm by phone that it arrived, as the NCA and Law Society recommend.

Payment diversion sits alongside your money laundering duties, not inside them. Your customer due diligence checks who your client is; the steps above check where the money goes. See the estate agents hub and letting agents hub for the AML side.

What to tell buyers, sellers and tenants

Clients are the people most often tricked, so tell them the rules before money moves. A short written message at instruction, repeated before exchange and completion, covers it: you will never change bank details by email, they should call you on a known number, and they should read their bank’s Confirmation of Payee result.

You can adapt this wording:

We will never ask you to send money to new bank details by email, text or phone. If you receive a message like that, even if it looks like it comes from us, do not pay. Call us on [number from your website or contract] to check. When you set up a payment, read the name check your bank shows. If it says the details do not match, stop and call us.

Clients who pay deposits or rent through your agency need the same message. For who pays for AML checks in a sale, see our guide on who pays for AML checks when buying a house.

What to do if money has gone

Speed matters most. The person who made the payment should call their bank straight away, then report to Report Fraud (Police Scotland in Scotland). Your firm should secure its email, record what happened and check whether a data breach report to the ICO is needed, where feasible within 72 hours.

For the person who paid:

1. Call your bank immediately on the number on your card or statement, and ask it to contact the receiving bank.
2. Report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. It replaced Action Fraud on 4 December 2025. In Scotland, report it to Police Scotland on 101.
3. Claim reimbursement with your bank within 13 months.

For your firm:

1. Warn everyone in the chain: the client, the other side’s agent and both conveyancers, by phone.
2. Secure your email. Reset passwords, check mailbox forwarding rules and sign out all sessions. Ask your IT provider to check how the fraudster got in.
3. Consider the ICO. If personal data was exposed and a risk to people is likely, report it to the ICO as soon as possible and, where feasible, within 72 hours. If the risk is high, tell the people affected without undue delay.
4. Check your insurance. If you hold cyber or professional indemnity cover, read the policy’s notification terms and tell your insurer or broker as it requires.
5. Record and review. Write down what happened and what you changed. If you suspect money laundering, your nominated officer decides whether to make a suspicious activity report.

This guide is general information, not legal advice. Your bank, the police and your supervisor’s guidance decide what applies in a specific case.