Conveyancing Completion Fraud: Payment Diversion Controls

Completion fraud diverts a buyer's deposit or completion funds to a criminal's account in the days before a property purchase completes, and the money is usually gone before anyone notices. In UK conveyancing the attack almost always runs through email: a compromised or spoofed mailbox at the conveyancing firm, the buyer, the estate agent or the seller's solicitor, followed by a message with "updated" bank details. This guide is narrow by design. It covers the controls a solicitor or licensed conveyancer can put around client money movements, what buyers should be told and asked to do, how to respond in the first hour, and how the UK reimbursement and registration protections apply. It is written for conveyancing partners, COLPs and COFAs, practice managers, IT leads at law firms and the advisers who brief buyers. For the wider real estate threat picture, see the Cybersecurity for Real Estate and PropTech Guide.

Practice recommendations in this guide (payment controls, client briefings, rollout timings, metrics and targets) are NHI Mgmt Group recommendations; regulatory and incident details are attributed to the sources linked in the text, as checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

Email must never carry a bank detail change. Give the firm's client account details once, at engagement, through a channel that is not email, and state in writing that they will never change.
Verify by call-back to a known number. Every instruction to send or receive money on a new or changed account is checked by phone to a number taken from the original file, never from the message itself.
The buyer is part of the control. Buyers send the largest payments of their lives from personal email accounts and phones, so the firm's briefing and a small test payment do as much as its own security.
Reimbursement has limits. The UK mandatory reimbursement for authorised push payment fraud started on 7 October 2024 and is capped at £85,000 per claim, which is below many deposits.
Speed decides recovery. Contacting the sending bank within minutes, while funds may still be frozen, matters more than anything done the next day.

How completion fraud works

The attack is patient and timed to the conveyancing timetable. Criminals know that exchange and completion dates are fixed, that large sums move on predictable days, and that everyone involved is under time pressure. The common name "Friday afternoon fraud" reflects how many completions happen at the end of the week.

Access: a conveyancer, buyer or agent mailbox is phished (ATT&CK T1566.002 Spearphishing Link) and then used with stolen credentials (T1078 Valid Accounts), or the criminal registers a look-alike domain (T1583.001 Domains).
Watching: the attacker reads the thread, often hiding their activity with mailbox rules that move or forward replies (T1564.008 Email Hiding Rules, T1114.003 Email Forwarding Rule).
Intervention: close to completion, a message arrives from the real or spoofed address saying the client account has changed because of an audit, a bank switch or a "problem with the usual account".
Payment: the buyer, or sometimes the firm paying out sale proceeds, sends funds to an account controlled by the criminal (T1657 Financial Theft), and the money is moved on through mule accounts within hours.

Variants target the other direction too: a "seller" asking the firm to send sale proceeds to a new account, a fake solicitor firm cloning a genuine firm's name and website, or a fraudster posing as the owner of a property they do not own. The SRA publishes scam alerts about people who misuse the names of genuine firms and solicitors, and several recent alerts concern property transactions. The Law Society's cybersecurity guidance cites the UK Legal Sector Cyber Threat Report figure of 278 SRA scam alerts between January 2022 and January 2023.

Where the money is exposed

Payment	Who sends it	Typical attack	Primary control
Deposit and balance of purchase price to the buyer's solicitor	Buyer, from a personal account	Spoofed or compromised solicitor email gives new client account details	Account details given once off email; buyer calls the firm on a known number before paying; test payment
Completion monies to the seller's solicitor	Buyer's solicitor, from client account	Spoofed seller's solicitor email changes their client account	Details taken from the seller's solicitor's letterhead at instruction and confirmed by call-back; directory and Confirmation of Payee check
Net sale proceeds to the seller	Seller's solicitor	Compromised seller mailbox asks for payment to a new account	Seller's account details and ID confirmed at onboarding; change requires signed form and call to the known number
Mortgage redemption	Seller's solicitor	Fake redemption statement with different bank details	Redemption figure and account obtained directly from the lender
Estate agent fees, search fees and disbursements	Firm accounts team	Invoice fraud from a spoofed supplier	Supplier master data change procedure with independent verification

Controls for the conveyancing firm

Payment process controls

Single source of bank details: client account details appear in the client care letter sent by post or through a secure client portal, and in no email. Every email signature carries a fixed warning that the firm will never change its bank details by email, text or phone.
Call-back for any new payee: before money leaves client account to an account not already verified on the matter, a member of staff calls the recipient on a number from the original file or from an independent directory, not from the email. Record who called, when, and what was confirmed.
Two people for payment release: one person sets up the payment, another approves it after checking the verification record. The Law Society advises firms to give payment system and admin access only to staff who need it, and warns against changing payment details or making payments without thorough checks.
Confirmation of Payee on outbound payments: Pay.UK describes Confirmation of Payee as an account name-checking service that lets a payer check an account name, including whether it is a personal or business account, before a payment is made. A "no match" or "close match" on a completion payment is a stop event, not a warning to click through. See the Confirmation of Payee and Payee Verification Guide.
Change freeze close to completion: any request in the last few days before completion to change an account, a completion date or the destination of funds is escalated to a partner and verified by phone, whoever it appears to come from.
Know the counterparty firm: check the other side's firm and named solicitor on the SRA's Solicitors Register (or the relevant register for licensed conveyancers), and compare the email domain with the firm's registered website.

