A simple cut and paste let cyber criminals steal homes worth millions

The fraudsters timed their theft to perfection.

They hacked into the email account of conveyancers Sargeants Knox Conveyancing on Wednesday May 30 and added themselves, using the conveyancers’ account, as a ‘ghost’ user to Australia’s new online property transfer platform.

Then they watched and waited. Patiently.

Seventeen days later on a Friday morning as two bankers and two conveyancers, one each for the buyer and vendor, gathered in the online “workspace” to settle the property transaction, they struck.

It was a simple, audacious “cut and paste” theft.

At the last minute, the fraudsters switched the vendor’s bank account details, where the funds were being transferred, with their own. Both were Commonwealth Bank accounts.

The Ocean’s Eleven-style heist took just seconds - the time taken by the conveyancer to check they had the right bank account for the vendor and then begin the process of approving the deal using a special password-protected electronic security device.

Ms Venn and Mr Burgess were innundated with offers of support after the theft of $250,000.Credit: Chris Hopkins

A click on the fraudster’s keyboard heralded a two-week, $250,000 nightmare for MasterChef finalist Dani Venn, her husband Chris Burgess and their two young children.

It was the family’s semi-rural home in Melbourne’s north east that was being transacted in cyber space when the criminals struck. And it was their $250,000, earmarked to pay for another home they had already purchased on the Mornington Peninsula, that disappeared.

“We have had a week of absolute hell .. and sleepless nights,” Ms Venn said.

The young family was left homeless and facing the threat of losing their new house and $80,000 deposit. After they defaulted on the new home’s settlement, they were charged interest of $500 a day.

They were not the only ones defrauded. Another Surrey Hills home vendor in Melbourne’s east had lost more than $1 million three weeks earlier.

While the bulk of money from both thefts was recovered, it precipitated an ongoing public relations disaster for Property Exchange Australia (PEXA), the privately-owned company that runs the new electronic e-transfer system.

Australia is midway through converting from the 150-year-old Torrens title paper system of exchanging property, to electronic certificates.

Thousands of land titles are now transacted and exchanged on PEXA’s system which is owned by state governments, the ANZ, CBA, NAB, Westpac, Macquarie Bank, private equity and property developer Paul Little.

Its use is set to become mandatory for standalone property transactions in NSW next week and all transactions in Victoria this October. Its rollout has been coupled with the sale of the Land Titles Offices in NSW for $2.6 billion, with Victoria set to follow suit.

At first PEXA denied liability for the loss.

“The PEXA platform was not hacked. Practitioners’ email accounts were hacked,” acting chief executive James Ruddock told Fairfax Media.

"It's important to note that funds cannot be misdirected unless the practitioner physically signs off on the fraudulent account details using the bespoke digital certificate and accompanying password," he said.

But after Ms Venn contacted Fairfax, PEXA offered the family a loan for the outstanding money under strict conditions.

They would have to pay it back whether or not their conveyancer’s cyber crime insurance claim was successful, a caveat would be put on their property, and they were not allowed to criticise PEXA.

“[We] would expect that they not disparage PEXA to the media, but confirm in any discussions with the media that PEXA has been proactive in assisting to resolve this matter,” the group’s legal counsel wrote to the couple.

“That’s not ok. That’s lying. We have values and ethics and we’re not breaking them because they don’t want the public to know what’s going on,” Ms Venn said.

Ms Venn said the couple would be seek damages to cover home moving fees, time off work and stress.   "We’ve had such a traumatic week we both need counselling."

After Fairfax broke the story and the family gave an emotional interview on national television, PEXA changed its tune. The company has agreed to pay out both of the victims unconditionally.

“We clearly regret the distress felt by those impacted in these two recent events and will ensure all outstanding funds are covered, without condition,” Mr Ruddock said.

In a further mea culpa, PEXA wrote to members this week saying: We've listened to concerns. We understand the importance of security .. [and] will be introducing a new consumer guarantee for transactions conducted on our platform.”

"We anticipate this guarantee will go above and beyond any guarantee available in the paper-based settlement process, and will provide greater safeguards to consumers whose conveyancer or lawyer uses PEXA."

The guarantee may go some way to reassuring home sellers whose confidence in PEXA's e-transfer platform has been shattered by the thefts.

“I’m very happy that they’re offering that guarantee and improving security. That’s a big win not just for us but for the Australian public,” Ms Venn said.

PEXA has denied the security breach will affect its proposed $1 billion public listing on the Australian stock exchange.

The events of the past week have galvanised opposition from conveyancers and lawyers.

Belinda Bernardini from Bellmar Conveyancing Service created an online petition calling for a halt to the system's mandatory rollout. It attracted 760 signatures by week's end.

"We’re not anti-electronic conveyancing. We’re anti the mandated use of it until all the issues we’re experiencing are fixed," she said.

As well as fraud, they include settlement delays, PEXA not answering calls for help and banks not adhering to guidelines, she said.

David Buxton from Sydney Legal Agents represents 550 lawyers and conveyancers upset at being forced onto the online platform.

"We don’t think it should be mandated until there is a stronger regulator in place and there’s a proven competitor to PEXA using the same ecosystem," Mr Buxton said. "Until that happens you should be able do property transfers on paper as well as online."