Stopping Vendor Identity Fraud in Real Estate

Vendor identity fraud happens when someone poses as a property’s registered owner to sell a place they do not own. Agents stop it by completing customer due diligence on the seller before any service starts. That means verifying the person’s identity against government sources, matching them to the registered proprietor on a current title search, and escalating anything that looks wrong. Since the Tranche 2 obligations commenced on 1 July 2026, this is a legal requirement under the AML/CTF Act 2006 (Cth) and the AML/CTF Rules 2025, not only good practice.

Fraudsters often target properties where the owner is rarely present, such as vacant homes, investment properties and land held by owners living overseas. They often instruct by email and keep away from any face-to-face contact. This guide sets out the checks that defeat that approach, the red flags that should reach your compliance officer, and how a suspicion should be handled without alerting the person behind it.

TL;DR

• If you act for the seller, seller CDD must be complete before you provide the service. The delay in Rules section 6-32 is for the party you are not acting for, which is the buyer.
• Verifying that a person exists is not enough. Match the verified person to the registered proprietor on a current title search.
• For a company or trust seller, confirm who controls the entity and that the person instructing you has authority to sell.
• Escalate email-only contact, urgency, refusal of a video call and any changed bank account to your compliance officer.
• If you suspect on reasonable grounds that the seller is not who they claim to be, section 41 requires a suspicious matter report within 3 business days after the day you form the suspicion. Do not tip off anyone.

Table of Contents

• Why the seller is the point of attack
• What the law requires of you as the selling agent
• The checks that stop an impersonator
• When the seller is a company or trust
• Red flags that go to your compliance officer
• Suspicion, reporting and not tipping off
• A practical seller-onboarding workflow
• Our perspective: judgement stays with your people
• How AML Guard supports seller verification
• FAQ
• Sources

Why the seller is the point of attack

A fraudulent vendor needs only a few things: the owner’s name, which is available from public property records; a plausible identity document; and an agent willing to proceed on the strength of email instructions. The scheme depends on the agent treating the seller as a low-risk customer because the seller is the agent’s own client and the buyer is the party who pays.

That assumption is the weakness. The seller is the person you are contracting with, and if the seller is not the owner, every later step in the transaction rests on a false foundation. Buyers can lose deposits, genuine owners can discover their property has been marketed or sold without their knowledge, and the agency is left having to explain why its checks did not catch it.

The AML/CTF regime puts the checking obligation where the exposure is. As AUSTRAC explains, you must complete initial CDD before you start providing a customer with a designated service, and it involves identifying the customer, certain other persons and the customer’s ML/TF risk. In practice, for a selling agent that means before you sign the listing, market the property or negotiate with anyone, not after an offer arrives.

What the law requires of you as the selling agent

Under the Act and the Rules, a real estate agent brokering a sale provides a designated service to the seller. Section 28(1) of the Act bars you from starting that service until you have established each of the section 28(2) matters, including the seller’s identity, on reasonable grounds. The real estate delay in Rules section 6-32 is for the party you are not acting for. As AUSTRAC’s guidance on delayed initial CDD explains, if you act for the seller you must complete initial CDD on the seller before you start providing them with a designated service. CDD on the buyer can wait until the earlier of 28 days after the exchange of contracts and 3 days before the initially agreed day for settlement, and only if the conditions in section 29 of the Act are met. An agent acting for the buyer is in the mirror position: the buyer first, and the seller’s CDD can wait on the same terms.

In practice this means three things for your workflow:

1. No listing agreement acted on until the seller is verified. A signed authority from someone you have not verified is not a verified instruction.
2. No marketing on the strength of an unverified email. Photography, advertising and open homes all follow the checks, not precede them.
3. A record of the reasoning. If you apply enhanced measures or decline to proceed, the file should show why.

The Act also ties the depth of verification to risk: you collect and verify KYC information appropriate to the customer’s ML/TF risk (section 28(3)). A remote, overseas or unreachable owner of a vacant property is a risk factor your business-wide risk assessment should name explicitly, so that your policies ask for more in those cases, not the same as for a local owner-occupier who attends your office.

The checks that stop an impersonator

Think of the process as four questions, asked in order. A fraudster can often answer the first. Very few can answer all four.

1. Is this a real person, and is the identity genuine?

Collect the seller’s full name, date of birth and residential address, and verify them using independent and reliable data. AUSTRAC’s individual CDD guide gives a current passport or driver’s licence as examples of government-issued photographic identification you could verify. Where possible, verify the document against the issuing government source rather than relying on a visual inspection of a scan. Scans and photographs are exactly what a forger supplies.

