Building a home means a lot of documents flying around: plans, contracts, variations, invoices, progress claims, ID and bank details. Most of it goes by email attachment. That's convenient, and it's exactly why scammers love it.
Before anything else, here's the one rule that matters most:
Never pay a deposit or progress claim to new bank details received by email. Call your builder on a number you already have and confirm the details before you pay.
How the payment scam works
It's called business email compromise, or a payment redirection scam. A criminal gets into someone's mailbox, usually the builder's, a supplier's or yours, and quietly watches. When a payment is due, they send an invoice that looks exactly like the real one, with one change: the bank details. Often there's a note saying the old account is closed and payments there will bounce.
It isn't a "what if". In 2024 a Victorian construction company paid about $938,000 to criminals after a supplier's email account was compromised and a fake invoice arrived with new bank details. Their bank, Bendigo Bank, recovered most of it, but that was luck as much as anything. Many people never see their money again.
For homeowners, the target is usually your deposit or a progress claim. Those are big amounts, paid on a predictable schedule, which is exactly what a scammer is waiting for.
Protect your payments
- Verify bank details by phone on a number from your contract or the builder's website, never from the email asking you to pay.
- Be suspicious of urgency. "Pay today or the job stops" is a classic pressure tactic.
- Treat any change of bank details as a red flag until you've confirmed it by phone.
- Turn on multi-factor authentication for your email. It's the single best way to stop someone getting into your mailbox.
- If you think you've paid a scammer, call your bank immediately. Speed matters. Then report it at cyber.gov.au.
Share links don't stop this scam on their own. A hacked mailbox can send a link just as easily as an attachment. The phone call is what protects your money.
Why attachments are risky
Payment scams aren't the only problem with emailing files.
- Malware. Attachments are one of the most common ways malicious files spread. Open the wrong one and your computer is compromised.
- No control. Once you send an attachment, it can be forwarded, copied and stored forever. Your ID, contract and bank details may be sitting in a dozen inboxes you'll never know about.
- Version confusion. Three copies of the plans, all slightly different. Someone builds from the wrong one. On a building site, that's an expensive mistake.
The Australian Signals Directorate received over 87,400 cybercrime reports in 2023 to 2024, about one every six minutes. Construction, with big payments and lots of parties, is an obvious target.
Why share links are better
A share link points to one file stored on a secure platform, instead of sending a copy. Good platforms let you:
- Control access. Decide who can view, edit or download.
- Set expiry dates. The link stops working after a set time.
- See who opened it. Audit trails show who accessed the file and when.
- Keep one version. Everyone sees the latest plans, not whatever was attached three weeks ago.
- Revoke access. Changed your mind, or sent it to the wrong person? Switch the link off.
For your personal documents, like ID, contracts and finance paperwork, that control matters. If your builder or broker offers a secure portal or share link, use it. If they ask you to email your passport and payslips, it's fair to ask if they have a safer option.
The law and your personal information
The Privacy Act 1988 and the Australian Privacy Principles set rules for how businesses collect, store and share personal information. Under the Notifiable Data Breaches scheme, a business covered by the Act must tell the Office of the Australian Information Commissioner (OAIC) and the people affected when a data breach is likely to cause serious harm.
Penalties were increased in December 2022. For serious or repeated privacy breaches, a company can now face the greater of $50 million, three times the benefit obtained, or 30% of its adjusted turnover for the relevant period. See the OAIC website for details.
Regulation has gaps, though. When we raised a data broker's practices with the OAIC, the response focused on the broker's business rather than the privacy risk. That's a gap homeowners should be aware of. The less personal information you scatter across inboxes, the less there is to leak.
What builders and trades should do
If you run a building business, the basics are straightforward:
- Turn on multi-factor authentication for every email account.
- Move to a secure file sharing platform for plans, contracts and anything containing personal or financial information.
- Put a call-back rule in place. Any change to supplier or client bank details is confirmed by phone before money moves.
- Keep software up to date and train your team to spot phishing.
- Tell your clients you will never change your bank details by email, and ask them to call you if they ever get an email saying otherwise.
Cost and habit are the usual hurdles. Most platforms have free tiers, and the paid features like permissions, expiry and audit trails cost far less than one diverted progress payment.
We've used Dropbox, Google Drive, Box and Tresorit over the years. We pay for Egnyte, which suits architecture, engineering and construction work well: it handles large drawings, has built-in PDF editing and signing, and its Project Control add-on is handy for tagging site photos and setting file expiry. We also have a pCloud account for personal storage. Pick whatever suits your business, as long as it gives you access control, expiry and audit trails.
The bottom line
In construction, you wouldn't accept dodgy workmanship on site. Don't accept it in your digital tools either. Use share links instead of attachments where you can, turn on multi-factor authentication, and above all, never pay new bank details from an email without a phone call first.
FAQs
Are share links safe for sensitive documents?
On a reputable platform with encryption, access controls and audit trails, yes. Set view-only access and an expiry date for anything sensitive.
What if someone forwards my link?
You can restrict a link to named people who must sign in, so a forwarded link won't open for anyone else. You can also switch the link off at any time.
Does the recipient need an account?
Usually not. Most platforms let you share a link that opens in a browser, with optional password or sign-in for sensitive files.
Will a share link stop payment redirection scams?
No. A scammer in a hacked mailbox can send a link as easily as an attachment. Always confirm bank details by phone on a number you already have.
Further reading
Anthony Painter
