10 Tips To Avoid House Deposit Scams In 2025

10 Tips To Avoid House Deposit Scams In 2025 Banner
Sebastian Salla author profile photo
Sebastian Salla Last Updated: January 12, 2025
Follow:

Buying houses has become an extremely stressful and anxiety-inducing experience due to the growing prevalence of cybercriminals preying on house buyers, aiming to steal house deposits during the settlement process.

In this blog post, we'll teach you how to avoid falling victim to house deposit scams and inform you of the latest techniques being used by cybercriminals.

Disclaimer:

The tips provided in this blog post are purely informational, and CanIPhish does not assume any responsibility in the event that you fall victim to a house deposit scam. If you do fall victim, please get in touch with your local or national cybersecurity authority.

1. Confirm Who Will Be Holding The House Deposit

Typically, house deposits are held in a trust account that's controlled by either the seller's real estate agent or the seller's conveyancer. The property purchase contract outlines who this party is, how much needs to be deposited, and what bank account will hold the money.

It's important to understand who will be holding the house deposit so you can verify when the funds have been received and who is accountable for securing the funds while they're held in trust.

Make sure your know who's holding the house deposit

2. Only Use Verified Contact Information

During a house purchase, you need to interact with a number of different parties, all of which are unfamiliar. Because of this, it's important to always verify that the person you're communicating with is who they say they are. Depending on who the contact is and the type of communication they're using, you can verify them in a few different ways:

Real Estate Agent Phone Number

Verify in person or through an existing trusted communication channel (e.g., the phone number is listed on a reputable real estate listing website that verifies real estate agent identities).

Real Estate Agent Email Address

Verify in person, through an existing trusted communication channel, or by visiting the real estate agent's website (found through a Google Search or similar) to match the email address with the website domain.

Conveyancer Phone Number

Verify verbally with the real estate agent either in person or through an outbound call to the real estate agent. The phone number should match what's provided in the property purchase contract.

Conveyancer Email Address

Verify verbally with the real estate agent either in person or through an outbound call to the real estate agent. The email address should match what's provided in the property purchase contract.

Before making the house deposit, all of the above contact information should be verified, and all important communication should be inspected to ensure it matches the verified contact information.

3. Remain Cautious Of Any Last Minute Changes

Have you received duplicate emails from a real estate agent or conveyancer? Received a last-minute change in payment instructions? Or any other urgent last-minute requests?

Cybercriminals will often use urgency to bypass much of the critical thinking we typically apply when mentally processing requests. If you receive any urgent or last-minute requests, take a step back and give the request the due time it deserves. Before actioning the request, speak with the requestor through an alternate communication channel (e.g., if the request was received from the real estate agent via email, then validate the request with the real estate agent by giving them a phone call).

4. Carefully Scrutinize Email Sender Addresses

Cybercriminals will often use lookalike email addresses to trick victims into thinking the email originates from a legitimate sender. There are a number of techniques that cybercriminals will use to create these addresses:

Similar Top-Level Domains thumbnbail

Similar Top-Level Domains

Top-Level Domains (TLDs) are the most right-side part of an email address (e.g., the ".com" or ".org" portion). Cybercriminals will use different but similar TLDs to create lookalike email addresses.

Legitimate-Looking Subdomains thumbnbail

Legitimate-Looking Subdomains

Cybercriminals will use legitimate-looking subdomains to try and obfuscate the actual domain in use. This technique attempts to abuse a lack of understanding of what subdomains are and how they're used.

Domain Typosquatting thumbnbail

Domain Typosquatting

Domain typosquatting is when one or more characters in the domain portion of an email address are slightly rearranged. This abuses the way the human mind processes words, whereby we subconsciously overlook small typos or character transpositions when processing words.

Homograph Domains thumbnbail

Homograph Domains

A homograph domain involves the replacement of certain characters with similar-looking ones that are hard to visually distinguish between. Similar to domain typosquatting, this technique abuses the way human minds process words and overlooks small mistakes.

5. Don't Trust Inbound Phone Calls Or Text Messages

Unfortunately, the network protocols used to transmit inbound phone calls and SMS text messages don't perform any form of sender authentication. This means that cybercriminals can spoof the phone number they're using and make it appear that phone calls or text messages appear from a legitimate and trusted phone number.

If you ever receive an inbound phone call or text message, and you're asked to perform a sensitive action, such as transfer funds, try calling the number back and confirm with the person who answers that they did indeed call you or send the text message you received.

Graphic with additional information about being wary of inbound calls and texts

6. Always Verbally Verify Bank Account Information

No matter how you've received the bank account information that will receive the house deposit, always ensure you validate this information through an alternate communication channel.

For example, if you've received the bank account information through a property purchase contract that was received over email, validate the information with the account holder in person or through a verified phone number. This helps mitigate the risk of a fake contract being sent from a hacked email account.