If a person cannot obtain standard identity documents, or cannot access them because of circumstances beyond their control, Rules section 6-10 can treat their identity as established, but only if you have taken reasonable steps to establish who they are, have collected and taken reasonable steps to verify the KYC information that suits their risk, and have AML/CTF policies to mitigate and manage the extra risk. AUSTRAC publishes guidance on identifying individuals without standard ID. Treat that route with extra care in a vendor context: a person who claims to own a property but cannot produce any standard identification is a reason to slow down, not to be flexible.

2. Is the person present and the same as the document?

When the seller is not in your office, a document check alone does not show that the person holding the device is the person on the document. Biometric liveness, which compares a live capture of the face against the photograph on the document, addresses that gap. Our guide to verifying identity remotely under Tranche 2 explains how remote verification fits the program you are required to document.

A live video call with the seller is a reasonable additional step for high-risk instructions. A seller who refuses one, repeatedly, without a credible reason, has told you something.

3. Is this person the registered proprietor?

This is the check that defeats vendor fraud, and it is easy to skip when the identity document looks genuine. A fraudster can hold a perfectly genuine identity document in their own name, or a convincing forgery in the owner’s. Only the title search tells you whose name is on the property.

Obtain a current title search and compare the registered proprietor’s name, and any details recorded against it, with the person you have verified. Check these points:

• The name matches exactly, including middle names and any recorded variation.
• If there are joint proprietors, every proprietor is identified and every proprietor is instructing you, or you hold verified authority from the others.
• The address on the title, the address the seller gives you and the address on the identity document are reconciled. A mismatch is not proof of fraud, since owners move, but it needs an explanation you can record.
• The title search is current, not a copy supplied by the seller.

A discrepancy between the person and the registered proprietor is the most important red flag in the whole process. Do not explain it away to preserve the listing.

4. Does the person have authority to sell?

If someone is acting for the owner, such as a family member, a property manager or a lawyer holding a power of attorney, you must establish the identity of the representative and their authority to act, as well as the identity of the person they represent. AUSTRAC’s individual CDD guide lists the identity of any person acting on the customer’s behalf, and their authority, among the matters you must establish.

Ask for the authority document, then confirm it independently. Contact the owner or the law firm using details you have found yourself, not the phone number or email on the document you were given.

When the seller is a company or trust

Impersonating a company director is harder to spot than impersonating an individual, because the paperwork is more complex and the agent’s attention goes to the entity rather than the people. The principle is the same: verify who controls it, and that they can sell.

For a company seller:

• Resolve the entity on its ACN and confirm it is registered and the registered office and officeholders match what you have been told.
• Identify the beneficial owners: individuals who directly or indirectly own 25% or more, or who otherwise control the entity. AUSTRAC’s guidance on ownership and control requires you to keep tracing through the chain until you reach the individuals at the end of it.
• Do not rely on shareholding alone. Ownership is a stake; control is influence. A person with no significant shareholding can still control the company.
• Confirm that the person instructing you is an officer or has documented authority, and verify that person’s identity as you would any individual.

For a trust or self-managed super fund seller, the registered proprietor is usually the trustee, often a corporate trustee. Look through to the people who control the trustee, and review the trust deed where your program calls for it. Our pages on beneficial ownership for trusts, SMSFs and companies and tracing beneficial owners in property transactions walk through the determination step by step.

A fraudster hides behind complexity. If the structure is layered without a commercial reason, or the person instructing you cannot explain it, treat the complexity itself as a risk indicator.

Red flags that go to your compliance officer

Some signals are weak individually and strong together. AUSTRAC’s real estate program starter kit gives worked examples of dealing with customers at different risk levels, and it is a useful model for the scenarios your own policies should cover. For vendor fraud, the following should be escalated the same day:

The agent who notices the signal is rarely the person who should decide what happens next. Route it to the compliance officer, who decides whether to apply enhanced due diligence, decline the instruction or consider a report.

Suspicion, reporting and not tipping off

If, after your checks, you suspect on reasonable grounds that the seller is not the person they claim to be, a suspicious matter reporting obligation arises under paragraph 41(1)(d) of the Act. Paragraph 41(1)(f) can apply as well, where information you hold may be relevant to the investigation of an offence. The report is due within 3 business days after the day you form the suspicion (section 41(2)). Your policies should say who decides, usually the compliance officer, and the decision should rest on the facts you hold, recorded at the time.

Two disciplines matter here:

• Document what you did and why you are suspicious. Record your attempts to verify, any refusal to cooperate, any information that appears false, and the reasoning. This forms part of your compliance record.
• Do not tip off. Under section 123 of the Act it is an offence to disclose that a suspicious matter report has been given or is required, or what it contains, where the disclosure would or could reasonably be expected to prejudice an investigation. It does not matter whether an investigation has started. In practice, say nothing to the person about your suspicion or any report. Keep your manner neutral. You can decline to proceed or ask for further verification without explaining your suspicion. Limit internal discussion to those who need to know.

