The $3 Billion Mortgage Ring That Put Accountants Inside AUSTRAC's Net

When Qi Gao - a Melbourne accountant trading as PGY Accounting + Business Solutions - was arrested by the Australian Federal Police in March 2026, he wasn’t charged with running a dodgy tax scheme. He was charged with laundering the proceeds of illicit tobacco, drug importations, and onshore scam networks through Australian home loans. Maximum penalty: 27 years.

Gao is one of several professionals charged as part of a sweeping investigation into a mortgage fraud syndicate that authorities now believe put approximately $3 billion in suspect loans through Australia’s major lenders. The others charged include a finance broker, a former NAB and CBA manager, and a Sydney solicitor. All of them held professional credentials. All of them used those credentials as the mechanism - not the cover - for the fraud.

The case is significant for two reasons. First, the scale: $3 billion across ten institutions is not a tail-risk scenario. It is the largest mortgage fraud investigation in Australian history. Second, the timing: as of 1 July 2026, the professions at the centre of this case - accountants, mortgage brokers, lawyers, real estate agents - are now captured by AUSTRAC’s anti-money laundering and counter-terrorism financing regime for the first time. Tranche 2 is live. The case study that justified it has already played out.

How the syndicate weaponised professional trust

The scheme wasn’t technologically complex. It was professionally complex. A network of accountants, mortgage brokers, bankers with internal sign-off authority, and lawyers acted as a referral chain, each link adding a layer of credibility to fraudulent loan applications moving through mainstream lenders.

In the typical pattern identified by investigators, an accountant referred clients to a broker. The broker prepared loan applications loaded with falsified income statements, forged payslips, and fabricated tax returns - documents that prosecutors allege were sometimes enhanced with AI tools capable of generating high-quality, plausible-looking financial records. A bank manager with the right level of authority approved the application. A solicitor handled settlement. The money landed in accounts tied to criminal networks involved in drug trafficking, illicit tobacco distribution, and scam operations.

Every link in the chain held a legitimate licence. Every link also trusted the one before it without independent verification. That trust was the attack surface.

Security researcher Jamieson O’Reilly, quoted in coverage of the CBA investigation, framed it precisely: “Technology doesn’t defeat institutional trust - it just makes exploiting it faster.” The fraud ring didn’t need to break into CBA’s systems. It needed people inside the lending process who would move things through without checking.

From $1 billion to $3 billion: the full picture

Commonwealth Bank self-reported to NSW Police and ASIC in late February 2026 after internal compliance teams found anomalies in its third-party broker channels and its internal referrer program. The initial estimate was roughly $1 billion in fraudulent home loans. CBA referred two mortgage brokers and a network of accountants to NSW Police and updated its internal policies to reject referrals from clients without a six-month prior loan history.

That was not the ceiling. As AUSTRAC and ASIC required ten major lenders to share loan data, a broader picture emerged. Authorities now estimate approximately $3 billion in suspect loans tied to the same syndicate typologies across the sector. One set of borrowers allegedly held an average of seven credit products across multiple institutions. The Penthouse Syndicate - the name NSW Police use for the core criminal group - is alleged to have defrauded major banks of more than $250 million alone, with NAB’s exposure a significant portion of that figure.

NSW Police’s Financial Crimes Squad established Strike Force Myddleton in January 2024, initially focused on automotive finance fraud. As investigators followed the money, the scope expanded to personal loans, business lending, and ultimately home loans. The syndicate, police allege, systematically recruited or corrupted people at each stage of the lending chain - from front-end brokers to bank staff with sign-off authority.

AUSTRAC is examining the funds on the other side: whether the fraudulently obtained home loans were used as a vehicle to launder proceeds of serious organised crime into the property market.

The charges: accountants, brokers, bankers, and a lawyer

Three categories of licensed professional have been charged to date.

Accountant. Qi Gao, 42, faces two counts: knowingly dealing in proceeds of general crime above $100,000, and committing an indictable offence to benefit a criminal organisation. His firm allegedly acted as a client funnel, directing customers to brokers who then submitted fraudulent applications. Australian Federal Police arrested Gao on 31 March 2026.

Broker and banker. In May 2026, Strike Force Myddleton arrested Thu Huong Nguyen, a 35-year-old finance broker operating HTN Finance, and Huy Tin Nguyen, a 34-year-old who formerly managed teams at both NAB and CBA. Police allege the ex-banker used his internal authority to help the Penthouse Syndicate secure more than $25 million in property loans and $6 million in business facilities. The broker is accused of submitting approximately $13 million in loan applications built on fabricated or altered documentation. Both had bail refused when they appeared at Burwood Local Court in May.