7. Confirm Your Devices And Online Accounts Are Secure

If there's ever a time to ensure the security of your computer and mobile phone, it's when buying a house. Cybercriminals often lie in wait, waiting for the perfect opportunity to strike. They may try to opportunisticly insert themselves if they see you're about to purchase a property.

For example, if a cybercriminal has access to your email account, they may passively monitor your emails until they see something of interest, such as a property purchase being initiated. With this inside knowledge, they're perfectly placed to attempt a house deposit scam.

To help minimize your exposure, you should:

  • Ensure all your devices are up-to-date with the latest security patches.
  • Ensure your online accounts have strong passwords and multi-factor authentication (MFA) enabled.
  • Avoid installing any unnecessary or untrusted software on your devices. This includes downloading and opening suspicious attachments in emails.

8. Communicate Regularly And Across Multiple Channels

Cybercriminals rely on a lack of consistent communication to insert themselves into the property purchase process. By staying in regular contact and across multiple channels of communication, you'll be able to quickly identify any irregularities where a cybercriminal has attempted to insert themselves.

This communication should be persistent and occur at all key stages of the property purchase process, such as when the property contract is signed, before sending the house deposit, after sending the house deposit, before settlement, and after settlement.

Graphic with additional information about staying connected throughout the purchase process via multiple means of communication

9. Document And Store All Important Communication

Communicating in person and over the phone is crucial to validating whether the bank account information you're about to send a house deposit to is valid. However, unless you're recording conversations (which is illegal without consent in most jurisdictions worldwide), it's always a good move to document and share any verbal communication in a written format for evidence-tracking purposes.

This gives you additional peace of mind that what's been verbally communicated won't be misconstrued, misremembered, or forgotten if required at a later date.

10. Ask Questions And Trust Your Gut

Most people only buy one property in their entire lifetime. Real estate agents and conveyancers know this and are often very open to providing advice or answering any questions to help settle concerns during the property purchase process.

However, if something doesn't seem right, trust your gut. Validate your understanding with friends, family or through trusted third-party entities, such as government or consumer-focused resources.

Final Things To Do When Sending A House Deposit

In the minutes before sending a house deposit:

  • Double-check that your contact information for the real estate agent and seller's conveyancer is valid and correct.

  • Call the real estate agent or seller's conveyancer to do a final validation of the bank details to be used for the house deposit.

  • Send an email to all parties (real estate agent, seller's conveyancer, and your conveyancer) that, per your phone discussion, you are about to initiate the house deposit transfer, including the bank details in the email.

  • Call your bank to verify if the provided bank account name matches the name in their systems and if they can confirm if the account is held by the entity or individual listed in the property purchase contract.

In the minutes after sending a house deposit:

  • Call the real estate agent or seller's conveyancer to confirm if they can see the house deposit within their trust account.

  • If the funds have not yet been seen, contact your bank to confirm if the funds have been released or have been put on a time-delay security hold. If possible, confirm when this hold will be finalized.

  • Once it's verified that the funds have been released, ask for validation that the funds have been received through multiple communication channels (e.g., email, then a phone call, or vice-versa).

Free Downloads

Download the house deposit checklist and more!

The CanIPhish team has created dozens of free cybersecurity posters, guides, and infographics!

See the full range of free content

Frequently Asked Questions

What Is A House Deposit Scam?

House deposit scams are a type of social engineering attack where cybercriminals insert themselves into the property purchase process and trick the buyer into sending the house deposit to a bank account that the cybercriminal controls.

How Do Cybercriminals Know Who To Target For House Deposit Scams?

Cybercriminals use a range of tactics to perform house deposit scams, but most commonly, the scams are initiated by the hacking of email accounts associated with companies or individuals involved in the property purchase process (i.e., real estate agents, conveyancers, and buyers agents).

Hacking these email accounts provides cybercriminals with inside knowledge of the property purchase, which can be weaponized to craft highly targeted spearphishing emails that are used to trick the house buyer into sending their deposit to a bank account controlled by the cybercriminal.

What Impact Does AI Have On House Deposit Scams?

AI acts as an enabler, providing cybercriminals with the means to automate phishing attacks and broaden who their potential victims are. As of 2025, AI does this by:

  • Automating the creation of fake documents.
  • Automating the creation of initial phishing messages.
  • Automating the processing and responding to queries over text and voice.
  • Providing highly accurate language translation services over text and voice.
  • Cloning the voices of trusted individuals for use in phone discussions.
  • Cloning the visual likeness of trusted individuals for use in deepfake video calls.

As publicly available AI technologies continue to evolve and improve, these capabilities will progressively become more accessible to cybercriminals and harder to detect by victims.

Glossary Article

Learn about AI-powered callback phishing attacks.

Can you get hacked by simply calling someone back?

Learn about callback phishing here!
Sebastian Salla - Avatar profile photo
Written by Sebastian Salla

A Security Professional who loves all things related to Phishing and Security Awareness Training.

Follow: