Australian Conveyancer edition two - Keep your data safe

AUSTRALIAN

Conveyancer.

THE PRACTITIONER’S COMPANION

SPECIAL REPORT

A WOLF AT THE DOOR: KEEP YOUR DATA SAFE # 2 • O C TO B E R 2 0 2 3

POWERED BY

2

THIS ISSUE DATA DASHBOARD Springs property sales in Sydney’s west were hotter than the city’s sweltering heat. How the stats stacked up.

Page 6

DEVIL IN THE DETAIL The security of personal data is top of mind but is the industry able to cope?

Page 8

ONE-ON-ONE WITH: Business leadership coach John Colbert shows the importance of teamwork as the conveyancing industry evolves.

Page 18

IT’S ALL HAPPENING A rundown of upcoming events that will open your mind.

Page 22

TAKING THE LEAD Tips on how to go prospecting for new customers. A must read.

Page 24

COPYRIGHT © Copyright 2023 triSearch Services Pty Ltd. triSearch and its licensors are the sole and exclusive owners of all rights, title and interest (including intellectual property rights) of this publication including all data, information, images, commentary and content (content). All rights reserved.

the burning questions

Creating freedom of choice and flexibility It used to be that when property sale contracts were exchanged and settled, all parties met in person to complete the transacts.

The 2014 introduction of an electronic lodgement network platform developed by the locally-owned PEXA simplified the process by bringing together all parties to a transaction – conveyancers, lawyers and banks – in a secure digital environment.

The benefits to the industry have been undeniable but PEXA’s first-to-market electronic lodgement network operation (ELNO) is proprietary, meaning that only PEXA can manage the space. Currently customers do not have the choice of which operator to use, effectively mandating them to use PEXA As the industry has matured, another ELNO, Sympli, has emerged but cannot seamlessly operate within the existing network platform.

Both the conveyancing industry and legislators have acknowledged the need to break the monopoly in the interests of freedom of choice, pricing flexibility and to drive innovation that free competition can bring. They propose a system of interoperability, much like competing telcos and airlines enjoy for their transactions.

The issues surrounding change have complexity but in September 2023, two customer refinance transactions were completed interoperably between the Sympli and PEXA networks as a proof of concept.

The Australian Registrars National Electronic Conveyancing Council (ARNECC) has determined full interoperability by December 2025, with drafting requirements in the Model Operating Requirements (MOR) implementing this date currently in consultation.

In the meantime, the development prompts some burning questions to the key stakeholders. Australian Coveyancer sought their positions on the legislation, pros and cons and the proposed timetable.

A U S T R A L I A N C O N V E YA N C E R • 3

FROM LES VANCE, PEXA CHIEF CUSTOMER AND COMMERCIAL OFFICER How will interoperability affect your organisation?

has averaged 99 per cent, considerably better than the networks The introduction of interoperability is designed to deliver greater that run our power, banking and mobile networks. competition in digital settlements.

Our concern is that interoperability not only introduces more PEXA welcomes competition on the basis of fair and considered risks and complexity to a safe and reliable system but will increase policy and has been preparing for the emergence of other players costs for users, such as banks and conveyancers, who will need to in this space for a number of years, including through its work with modify their systems at significant expense. industry and regulators on the various models of interoperability.

Is December 2025 a reasonable timeline Our concern is that the promise of increased competition will for a completely interoperable network? come at a high price for all participants by introducing additional Through the work to date, including risks and complexity into what is the successful pilot transactions in currently a safe and reliable system.

September, it is clear there is a long way Interoperability was not a policy to go before we have a fully operational when the PEXA Exchange was initially and interoperable system. built. Its current design cuts across The complexity, the time required, the way in which the PEXA Exchange the cost and the impact on industry works and the implications of this stakeholders are significantly greater for the industry were not considered than originally assumed. The resources when the policy was first adopted. required of all industry participants, Given the critical role of the PEXA including ARNECC, to implement and Exchange, changes to the platform and administer the regime are also greater to e-conveyancing policy need to be than originally assumed. designed and implemented in a way ARNECC’s review of plans for the that maintains the reliability, resilience next phase of interoperability, which and security of e-conveyancing. is limited to refinance transactions in After years of work, and having NSW and Queensland with only the only just reached the initial pilot major banks, concluded that this is transactions, it is clear that it will expected to take until July 2025. cost significantly more than originally Given the limited scope of these test estimated, it is significantly more transactions, it does not seem realistic complex, and the cost benefits for home buyers and sellers are likely to be negligible or insufficient to to think that all of the additional work beyond that to complete a full roll-out can be done in less than six months. Certainly there justify the additional risk and complexity. has been no detailed design or planning which would support that Will it benefit the Industry? being feasible.

