Fake AUSTRAC Officials Are Targeting Real Estate Agencies

The short answer: Scammers are impersonating AUSTRAC and its staff, AUSTRAC CEO Brendan Thomas confirmed on 13 October 2026. Real estate agencies, newly inside the AML regime since 1 July 2026, are likely targets. AUSTRAC says it will never use messaging apps to handle cases or ask for payment in cryptocurrency. Verify any payment request against the account it points to.

Key takeaways

• Scammers use real AUSTRAC staff names on fake profiles and move victims to WhatsApp.
• AUSTRAC has written to every bank asking them to watch for payments made on supposed agency instructions.
• A convincing story can be faked, but the destination bank account can be checked.
• For the fundamentals, see our guide to AML/CTF compliance.

Picture a principal at a real estate agency who gets a message from someone saying they are an AUSTRAC investigator. They use the name of a real AUSTRAC staff member. Their professional profile looks right. They want to move the conversation to WhatsApp.

It is not AUSTRAC. It is the kind of approach AUSTRAC has now warned about.

On 13 October 2026, AUSTRAC CEO Brendan Thomas confirmed that scammers are impersonating the regulator and its staff. He has also written to every bank, asking them to watch for customers making payments on instructions they believe came from AUSTRAC or another government agency. (Cyber Daily)

Why are real estate agencies being targeted?

Since 1 July 2026, real estate agents have been inside AUSTRAC’s anti-money laundering framework alongside lawyers, accountants and conveyancers. For many principals that is new territory. AUSTRAC has already issued penalty notices to real estate, accounting and jewellery businesses, with fines of up to $21,840 for companies and $4,368 for individuals.

That makes a message about “compliance” easier to believe. Thomas said these scams “are designed to look credible”, and that they rely on fear or urgency.

Property is also where the money is. Deposits, settlement funds and trust account disbursements all move under tight deadlines, between several parties who may never have spoken directly.

How does the AUSTRAC impersonation scam work?

AUSTRAC describes two main versions.

In the investigator contact scam, a scammer opens with an ordinary conversation, then says they work with an “AUSTRAC investigator” who can recover money lost to an earlier scam or complaint. The investigator is a real staff member’s name attached to a fake profile. The victim is moved to WhatsApp and promised a quick recovery.

In the helpful contact scam, the scammer poses as a senior AUSTRAC official, including the CEO, and offers to connect the business with the regulator’s general counsel or sort out a compliance issue.

Thomas said the scammers use real staff names, job titles, logos and public information, and the approaches push the conversation onto a channel where AUSTRAC is not present. They rely on fear or urgency, so that money or details are handed over before anyone has time to check.

What does AUSTRAC say it will never do?

AUSTRAC has said it will not:

• retrieve lost investment funds for consumers
• use messaging apps to handle cases
• ask for payment in virtual currencies or through social media apps
• ask for extra payment to handle a complaint or resolve a matter

“We are never going to ask you to pay in virtual or cryptocurrencies or through social media apps,” Thomas said. If you get a suspicious message, his advice is to “stop, don’t click any links and contact us using the contact details on our website.”

AUSTRAC-regulated businesses can receive legitimate invoices, so a real request does exist. The rule is that an unexpected request for money, personal data or urgent action gets checked through official channels before anyone acts.

When the story is convincing, why check the account?

Impersonation scams work on people. A name, a title, a logo and a plausible story can fool someone who is busy and worried about compliance. Training helps, but it never closes the gap completely.

The bank account is harder to fake. Whatever story comes with a payment request, the account it points to either belongs to who the request says it belongs to, or it does not. Before a payment leaves, whether it is a settlement disbursement, a fee, a refund or a deposit, check three things.

• The business named on the request is real, registered and has an active ABN.
• The person making the request is who they say they are.
• The BSB and account number are registered to that business, not just a name that looks similar.

Confirmation of Payee matches names, but it will not tell you whether a regulator really sent the request. A proper bank account ownership check and ABN verification catch the mismatch that a convincing story hides.

Before your next payment run, try our free compliance readiness check. It takes a few minutes and shows where your process is exposed.

Related reading: AUSTRAC Tranche 2: Verify the Client and the Bank Account, PEXA Settlement Scams Index: Under 1% Spot a Fake Email.

What should you do this week?

• If anyone claiming to be from AUSTRAC contacts you, end the conversation and call AUSTRAC on the contact details published on its website, not the ones the contact gave you.
• Tell the whole team, not only principals, so anyone who gets an approach knows what to do.
• Make bank account verification a fixed step before any non-routine payment goes out.
• Report an approach to AUSTRAC, and report any loss through ReportCyber. Early reports give investigators and banks the best chance of freezing funds.

The regulator will not message you on WhatsApp to ask for money. And whatever story comes with a payment request, the account it points to is either verified or it is not.

Frequently Asked Questions

Does AUSTRAC contact businesses on WhatsApp?

No. AUSTRAC has said it does not use messaging apps to handle cases.

Will AUSTRAC ever ask for payment in cryptocurrency?

No. AUSTRAC has said it will never ask for payment in virtual currencies or through social media apps, or ask for extra payment to resolve a matter.

What should I do if someone claiming to be from AUSTRAC contacts me?

End the conversation and call AUSTRAC on the contact details published on its website, not details the caller gave you.