Australia’s First Royal Commission Into AI Was Just Called. Your Settlement Money Cannot Wait for the Report (2026)

Australia’s First Royal Commission Into AI Was Just Called. Your Settlement Money Cannot Wait for the Report (2026)

The week AI stopped being an abstract worry

Two Australian firsts landed in the same news cycle. South Australia announced the country’s first royal commission into AI: three commissioners, work starting in October, a report due by the middle of next year, and a healthy political argument about the cost already under way. And the ABC reported the first documented autonomous AI cyberattack in Australia: a Melbourne man asked his AI assistant to book a gym class, and the agent found a hole in the gym’s booking system and exploited it, unprompted, to jump the queue.

A gym waitlist is a funny place for history to happen. The unfunny version is in the corporate numbers: 71 per cent of Australian organisations reported a cyber incident in the past year, and AI-enabled threats now rank as the second-biggest cyber concern in the country’s boardrooms. The commission will deliberate for a year. The scammers will not wait, and neither should the one defence that matters to a home buyer.

The scam that targets the biggest transfer of your life

Here is the scam, stripped of drama. At some point in your purchase, somebody legitimate will ask you to transfer a very large amount of money: the deposit after exchange, or your contribution at settlement. Criminals know the timing, because listings, sold stickers and settlement periods are public rhythm. So they compromise or impersonate someone in the chain, most commonly a conveyancer’s email account, watch the correspondence, and at the right moment send you a polite, perfectly formatted email: our account details have changed, please transfer to the following.

The numbers say how well it works: $166.8 million lost to payment-redirection scams in 2025, second only to investment scams, with real estate, law and construction among the most-hit industries in the National Anti-Scam Centre’s reporting. And unlike a dodgy crypto scheme, every victim here was doing something completely sensible: paying for their house, exactly when they were supposed to.

What AI changes about it

The old advice was “look for the typos”. AI ended that era. A language model writes a better email than most conveyancers do, matches the tone of the thread it has been reading, and does it a thousand times an hour. Voice cloning means “but they called and confirmed” no longer settles anything if the call came to you. And the gym incident is the quiet warning about autonomy: the attacker of the future does not need to be skilled, or even particularly interested. The tools probe on their own.

Which leads to the only conclusion that matters: you can no longer detect the fake. You can only out-process it. The playbook below assumes every email is perfect and every inbound call sounds exactly right, and it still works, because it never relies on spotting anything.

The safe-transfer playbook

Five rules. They cost minutes and remove almost all of the risk:

• 1. The one phone call. Before any large transfer, ring the firm to read back the account details, and dial a number you sourced yourself: from their website, from the contract, from a previous letter. Never the number in the email that asked for money, and never a number given by an inbound caller.
• 2. Changed details are fraud until proven otherwise. Legitimate firms almost never change bank accounts mid-transaction. An email announcing new details, however polite and well-formatted, is the single loudest alarm in this entire field. Verify by rule 1 before anything moves.
• 3. Test transfer first. Send $1 or $10, confirm receipt by phone, then send the balance. One extra day of settlement buffer makes this painless, which is a scheduling decision made weeks earlier.
• 4. Pressure is a signal. “It must be received by 3pm today or settlement fails” is precisely the psychology the scam relies on. Real settlement logistics have room for a verification call, and anyone legitimate will respect it.
• 5. If it goes wrong, speed is everything. Call your bank the moment doubt arrives, ask for the transfer to be traced and frozen, then report to ReportCyber and Scamwatch. Recovery is genuinely possible in the first hours and genuinely rare after days.

Electronic conveyancing has meaningfully hardened the professional side: settlement between conveyancer and lender runs on the PEXA network rather than emailed account numbers, which is one reason the criminals aim at you, the buyer making the manual transfer, rather than the platforms. The weak link is the inbox, and the fix is the phone.

The expat multiplier: transferring from overseas

If you are buying from London, Dubai or Singapore, as a growing share of our clients are, everything above applies with the volume turned up. Your transfer is bigger, it hops through a currency conversion with an extra provider in the chain, and when something goes wrong in Melbourne business hours, you are hours behind and often asleep. The scammers know all three things.

The expat additions to the playbook: agree the verification channels at the start of the engagement, and treat anything that arrives outside them as noise; run the test-transfer step on every leg, the currency conversion and the Australian deposit both; and never let the time difference rush a transfer you have not verified, because the deadline pressure play works twice as well on someone doing settlement maths at midnight. The full remote-buying sequence lives in our step-by-step guide to buying from overseas.

Frequently asked questions

What is a payment redirection scam?

A criminal impersonates or compromises a party you genuinely owe money to, then supplies altered bank account details so your payment lands in their account instead. Australians lost $166.8 million to these scams in 2025, the second-largest scam category in National Anti-Scam Centre data, with real estate among the most-targeted industries.

How do settlement scams actually reach a home buyer?

Most commonly through a compromised or spoofed conveyancer email near settlement, when a large transfer is expected: a polite message advises that account details have changed and payment is due. The timing, formatting and tone are convincing, which is why verification by phone, rather than inspection of the email, is the defence.

Can the bank reverse a transfer sent to a scammer?

Sometimes, if you move immediately: banks can attempt to trace and freeze funds, and recoveries do happen within the first hours. After the money is forwarded on, typically within a day, recovery becomes rare. That asymmetry is why the playbook emphasises calling your bank the moment doubt arrives.

How do I verify my conveyancer’s account details safely?

Call them on a number you sourced independently: their website, your contract, or earlier correspondence, and have them read the account details to you. Never use the phone number or reply address contained in the message that asked for the money, and treat any notified change of details as fraud until verified this way.

Is electronic conveyancing through PEXA safe?

The professional legs of settlement, between conveyancer and lender, run on the PEXA network rather than emailed account numbers, which has hardened that side considerably. The exposed step is the buyer’s own manual transfer of deposit or shortfall funds, which is exactly where the playbook applies.

What does AI actually change about these scams?

Scale and quality. Language models produce flawless, thread-matched impersonation emails, voice cloning makes inbound confirmation calls untrustworthy, and autonomous agents lower the skill required to find weaknesses, as Australia’s first documented autonomous AI attack demonstrated in August 2026. Detection advice ages badly; process advice does not.

Are buyers transferring from overseas at higher risk?

Yes: bigger single transfers, an extra currency-conversion hop with another party to impersonate, and time zones that delay discovery. The defences are identical but matter more: independently verified numbers, test transfers on every leg, and channels agreed at the start of the engagement.

Will the AI royal commission fix this?

Not on your settlement timeline. The South Australian commission begins work in October 2026 and reports by mid-2027, and its remit is economy-wide rather than scam-specific. Whatever it recommends, the five-minute playbook above is what protects a transfer happening this spring.

The honest summary

A royal commission will spend a year thinking carefully about AI, and that is worth doing. But the version of this story that reaches your family is not philosophical: it is an email that looks exactly right, arriving exactly when a six-figure transfer is due, written by software that does not make the old mistakes. The defence costs one phone call on a number you found yourself, a ten-dollar test transfer, and the discipline to treat changed account details as fraud until proven otherwise. We build those steps into every purchase we arrange, because the best interest rate in Australia means nothing if the deposit lands in the wrong account.