PEXA will continue to constructively participate in the That is hard to say with any certainty. The existing system works interoperability program to achieve the timelines. However, we for all parties in terms of reliability, efficiency and security – believe now is the right time for a proper review of the policy to critical features of a system that handles the biggest financial decision in most people’s lives at a time of increasing cyber-crime. ensure decisions and expectations are based on a full appreciation and critical analysis of the issues.

The availability of the PEXA Exchange over the past five years

4 • THE BURNING QUESTIONS

FROM PHILIP JOYCE, SYMPLI CEO How will the introduction of ELNO Interoperability impact your organisation?

Sympli’s organisational purpose is to deliver the benefits of competition and choice to customers and industry. Interoperability is critical to enable that to happen. Through interoperability, businesses will be able to choose which Electronic Lodgement Network Provider (ELNO) they can use for property settlements, without having to check what ELNO the other parties in a transaction are using. There is no real choice today as practitioners are effectively mandated to use the incumbent. Our current focus is ensuring that regulation is updated to deliver full interoperability in NSW and QLD by the end of 2025. That means that house purchase and sale can be supported interoperably between networks. Only then can benefits start to be realised by customers.

How will it benefit the industry?

Interoperability will drive benefits for millions of consumers and thousands of businesses across the industry and the Australian economy. Customers are missing out on tens of millions of dollars’ worth of productivity, innovation, service and cost benefits through a powerful monopoly that continues to fight tooth and nail to protect its position. Currently, there is no practical choice but to use the PEXA monopoly, which means zero competition on price, no drive to innovate and a single point of failure for the network.

Competition in this market will lead to increased productivity, lower costs, more jobs, more innovation, and better services.

Independent cost-benefit analysis has found

that competition alone would deliver a net benefit of almost $84 million just to NSW over the next 10 years and more than $20 million in fee savings annually nationally. While a monopoly continues to dominate this market, these benefits cannot flow to customers.

Our industry also has thousands of small legal businesses supporting home buyers and sellers. The vast majority of these are female led and have less than five employees, but the truth of the matter is they have no real choice of network today: they must use the incumbent.

Considering this has been on the table for some years already, is the proposed introduction by December 2025 reasonable? Why? We maintain that this can still be done sooner than December 2025, however we support the outcomes of the independent reviews and reports that have determined this timeline.

Given all the work already done, over two years from today is ample time for all ELNOs and stakeholders to be ready for interoperability.

It must be acknowledged however that the reforms are years behind schedule, with the original dates scheduled having shifted multiple times. Only one-party benefits from further delays – the monopoly.

Now more than ever it is critical that these 2025 dates are inserted into regulation and matched with progress milestones to ensure that ELNOs remain accountable to the dates.

That would mean after nearly a decade these reforms are finally implemented, and benefits can flow to businesses and consumers, firstly in NSW and Queensland and shortly thereafter to the other states.

Sympli CEO, Philip Joyce.

PHOTO: JULIAN ANDREWS

A U S T R A L I A N C O N V E YA N C E R • 5

FROM THE AUSTRALIAN REGISTRARS’ NATIONAL CONVEYANCING COUNCIL The Australian Registrars’ National Electronic Conveyancing Council (ARNECC) is the body established to facilitate the implementation and ongoing management of the regulatory framework for electronic conveyancing of real property in Australia.

The peak body has determined full interoperability by December 2025.

We put the following to it:

How will interoperability affect the conveyancing industry?

Interoperability is a competition reform of the e-conveyancing industry. It requires Electronic Lodgment Network Operators (ELNOs) to exchange data to enable subscribers (such as conveyancers) to use different ELNOs to complete an e-conveyancing transaction.

Interoperability is being designed to deliver the benefits of competition, while minimising impact on subscribers’ existing processes and workflows.

It is intended subscribers will have a similar experience, regardless of whether a transaction is conducted on a single ELNO or across multiple ELNOs.

Will it benefit the Industry?

