26 August 20265 minute readLANTEK Computers
This is the most profitable fraud in South African property, and almost nothing
about it looks like an attack while it is happening. There is no suspicious
attachment, no misspelled domain and no obvious warning sign. That is the design.
How it actually works
An attacker compromises one mailbox in the chain, most often at the agency or
the conveyancer, then reads quietly for weeks. They are not looking for anything
to steal yet. They are learning the language of the transaction, the names, the
timing and the amount.
When a transfer or deposit is due, they send the buyer new banking details from
a genuine account, in a genuine thread, at exactly the right moment. The buyer
pays. The money is gone within minutes, and by the time anyone in the chain
compares notes it has moved through several accounts.
Why the agency, when the conveyancer holds the money
Because the agency is usually the softest entry point into the conversation and
the most trusted voice in it. Buyers act on what their agent tells them.
An attacker does not need access to the trust account to redirect a payment.
They only need access to the thread in which the payment is being discussed. That
is a much lower bar, and it is why the agency is targeted even though the money
sits somewhere else.
The one control that stops it
Telephone verification of any banking detail, on a number obtained
independently before the transaction began, and a written warning to every buyer
at the start that banking details will never change by email.
Both are process controls rather than technical ones. Together they defeat an
attack that no email filter alone can reliably catch, because the email is
genuine, sent from a real account, by someone who has been reading the thread for
a month. There is nothing for a filter to object to.
The detail that makes it work is the phrase obtained independently. A
number in the signature of the email asking you to verify is not verification.
The signal that a mailbox has been compromised
A mailbox rule automatically files or forwards incoming mail. Attackers create
one immediately after compromising an account, so that replies from the real party
are hidden from the account owner while the fraud runs.
An unexplained new rule is one of the clearest signals of compromise available,
and it is specifically worth monitoring for. It is also invisible to the person
whose account it is, which is precisely why somebody else has to be watching.
What POPIA adds
An agency holds identity documents, income verification, bank statements and
contact details for buyers, sellers and tenants. That is a substantial
concentration of personal information, and Section 19 requires documented access
control, encryption, tested backup and an incident response process. A breach
involving FICA documentation is a serious one.
What to put in place
Enforced multi-factor authentication and monitoring for mailbox rule changes.
Email security that flags a first-ever banking change. Encrypted devices for
agents working from cars and show houses. Independent Microsoft 365 backup. Dark
web monitoring. And awareness training built around this scenario specifically,
rather than phishing in the abstract.
More of what that looks like for an agency is on the
real estate and property
page, or start with the
free health check.