Solicitor. In April 2026, Elic Tang - a solicitor operating from Sydney’s Pitt Street - became the first legal professional charged under the operation, over more than $25 million in alleged fraudulent property transactions.

What each of these professionals shared: structural access to a stage of the lending process, a professional credential that made their involvement appear routine, and - critically - no obligation before 1 July 2026 to conduct AML/CTF due diligence on the clients they referred or transactions they facilitated.

That last point has now changed.

Tranche 2 is live: these professions are now AML reporters

As we covered in AUSTRAC Tranche 2 Is Live: You Can Verify Clients, Not the Bank Account, from 1 July 2026, Australia’s AML/CTF regime now captures real estate professionals, property developers, accountants, lawyers, and mortgage brokers for the first time.

The obligations are substantive. Newly regulated entities must appoint an AML/CTF compliance officer, enrol with AUSTRAC, and implement a written compliance program that includes formal risk assessment and customer due diligence procedures. Where a transaction raises suspicion, they must file a suspicious matter report.

AUSTRAC CEO Brendan Thomas put the intent plainly in comments to The Adviser: “When every professional involved in a transaction is required to know who they are dealing with and question the source of funds, it becomes significantly harder for false documents, synthetic identities or illicit money to move undetected.”

That is a precise description of what was missing in the mortgage fraud chain. No single professional along the referral route was legally required to ask where the money came from.

Industry is still absorbing what the new obligations mean in practice. The Finance Brokers Association of Australia published a request to AUSTRAC in July 2026 seeking urgent clarification on whether commercial asset finance broking falls within the new regime. FBAA CEO Leo Gagic noted: “Our industry is keen to understand its compliance responsibilities and ensure we are appropriately preparing for any regulatory changes.” The request signals that significant portions of the broking market are still mapping their legal exposure six weeks after the commencement date.

Firms that are not yet enrolled with AUSTRAC, that do not have a compliance officer in place, or that have not documented an AML/CTF program are currently operating in breach of obligations that took effect on 1 July.

The verification gap that the entire chain shares

Tranche 2 will make it harder for the next syndicate to run this pattern without triggering a suspicious matter report. But it will not close the gap that made the fraud possible in the first place.

None of the professionals in the chain - not the accountant, the broker, the banker, or the solicitor - checked whether the bank account at the end of the transaction matched the entity on the paperwork.

This distinction matters. AML/CTF customer due diligence asks: who is this person, and where does their money come from? Bank account verification asks: does this account number actually belong to the entity I intend to pay? The two checks are not the same, and one does not substitute for the other. Fraud rings understand this. They invest in creating customers who pass KYC - synthetic identities, real-looking professional referrers, plausible document trails - and then route funds to accounts that aren’t what they appear to be.

In the property and professional services sector, this gap opens at every settlement. When a conveyancer sends account details for settlement funds, those details arrive by email - outside the lending chain’s formal controls. When a law firm provides a trust account number, there is no default step that confirms the account name, BSB and account number are consistent and match the firm on record. When a supplier updates payment details mid-project, the update is typically accepted on the strength of the relationship.

AUSTRAC has been explicit with banks: accountant and lawyer referrals should now be treated as elevated-risk channels. That risk signal needs to translate into payment controls at the point of transfer - not just a notation in a customer due diligence file.

What professional services firms should do now

Two distinct obligations now apply to firms in this sector.

Comply with Tranche 2. If your business is a newly regulated entity, the obligations are not aspirational - they commenced 1 July 2026. Enrol with AUSTRAC. Appoint a compliance officer. Document your AML/CTF program including your customer risk assessment and due diligence procedures. If you have not started, start immediately.

Add bank account verification to your payment controls. Tranche 2 requires you to know your client. It does not require you to verify that the account your client directs you to pay actually belongs to them. That is a separate control, and it is the one the $3 billion syndicate never had to defeat. Before any payment leaves your firm - to a client, a supplier, a settlement agent, or a counterparty - confirm that the BSB, account number and account name match the entity on your instruction. If account details arrive by email at any point in the process, verify them independently before the payment moves. The syndicate that cost Australian banks $3 billion relied on every participant in the chain trusting each other’s paperwork. That trust, unverified, is the liability.

---

ezyshield is on a mission to eliminate payment fraud in Australia. We verify the person, the business, and the bank account before money moves - so payments only ever land with who they’re meant to. Learn more