Interoperability is expected to benefit the industry in a number of ways, including by: • providing subscribers the flexibility to transact using their ELNO of choice

• facilitating a competitive ELNO market, which helps drive competitive pricing, better services, and innovation In a multi-ELNO market without interoperability, conveyancers would need to subscribe to multiple ELNOs – known as “multi-homing”, meaning subscribers would need to be a customer of both ELNOs – leading to additional cost, time and complexity.

Interoperability will eliminate the need for multi-homing.

Is December 2025 a reasonable timeline for a completely interoperable network?

ARNECC identified December 2025 as an appropriate date after extensive industry and expert consultation.

In an independent review, Accenture recommended July 2025 as a reasonable and efficient date for the first interoperability release (limited scope refinance), having regard to the ELNOs’ build cadence and methodology.

ARNECC, with the advice of its experienced program team, identified December 2025 to develop full functionality, based on the principles used by Accenture.

The timetable recognises the importance of delivering competition and choice as quickly as possible, while preserving the security and efficiency of the e-conveyancing network.

6 • THE DASHBOARD

Property in the west as hot as the sun NSW

Hottest suburbs The suburbs where most property was bought in September 2023 POSTCODE

SUBURB

1

2765

Oakville

2

2145

Pendle Hill

3

2148

Blacktown

4

2560

Campbelltown

5

2155

Kellyville

6

2259

Wyong

7

2570

Oran Park

8

2320

Maitland

9

2430

Taree

10

2179

Austral

As Sydneysiders sweltered under the city’s highest spring temperatures in 57 years, the property market was packing heat of its own in September.

Near 35 degrees on September 19 – the highest since 1965 – was matched only by the property sales performance in the harbour city’s western suburbs of Oakville, Pendle Hill and Blacktown. They headed the top 10 list. Buyers were most definitely heading west last month.

Nearby Campbelltown and Kellyville also showed strength.

First-home buyer activity

How many first-home buyers entered the market in September 2023, compared to September 2022.

The average price of properties across the state also rose around 12 per cent from $1.054 million in Sept 2022 to $1.186 million in September 2023.

68%

2022

2023

22%

But the darling of the west appears to be Oran Park. The suburb was in the top 10 for average home price sales, and in the numbers of properties transacted for the month.

More broadly, we see a trend of more first-home buyers entering the market, up 10 per cent from same time last year.

78%

32%

Existing home owner First home buyer

Market health The average or median price of property in NSW against same time last year.

$1.054m

$1.186m

SEPT 2022

SEPT 2023

Overseas Investment Buyers from which countries invested in the Australia property market for the first time in September 2023 1. India 8.5%

2. Nepal 3.96%

3. China 3.69%

4. NZ 1.86%

5. UK 1.67%

6. Vietnam 0.8%

7. Philippines 0.74%

8. South Korea 0.71%

A U S T R A L I A N C O N V E YA N C E R • 7

Suburbs tussling for position in the rankings

QUEENSLAND

VICTORIA

Morayfield remains strong, topping the chart for the most properties sold for two months running (August and September).

Victoria’s property sales performance rankings looked more like a footy finals race in September with several consistent runners dropping a few spots last month.

Melbourne, Tarneit and Werribee fell a few places from August, but still remain in the top 10 suburbs where the most property was bought.

Meanwhile, Kallangur, which came in second in August, was nowhere to be seen in September.

Instead Yarrabilba claimed the No. 2 spot last month.

Point Cook jumped from fifth to first month-on-month, while South Yarra makes the top 10 for September, but were nowhere to be seen in August.the

Morayfield

Caboolture remains strong, staying in third place month on month.

Point Cook

The Victorian suburbs where most property was bought in September 2023 SUBURB

The hits keep on coming for Morayfield

POSTCODE

The Queensland suburbs where the most property was bought in September 2023 PERCENTAGE

SUBURB

POSTCODE

14%

Morayfield

4506

PERCENTAGE

14%

Point Cook

3030

Craigieburn

3064

12%

Yarrabilba

4207

11%

Tarneit

3029

12%

Caboolture

4510

11%

Melbourne

3000

11%

Logan Reserve

4133

10%

Werribee

3030

11%

Southport

4215

10%

Clyde North

3978

10%

North Lakes

4509

10%

Traralgon

3844

9%

Ripley

4306

9%

Reservoir

3073

Brisbane City

4000

9%

Croydon

3136

7%

Greenbank

4124

8%

South Yarra

3141

7%

Raceview

4305

8%

8%

Disclaimers - The content provided in this publication is of a general nature and does not take into account future market conditions or your individual circumstances.