If you have already started marketing a property before the concern arose, take your compliance officer’s direction on how to pause without revealing the reason. The Rules and the Act are in force and the reporting duty applies to a suspicion formed at any stage, including after a service has started.

Conveyancers and lawyers have their own verification of identity duties under land titles rules. Those sit alongside your obligations rather than replacing them, so completing your seller CDD properly is not made optional by the fact that a conveyancer will later do their own checks.

A practical seller-onboarding workflow

Here is a sequence your agency can adopt as written policy.

1. Collect the instruction and the seller’s details through a secure intake channel, not by accepting attachments over open email.
2. Assess the risk: owner location, property occupancy, how the instruction arrived, entity type, anything unusual in the story.
3. Verify identity against government sources, with biometric liveness if the seller is remote.
4. Run a current title search and compare the registered proprietor with the verified person.
5. Establish authority, and for entities, determine the beneficial owners and the officer’s authority to act.
6. Screen the seller for sanctions, PEP status and adverse media.
7. Have the compliance officer or delegated reviewer approve the outcome before the service starts.
8. Record everything, then re-check at settlement if the instruction changes, especially the proceeds account.

The record should survive scrutiny. Under section 111 of the Act you must keep the records that demonstrate your CDD, including your analysis and decisions, until the end of the 7-year period that begins when the business relationship ends or the occasional transaction is completed, and your file should show not just the result but how you reached it.

Our perspective: judgement stays with your people

We built AML Guard for Australian Tranche 2 reporting entities, and vendor fraud is a good example of why the platform is designed the way it is.

The lookups, such as identity document checks, liveness, screening and entity searches, are tasks software performs faster and more consistently than a busy agent. The judgement is different. Whether a mismatch between a title and a passport is a typing variation or an impersonation is a decision for a person who understands the transaction. So an officer reviews each determination, and the platform records the reasoning behind each risk score.

We also believe the weak point in most agencies is not a lack of checks but a lack of consistency. A risk assessment says one thing, the policies say another, and the staff training says a third. Our guided wizards produce the risk assessment, policies, compliance action plan and training manual from the same answers, so a rule such as “enhanced checks for remote owners of vacant property” appears in all four. That consistency is easier to defend than four documents written at different times, and a downloaded template cannot provide it.

Finally, we think the record matters as much as the check. Every step is written to AML Guard’s tamper-evident audit trail, which holds records for 8 years, above the Act’s seven-year minimum, so you can show how a seller was verified long after the sale settles.

How AML Guard supports seller verification

Through the client intake portal, sellers complete government-source identity checks and biometric liveness on their own device, which suits owners who are interstate or overseas. Results come back to your officer for review, and for companies and trusts the beneficial ownership determination runs from the entity’s ACN, with trusts and SMSFs reached through their corporate trustee. Deed work stays with officer review.

You can see how this works for your agency by booking a demo, or review how the service is structured on our pricing page. If you are also working through your wider obligations, our AML/CTF checklist for real estate agents covers the program components, and our guide to overseas buyer checks covers buyers who are based overseas. Our guide to buyer due diligence in real estate covers the buyer, whose CDD follows its own timing rules.

FAQ

Can I delay seller identity checks until after the contract is signed?

No, not if you act for the seller. The delay available under Rules section 6-32 is for the party you are not acting for, which for a selling agent is the buyer. Initial CDD on the seller must be complete before you provide the designated service, which for a selling agent means before you act on the listing.

Is a passport check enough to prove a vendor is the owner?

No. A passport shows who a person is, not what they own. You must also match the verified person to the registered proprietor on a current title search, and confirm authority if anyone is acting on the owner’s behalf.

What should I do if a seller wants proceeds paid into a different account?

Treat it as a red flag and escalate it to your compliance officer before accepting the instruction. Confirm the change through contact details you have sourced independently, and do not rely on the email that requested it. If suspicion remains, your officer will consider a section 41 report.

Can I tell the seller I suspect fraud?

No. Do not tell the seller about your suspicion or any report. Section 123 of the Act makes it an offence to disclose that a suspicious matter report has been given or is required, or what it contains, where the disclosure would or could reasonably be expected to prejudice an investigation. Keep your manner neutral, decline to proceed or ask for further verification, and keep a record of your reasons.

Sources

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 | Federal Register of Legislation
• Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 | Federal Register of Legislation
• Overview of initial customer due diligence | AUSTRAC
• Delayed initial customer due diligence | AUSTRAC
• Initial CDD for individuals | AUSTRAC
• Identifying individuals who don’t have standard ID | AUSTRAC
• Determining ownership and control structures | AUSTRAC
• Real estate program starter kit: examples of dealing with customers | AUSTRAC

Recommended

• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026
• AML training real estate: what agencies must do
• AML risk assessment for real estate agencies
• Beneficial Ownership in Property Transactions: How to Trace UBOs Under Tranche 2