Last updated: 7 July 2026 · By Cordell Smith, Director, Zettle · General information only — not legal advice.
The short version: The biggest financial risk when you buy or sell a home isn't the market — it's a scammer intercepting the emails around your settlement and swapping in their own bank details. It's called payment redirection fraud, and it costs Australians tens of millions of dollars a year. Tools like PEXA Key exist to stop it, and a conveyancer who uses one is taking your security seriously. At Zettle we agree so strongly that we built that same protection into everything we do — every conversation runs through one secure app, locked to your face, with your identity verified before anyone can act on your file.
Key facts at a glance
- The threat: payment redirection fraud — scammers swapping bank details in intercepted settlement emails.
- The scale: property scam losses in Australia rose to around $43 million in 2024, roughly triple three years earlier (ACCC data cited by PEXA).
- PEXA Key: a good, free app that secures the bank-detail step and tracks your settlement — but it does not verify your identity.
- Zettle's approach: secure communication and biometric identity verification built into your whole matter, not bolted on for one step.
- What to do: ask any conveyancer how they protect your communication and verify who you are.
What is payment redirection fraud?
It's the most common scam in Australian property, and it's frighteningly simple. A criminal quietly watches the email correspondence around a settlement — often after compromising an email account somewhere in the chain, a technique known as business email compromise. Then, right when money is due to change hands, they send a convincing email with “updated” bank details. The address might differ by a single character. The money is transferred to the scammer and is usually gone within hours, laundered offshore before anyone notices.
This isn't rare. According to figures PEXA drew from the ACCC, losses from property scams in Australia climbed from around $13 million in 2021 to roughly $43 million in 2024 — about triple in three years. In one PEXA-commissioned study, 97% of recent and prospective buyers failed to spot the warning signs in a scam settlement email. Individual buyers have lost life-changing sums — more than $700,000 in one Western Australian case.
The common thread in almost every case? Email. Bank details were sent, changed, or confirmed over ordinary email, and that's where the trust was broken.
What is PEXA Key, and is it a good thing?
PEXA Key is a free app from PEXA that tackles this head-on. Instead of emailing your bank account details to your conveyancer, you enter them into the secure app and they flow straight into the settlement platform — encrypted, with no vulnerable email in the middle. It also lets you track your settlement and get notified of key milestones, and PEXA backs the secure exchange of those details with a guarantee.
It's a genuinely valuable tool. If your conveyancer uses PEXA Key, that's a good sign — it means they take your money and your data seriously. We have no quarrel with it. It proves something we've believed from day one: insecure communication is the single biggest vulnerability in a property transaction, and closing it should be non-negotiable.
Does PEXA Key verify my identity?
No — and this is worth understanding. PEXA Key secures the bank-detail exchange and tracks your settlement. It does not verify who you are. That's a separate job, and it comes in two parts:
- Verification of identity (VOI) — confirming you are who you say you are, so the correct person is the one dealing with the property. This isn't new; it's been a requirement under the national ARNECC rules for years, and it's what stops a criminal impersonating you.
- Anti-money-laundering (AML) checks — an additional layer that, since 1 July 2026, every conveyancer must also perform. Where VOI confirms your identity, AML checks whether that identity is safe to transact with. (We've explained the new AML rules in plain English in our guide to the AML checks now applying to your property settlement.)
So a good conveyancer needs two protections working together: securing your communication (so no one tampers with instructions), and verifying your identity (so no one can pretend to be you, and so the person transacting is safe to deal with). PEXA Key covers part of the first. It doesn't touch the second.
How does Zettle protect me — and why is it different?
Most secure conveyancing tools are a separate app, bolted on beside everything else. Your conveyancer runs the whole matter over normal email, then reaches for a dedicated app just for the bank-details moment. That's a real improvement — but it only protects one step, and only if it's switched on and used.
And there's a gap even then. The details inside PEXA Key are only as good as the information the conveyancer keyed into their PEXA workspace in the first place. Those two points are bank-grade encrypted — but how did your conveyancer get your details to begin with? If that happened over email, the email is the weak link, and a chain is only as strong as its weakest link. Locking the last step doesn't help if the information reached it through an inbox a scammer could read.
We took a different view. If secure communication is that important — and it is — it shouldn't be an add-on. It should be the foundation. So at Zettle:
- Every conversation happens in one secure, encrypted channel — not scattered across email. There's no email chain for a scammer to intercept or impersonate, because we don't run your matter over email in the first place.
- Your communication is locked to your face. Access to your matter uses facial biometrics — the same face or fingerprint recognition that secures your banking app. A password can be stolen or guessed; your biometrics are far harder to fake.
- We verify who you are, not just how to reach you. We biometrically confirm your identity against your government-issued ID (through our identity partner, Livesign) at the moment it matters — when you sign. That one check, which takes about 4 minutes on your phone, then secures every later communication on your file, so a criminal can't impersonate you to redirect your settlement money.
- It's all in one place. Chat, documents, signing, identity checks and settlement tracking live in a single app you use throughout your matter — so the security is always on, not something anyone has to remember to switch to.
To be clear about what this means: like every conveyancer, we settle through the national PEXA network — that's the trusted rail the whole industry runs on. What we've changed is everything around it: how you and your conveyancer communicate, how your identity is confirmed, and how your documents are signed. That's the part where fraud actually happens, and that's the part we've locked down end to end.
Do I still need PEXA Key if my conveyancer uses Zettle?
No. Zettle clients don't use PEXA Key — Zettle replaces it and does more. We secure your bank details directly in the app, so there's no separate tool to download and no email step to get that information to us in the first place. Then we go further: your whole matter runs through the same secure channel, locked to your face, with your identity verified before anyone can act on your file. You're not giving anything up on settlement, either — like every conveyancer, Zettle still settles through the national PEXA network. The difference is how much of the journey around settlement is protected: with Zettle, all of it, from the very first message.
What should I ask any conveyancer about security?
Whether you choose Zettle or not, ask these before you hand over your details:
- Do you secure all of our communication, or just the bank-details step?
- PEXA Key secures my bank details — but how do you actually know it's me you're dealing with, and not someone impersonating me?
- How do you protect the channel we talk through — is it tied to my identity?
- Do you verify my identity biometrically when I sign?
- Are your identity checks, signing and messaging integrated, or spread across separate tools?
- Are you set up for the anti-money-laundering checks that apply to every settlement since 1 July 2026?
A conveyancer who can answer all of these with confidence is one who takes your security as seriously as you do.
Frequently asked questions
What is PEXA Key?
PEXA Key is a free app from PEXA that lets you send your bank account details to your conveyancer securely, instead of by email, so they can't be intercepted before settlement. It also lets you track your settlement. It's a good tool, and a conveyancer who uses it is taking your security seriously.
Does PEXA Key verify my identity?
No. PEXA Key secures the exchange of bank details and tracks your settlement, but it does not verify who you are. That's a separate, two-part job: verification of identity (VOI) confirms you're the right person dealing with the property — a long-standing requirement under the national ARNECC rules — while anti-money-laundering (AML) checks, which every conveyancer must perform since 1 July 2026, confirm that identity is safe to transact with.
What is payment redirection fraud in property?
It's when a scammer intercepts the emails around your settlement and, right when money is due to move, sends a convincing message with new bank details. The funds go to the criminal and are usually gone within hours. It's the most common scam in Australian property, and it almost always starts with email.
How does Zettle protect me from settlement fraud?
Zettle runs your whole matter through one secure, encrypted app rather than email, so there's no email chain for a scammer to intercept. Access is protected by facial biometrics, and your identity is biometrically verified against your government ID when you sign — so a criminal can't impersonate you to redirect your money.
Do I still need PEXA Key if my conveyancer uses Zettle?
No. Zettle clients don't use PEXA Key — Zettle replaces it and does more. We secure your bank details directly in the app, run your whole matter through the same secure channel locked to your face, and verify your identity before anyone can act on your file. Like every conveyancer, Zettle still settles through the national PEXA network.
PEXA Key is encrypted — so isn't my conveyancer's version safe enough?
The exchange inside PEXA Key is bank-grade encrypted, but it can only protect the details your conveyancer already keyed into their PEXA workspace. The question is how those details got there in the first place. If you sent them by email, that email is the weak link — and a chain is only as strong as its weakest link. So it's worth asking any conveyancer: even if you use PEXA Key, how do you collect my details from me to begin with? Zettle removes that gap by keeping everything in one secure channel from the first message.
What security questions should I ask a conveyancer?
Ask whether they secure all of your communication or just the bank-detail step; if they use PEXA Key, how they actually know it's you they're dealing with and not someone impersonating you; how they protect the channel you talk through; whether they verify your identity biometrically when you sign; whether their identity, signing and messaging are integrated; and whether they're set up for the AML checks that apply to every settlement since 1 July 2026.
Does Zettle still use PEXA?
Yes. PEXA is the national settlement network the whole industry uses, and Zettle settles through it. What Zettle secures is everything around settlement — how you communicate, how your identity is confirmed, and how your documents are signed — because that's where fraud actually happens.
Zettle is a digital-first conveyancing service. The above is general information about settlement security and the AML/CTF rules and isn't legal advice for your particular situation — for that, it's a Zettle conversation. Worried about scammers in your property transaction? Just Zettle it.