You should exercise your own skill and judgment when considering investment decisions and seek professional advice where appropriate.

While triSearch uses commercially reasonable efforts to ensure the content contained in this publication is current, triSearch does not warrant the accuracy, currency or completeness of the content and to the full extent permitted by law excludes all loss or damage howsoever arising (including through negligence) in connection with this publication.

8

special report

CYBER SECURITY KEEPING THE ASSETS SAFE

With cybercrime on the rise worldwide and hostile actors targeting conveyancers and their clients in sophisticated scams, keeping data safe and secure is vital in guarding against conveyancing-based electronic fraud.

A U S T R A L I A N C O N V E YA N C E R • 9

LEIGH REINHOLD is the principal of Oz News, a freelance media company supplying print and electronic stories and concepts to local and international markets.

As e-conveyacing has become mandatory in most states and conveyancers and law firms rely more heavily on technology for their daily business, experts warn a failure to implement cyber risk management strategies – and to regularly update them – is leaving the door wide open to hackers.

Last year Australians were scammed of at least $3.1billion – an 80 per cent increase in total losses reported to Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, IDCARE, ASIC and other government agencies from the previous year.

“Behind the numbers are everyday Australians who lost money, sometimes their life savings, to scams,” said Catriona Lowe, deputy chair of the Australian Competition and Consumer Commission (ACCC).

“By responding to a fraud alert call they thought was their bank; clicking on a link in a text message they thought was from a government agency; signing up to a promising scheme to invest their retirement savings or transferring their property settlement funds into a bank account listed in an email they thought was from their lawyer – these people never expected they could lose everything.”

Lowe said losses to cybercrime are increasing because scams are becoming more difficult to detect, meaning anyone can be caught.

“Leveraging emerging technology, scammers impersonate the phone numbers, email addresses and websites of legitimate organisations,” she explained.

“Their text messages can appear in the same conversation thread as genuine messages. Fake ads, social media profiles and reviews are easily, and cost effectively deployed. This makes scams incredibly difficult to identify.”

Using attack vectors, including identity fraud, fraud-as-a-service (FaaS), business email compromise scams (BECs), ransomware attacks, phishing emails, and exploit kits, cybercriminals are employing a variety of tools to abuse vulnerable business systems and, specifically, are aiming at conveyancing specialists.

“Cybercriminals are targeting all parties involved in

10 • SPECIAL REPORT CYBER SECURITY

real estate sector, with a particular focus requirements through the Model Operating Keeping the the on impersonating conveyancing lawyers and Requirements (MOR) for Electronic Lodgement with their clients,” said the Australian Network Operators (ELNOs) and Model Participation assets safe: communicating Cyber Security Centre (ACSC). “Cybercriminals Rules (MPR) (for subscribers), which dictate system are also singling out mortgage lenders in order to requirements in regard to system capability, a 10-point intercept property settlements. availability, security and access. cyber safety “This trend has potential for significant financial “There are also very clear requirements in regard harm. All parties involved in the buying, selling to data integrity, and notification of compromised checklist and leasing of property should be vigilant when systems and transactions.” communicating via email, particularly during settlement periods. This includes real estate agents, conveyancers and lawyers, mortgage lenders and any clients of these businesses.”

1 2 3 4

Know how to keep your systems and all devices safe

Use highly protected antivirus and malware software Keep up-todate with system updates and cybersecurity fixes

Double- and triple-check any payment details/email addresses before transferring funds

5

Use a Customer Identity Access Management (CIAM) solution and a secure VOI service

CYBERCRIME DON’T BE A STATISTIC

A spokesperson for the Attorney General’s Department said, “the Australian government CONVEYANCING CAN recognises the increasing, persistent, and pervasive BE A RISKY BUSINESS threat all cybercrime poses to the Australian community, including individuals, businesses and The conveyancing industry is especially vulnerable government services. to cyberattacks because of the volume of personally “Cybersecurity vulnerabilities change over time and identifiable information (PII) held by conveyancers cyber criminals may regularly change who they target. and other related agencies, according to Chris Gibbs, The Australian Federal Police work in close collaboration technology expert and chief executive of property with law enforcement, regulators, and other entities to title and legal search platform triSearch.

“In Australia we’ve seen a huge increase in the use prevent, disrupt, investigate and prosecute cybercrime impacting the Australian community.” of technology to support the work of conveyancing,” With a cybercrime reported in Australia on said Gibbs. “As the reliance on technology has average every seven minutes, recent data from increased so has the risk of cyberattacks.