Mailbox and identity controls

Phishing-resistant MFA on email: passkeys or FIDO2 security keys for every fee earner and accounts user, so that stolen passwords and relayed one-time codes do not open the mailbox. See the Phishing-Resistant MFA Guide.
Alert on mailbox rules and forwarding: new inbox rules that move, delete or forward messages containing words like "completion", "bank" or "funds", and any automatic forwarding to external addresses, should page someone. See How to Audit Mailbox Forwarding and Inbox Rules.
Email authentication on your own domain: SPF, DKIM and a DMARC policy at p=reject make it harder to send mail that claims to come from the firm's exact domain. See the Email Authentication Checklist.
Watch for look-alike domains: monitor registrations that resemble the firm's name and flag inbound mail from newly registered or similar domains. See the Domain Portfolio and Lookalike Domain Management Guide.
External sender banners: tag mail from outside the firm, and in particular mail whose display name matches a colleague or client but whose address does not.

Seller identity and title fraud

Payment diversion has a sibling: the fraudster who poses as the owner of a property in order to sell or mortgage it. The Law Society's page on the Code for Completion by Post records that its 2019 revision followed the Court of Appeal decision in Dreamvar, in which fraudsters posed as genuine sellers, and that the seller's solicitor must still take reasonable steps to confirm the client's identity and entitlement to sell. HM Land Registry lists the owners at higher risk: people whose identity has been stolen, owners who rent out the property or live overseas, owners of empty or unmortgaged properties, and owners of unregistered land. Treat those features, combined with urgency, remote-only contact or a request to send proceeds to a new or overseas account, as reasons for enhanced checks. See the Deepfake-Resistant Identity Verification Guide.

What to tell buyers and sellers

The client is often the weakest link because they use personal email, they are not trained, and they want completion to happen on time. A short, repeated briefing changes behaviour more than a long leaflet.

When	Message to the client	Action asked of the client
Instruction	Our bank details are in this letter and will never change during your matter. We will never send new bank details by email, text or phone.	Keep the letter; save the firm's main phone number from our website or letterhead.
Before any payment	Criminals copy our emails and our staff names. A genuine change will never happen.	Call us on the saved number before sending money, and ask the named person to confirm the sort code and account number.
Deposit payment	Send a small test amount first.	Transfer a small sum, wait for us to confirm receipt by phone, then send the balance.
Week of completion	This is when fraudsters strike.	Ignore any message about changed details, deadlines or penalties; call us.
After completion	Register for HM Land Registry Property Alert.	Sign up for the free alert service, which can monitor up to 10 properties.

Personal mailbox hygiene: encourage clients to turn on two-step verification on their personal email account and to keep the transaction off shared family accounts.
Confirmation of Payee on the client side: tell buyers what result to expect for the firm's client account name, so that a "no match" warning makes them stop and call.
Seller proceeds: ask sellers for their account details at onboarding, with identity checks, and explain that the firm will phone before paying to any account that differs.

Reimbursement and registration protections

Practitioners and clients often assume the bank will refund a diverted payment. The rules are narrower than that.

Protection	What it does	Limit relevant to conveyancing
PSR APP fraud reimbursement	Requires payment firms to reimburse consumers for authorised push payment fraud on UK Faster Payments and CHAPS transfers made on or after 7 October 2024; sending and receiving firms share the cost 50:50	Maximum £85,000 per claim; optional excess of up to £100; claims within 13 months; gross negligence exception (not for vulnerable consumers)
Financial Ombudsman Service	Considers complaints about amounts above the £85,000 reimbursement cap	Award limit of £455,000 for complaints about acts on or after 1 April 2019, from 1 April 2026 (FCA confirmation)
Confirmation of Payee	Name check before payment; Pay.UK reports more than 300 organisations implemented and over 2 million checks a day	Helps the payer spot a mismatch; does not reverse a payment
HM Land Registry Property Alert	Alerts the owner when someone applies to change the register	Alerts only; does not block the change
Restriction on the title	Requires extra checks before a sale or mortgage is registered	Form RQ for owners not living at the property and the company request for companies, both free; form RX1 for owners who live there, £40

Two practical consequences follow. First, a buyer sending a £150,000 deposit is only guaranteed reimbursement of the first £85,000 under the PSR scheme, so prevention is the only full protection. Second, the reimbursement scheme is framed around consumers; a payment sent by the firm from client account may sit outside it, which places the loss and the duty to make good client money on the firm and its insurers. Check the position with the firm's bank and professional indemnity insurer before an incident, not after. See the Authorised Push Payment (APP) Fraud Guide.

HM Land Registry's own figures show why title fraud controls work: in 2024-25 it identified 86 fraudulent applications out of 4,429,092 applications to change the register, and prevented fraudulent applications against more than £59 million of property.

