ProofRelayPayment fraud in strata management
Strata and body corporate managers sit on an unusually attractive combination: you hold money that belongs to owners, you pay a steady stream of contractors on invoices that arrive by email, and you do it across many schemes with a back office far smaller than the sums flowing through it.
That is not a criticism of how the industry runs — it is a description of why it gets targeted, and it is worth understanding precisely.
Why the volume itself is the vulnerability
A finance team paying twenty invoices a month can look closely at each one. A strata manager paying hundreds across dozens of schemes cannot, and attackers know it.
The fraudulent invoice does not need to be clever. It needs to look like the forty others processed that week — a plumber, a lift company, a cleaning contractor, an amount that is unremarkable for the scheme. Volume is what makes it survive scrutiny.
The money is not yours, which changes what a loss means. A redirected contractor payment is an owners' funds shortfall — a meeting, a regulator, and a broken relationship, not just a bad month.
The three shapes it takes here
- A real contractor's mailbox is compromised, and their next invoice carries a different account. Everything about it is genuine except the destination — and because you have paid them before, it clears your usual checks.
- A fake invoice arrives from a plausible trade for work that could have happened. In a scheme with regular maintenance, a modest invoice for something routine is very hard to falsify-check.
- Someone impersonating a committee member or a scheme's representative asks for an urgent payment or a detail change, often citing an approval you cannot immediately verify.
Controls that fit the way strata actually works
Anything that adds a step to every invoice will be abandoned within a fortnight. These add friction only where the risk is.
- Only apply the full check when the bank account is new or has changed. A repeat payment to an account you have already verified needs nothing extra — which is what makes the exception affordable.
- Verify every account change by phone, on the number you held for that contractor before the request arrived. Not the number on the new invoice.
- Have a second person release any payment to a new or changed account. In a small office this can be a director or the licensee; it does not need to be a finance role.
- Keep a per-scheme record of which accounts have been verified and when. Across dozens of schemes, memory is not a control.
- Set a value threshold above which a second approval is always required, regardless of whether the account is familiar.
The committee and owner side
Owners and committee members are also targeted — an email appearing to come from the manager, giving new details for a levy payment or a special contribution.
Tell owners plainly, in scheme communications, that levy payment details will never change by email and that they should call the office on the published number before paying anything that looks different. That one sentence, sent before it happens, prevents more loss than anything you can do afterwards.
Call the supplier on a number you already had — from an earlier invoice, their website that you navigated to yourself, or your own records. Never a number written in the email or invoice you are checking. The person who wrote that document chose that number.
Records, because you will be asked
Strata managers operate under trust account obligations and are audited. If a payment goes wrong, the questions are immediate: what was checked, by whom, and when.
A written record of the verification — who called, which number, who they spoke to, what was confirmed — is the difference between a documented control failure by a criminal and an apparent failure by you. It takes thirty seconds and it is worth writing down every time.
Common questions
We pay hundreds of invoices a month. Is calling to verify realistic?
Calling on every invoice is not, and nobody sustains it. Calling only when a bank account is new or has changed is — that is a small fraction of your volume, and it is where essentially all of the loss happens. Scoping the control to the exception is what makes it survive.
What if the contractor is annoyed at being checked?
It is rarer than people expect, and the framing matters: "we verify every account change for every contractor — it protects both of us." Tradespeople are targeted too, and many have had their own invoices altered. Reluctance to be verified is itself informative.
Does our trust account audit cover this?
An audit checks that money was accounted for, not that the person you paid was the person you meant to pay. A fraudulent payment can be perfectly recorded and perfectly reconciled. The control has to happen before the payment, not in the audit after it.
Related guides
- Is this invoice a scam? Seven checks before you pay
The seven things worth checking on an invoice that doesn't feel right, and the one check that actually settles it.
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- You've paid a scammer. What to do in the first hour
If money has already gone, speed decides the outcome. The order of operations that gives you the best chance.