ACSC shows over 76,000 reports of cybercrime were “With conveyancers relying more on technology they need to ensure they take into consideration their made last year – an increase of 13 per cent from the previous financial year. resilience to the threats around cybersecurity.”

According to the ACCCs 14th annual Targeting Spokesperson for the Australian Registrars National Scams Report among the common businessElectronic Conveyancing Council (ARNECC), Brad related scams is: “payment redirection (business McBride, said there are strict requirements put in email compromise), where scammers compromise place to address cybercrime within the industry, and the business email, either through hacking or by stakeholders in each jurisdiction need to comply with impersonating the businesses email (by changing the Electronic Conveyancing National Law (ECNL). one letter in the email address). They alter invoices or “ARNECC, as a council of regulators from each requests for payment by changing the bank account jurisdiction, remains aware of, and takes very details. Many of these are reported to Scamwatch as seriously, cyber incidents across the board, be they false billing scams. from nefarious sources such as fraud or cyberattacks “While all business sectors are affected by or caused by incidents and outages in operating these scams, historically the typical targets are systems across the electronic conveyancing ecosystem high transaction industries such as real estate that impact the ability for electronic conveyancing conveyancing firms or the construction industry.” transactions to take place,” said McBride, the director The ACCC said last year investment scams caused land titles regulation, Western Australia. the country the most financial woes, with combined “As such ARNECC has put in place stringent

A U S T R A L I A N C O N V E YA N C E R • 1 1

THE RISE AND RISE OF CYBERCRIME

Chris Tyler.

losses of $1.5 billion. This was followed by remote access scams with $229 million lost, and payment redirection scams with $224 million lost.

While bank transfer remains the most reported payment method with 13,098 reports totalling $210.4 million. Losses by bank transfer increased 62.9 per cent.

Businesses and people who lost money via bank transfer were more likely to have been contacted by phone or email.

The ACSC said losses due to business email compromise scams (BECs) topped $98 million in Australia last year with an average loss of $64,000 per report.

There was a rise in the average cost per cybercrime report to over $39,000 for small businesses, $88,000 for medium businesses, and over $62,000 for large businesses – an average increase of 14 per cent. Large businesses took a smaller hit than medium sized businesses because they were more likely to have cybercrime mitigation strategies in place.

In 2022, businesses submitted 3,857 scam reports to the ACCC with reported losses of $23.2 million.

Businesses that reported losing the most money were in NSW ($6.5 million) and Queensland ($6 million).

The ACSC reported between 150,000 to 200,000 routers in Australian homes and small businesses are vulnerable to compromise, including by state actors.

The ACSC also said that worldwide in 2022 there was a 25 per cent increase in the number of publicly reported software vulnerabilities (common vulnerabilities and exposures or CVEs).

Research from the Australian Institute of Criminology Statistical Report – Cybercrime in Australia 2023, showed 47 per cent of respondents had experienced at least one cybercrime in the past year, while 22 per cent had been a victim of malware, 20 per cent had been a victim of identity crime and misuse, and 8 per cent had been a victim of fraud and scams.

Meanwhile, figures from the Australian Bureau of Statistics show reports of cybercrime have more than doubled in the two years from 2020-2022, up from 8 per cent to 22 per cent.

The Australian Competition and Consumer Commission (ACCC) said more coordinated effort is required across government, the private sector and law enforcement to combat scams.

“Businesses need to be vigilant and implement effective monitoring and intervention processes to prevent scammers using their services and stop them when they do,” said the ACCCs Catriona Lowe.

“Identity, verification and communication processes need constant review as scammers constantly evolve. We need to arm consumers with the tools to give them the best chance to identify scams.”

Yet, according to ABS data, only 70 per cent of Australian businesses reported they were employing cybersecurity measures to protect themselves against attacks.

“The essential steps any conveyancer needs to take are staying informed and educated as to cyber risks, maintaining cyberhygiene and preparedness and knowing what to do in the event of a cyberthreat,” said Chris Tyler, chief executive of the Australian Institute of Conveyancers.

“Early detection and remediation is of paramount importance as it will often lead to misapplied monies being short-circuited and prevented from being transferred to the threat actors.

“Another essential step is ensuring staff and industry stakeholders are educated and aware of the risks.”