The first hour after a diversion

Call the sending bank immediately: the payer (client or firm) phones the fraud line of the bank that sent the money and asks for the payment to be recalled and the receiving account frozen. Minutes matter because funds are moved on quickly.
Stop further payments on the matter: freeze all outbound payments linked to the transaction until every account has been re-verified by phone.
Secure the mailbox: reset the affected user's credentials, revoke active sessions and tokens, remove malicious inbox rules and forwarding, and check for other mailboxes accessed from the same sign-in source. The Business Email Compromise Response Playbook sets out the full sequence.
Preserve evidence: keep the fraudulent emails with full headers, sign-in logs, mailbox audit logs and the payment records. See the Email Forensics and Header Analysis Guide.
Tell the other parties: warn the other side's firm, the estate agent and any lender that the thread is compromised, by phone.
Report: report to Report Fraud (which replaced Action Fraud on 4 December 2025), or in Scotland to Police Scotland on 101; notify the professional indemnity insurer; consider the SRA reporting duty (the Law Society points to Rule 3.9 for serious breaches); and if personal data was exposed, assess notification to the ICO within 72 hours of becoming aware.

Rolling out the controls

Weeks 1 to 2, quick wins: add the fixed bank details warning to every email signature and client care letter; publish an internal rule that no bank detail change is accepted by email; brief all conveyancing and accounts staff on the call-back procedure.
Weeks 2 to 6, mailbox protection: enforce MFA on all mailboxes, moving accounts users and partners to phishing-resistant methods first; switch on alerts for new forwarding and inbox rules; move DMARC towards p=reject after reviewing reports.
Weeks 4 to 8, payment workflow: build verification evidence into the case management system as a mandatory field before a payment can be approved; enforce two-person release; record Confirmation of Payee results.
Test: run a simulated "changed bank details" email against the conveyancing team and the accounts team, and a tabletop of the first-hour response with the bank fraud line number to hand.
Review quarterly: sample completed matters to check that call-back records exist, and update the client briefing with any new scam pattern seen in SRA alerts.

Small firms and sole practitioners: the process controls cost little; the essentials are the fixed warning, the call-back rule, MFA and a second person (even an external bookkeeper) approving large payments. Larger firms and panel conveyancers: invest in a client portal that removes bank details from email entirely, central monitoring of mailbox rules, and payment verification built into the case management workflow. If a buyer is handled through an online portal, apply phishing-resistant MFA to the portal itself.

Detection and measurement

Mailbox signals: new inbox rules, external forwarding, sign-ins from unfamiliar locations or hosting providers, and bursts of reading in conveyancing mailboxes.
Payment signals: payee changes on a live matter, Confirmation of Payee mismatches, requests to change the completion date or destination of funds, and overseas or newly opened receiving accounts.
Client signals: calls from clients asking about an email they did not expect, which should be logged and investigated rather than reassured away.

Metrics that show the controls are working:

Percentage of outbound client account payments with a recorded call-back verification (target 100% for new payees).
Percentage of fee earners and accounts staff on phishing-resistant MFA.
Time from an inbox rule or forwarding alert to triage.
Number of payment change requests received by email, and the share escalated correctly.
Click and report rates in simulated bank-detail change emails.
Number of clients sending a test payment before the deposit.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ATT&CK techniques addressed
Mailbox authentication and account management	PR.AA-01	IA-2, AC-2	T1078, T1586.002
Staff and client awareness	PR.AT-01	AT-2	T1566.001, T1566.002
Spam and spoofing protection	PR.AA-01	SI-8	T1583.001
Mailbox rule and sign-in monitoring	DE.CM-01	SI-4	T1564.008, T1114.003
Payment diversion response with banks and counterparties	RS.MA-01	IR-4	T1657

Common failure patterns

Verifying with the attacker: calling the number in the email signature of the fraudulent message, which reaches the criminal.
Warnings that clients never read: a fraud notice buried in terms of business, with no repeat before the deposit or in the week of completion.
Trusting the thread: assuming a message is genuine because it sits in a long, real conversation. A compromised mailbox replies inside the real thread.
Clicking through Confirmation of Payee: treating "no match" as a technical glitch under completion-day pressure.
Password-only email: fee earners on passwords or SMS codes, with no alert when a forwarding rule appears.
Assuming the bank will refund: no plan for losses above the £85,000 reimbursement cap or for payments made from client account.

Practitioner checklist

Client account details are given once, outside email, with a written promise that they will never change.
Every email signature and pre-completion letter repeats the bank details warning.
Call-back to a number from the original file is mandatory and recorded before paying any new payee.
Two people release every client account payment above a set threshold.
Confirmation of Payee results are recorded and a mismatch stops the payment.
All conveyancing and accounts mailboxes use phishing-resistant MFA, with alerts on forwarding and inbox rules.
DMARC on the firm's domain is at p=reject and look-alike domains are monitored.
Buyers are asked to make a small test payment and confirm receipt by phone.
Sellers' identity and entitlement to sell are verified, with enhanced checks for empty, rented, unmortgaged or overseas-owned properties.
The first-hour response, with the bank fraud line, insurer and reporting contacts, is printed and rehearsed.

Conveyancing Completion Fraud: Payment Diversion Controls for Solicitors and Buyers