6

Ensure all staff are aware of current company protocols surrounding cybersecurity

7 8 9 10

Learn how to identify possible attack vectors Know how to neutralise an attack

Practice your Cyber Incident Response

Educate yourself of all possible risk scenarios

12 • SPECIAL REPORT CYBER SECURITY

How hostile actors attack

Getting to know your attack vector threats and how to mitigate them

Cybercriminals use attack vectors to access networks by targeting infrastructure (network, hardware, cloud), applications and team members.

“Conveyancers should be reminded that preventing a ransomware attack is far easier and cheaper than recovering from one,” said triSearch chief executive Chris Gibbs.

“An effective way to prevent, for example, a ransomware attack is for conveyancers to understand these attack vectors (below) and be proactive in providing stronger cybersecurity measures.”

IDENTITY FRAUD Identity fraud is the ability for cybercriminals to hijack someone’s identity by combining fraudulently obtained personal information with generally available information on professional and social media platforms.

Advancements in AI technology now allow cybercriminals to impersonate consumers’ voices and faces to bypass many of the common two-factor authentication (2FA) verification controls.

They can then use available information and AI to generate new synthetic profiles with documents, facial images, and voice cloning to apply for loans and claim social benefits.

Not only does this create additional challenges for conveyancers to authenticate their customers, but it can also pose serious financial and personal risks for individuals.

TIP

The Australian Federal Police explain everything you need to know about Identity Crime and how to prevent it. afp.gov.au/crimes/fraud-andcorruption/identity-crimeaustralia

PHISHING EMAILS Every day 3.4 billion phishing emails are sent by cybercriminals worldwide.

In a phishing attack, a cybercriminal will send malware or malicious links in a phishing email.

With the “look and feel” of phishing emails continually improving to appear like a trusted contact or company, a user may unknowingly click on a link contained in the email.

This simple click can set off a chain of events by installing a ransomware program on the computer.

Not only do phishing attacks cause havoc via ransomware, but the pay-load can be even more malicious as the cybercriminal may extort a firm by locking down infrastructure until a ransom is paid.

TIP

The ACSC explains phishing attacks and what to do if you’ve been exposed. cyber.gov.au/learn-basics/ explore-basics/watch-outthreats/phishing-emails-andtexts

A U S T R A L I A N C O N V E YA N C E R • 1 3

REMOTE DESKTOP PROTOCOL (RDP) RDP is an access portal that allows a user or administrator to connect to your computer from another location. RDP is a feature built into the Windows operating system that helps businesses manage their IT network and fix any issues that might arise on an employee’s computer.

If a firm’s RDP setting is configured improperly, a cybercriminal can launch a ransomware attack on its business networks.

RDP attacks pose a significant risk to not only conveyancers, as they are common amongst businesses of all sizes. Both large and small organisations, including law firms are impacted due to open RDP ports.

Also, companies with team members working remotely and who require access to their firm’s infrastructure are especially vulnerable.

TIP

The ACSC offers guidance on security risks associated with the use of RDP. cyber.gov.au/resourcesbusiness-and-government/ maintaining-devices-andsystems/remote-workingand-secure-mobility/remoteworking

FRAUD-AS-ASERVICE (FAAS)

RANSOMWARE ATTACKS

Fraud-as-a-service is commonly seen when cybercriminals impersonate supply services to carry out fraudulent activity.

Cybercriminals are turning to automated voice bots for impersonating businesses and socially engineering customers either over the phone, or via email.

Cybercriminals can copy a business’s email signature and bank details, changing only one or two numbers in the accounts, to have your clients transfer funds to their own account, instead of the intended recipient.

Ransomware is a serious issue that all businesses need to consider but few are willing to discuss due to the significant impact a ransomware attack can have on a businesses brand and reputation.

Rates of cyberextortion and ransomware have risen exponentially in Australia over the past 36 months. The federal government has recently introduced a bill mandating reporting of attacks by ransomware requiring businesses with turnover above $10 million per year to disclose a ransomware attack and whether they paid a ransom (and how much).

The challenge for the conveyancing industry is the $10 million threshold would exclude more than 90 per cent of Australian conveyancers.

Ransomware attacks will continue to go unreported and unseen.

TIP 1

A common prevention method is to never exchange details through unsecured communication tools and have all settlement and payment options secured with billing and accounting software.

TIP 2

Educate each client that your business will never ask for fund transfer details to be sent in emails, and to double check and verbally confirm any fund transfers with other businesses and clients throughout the property purchase or sale.

WARNING

Cybercriminals are increasingly using supply chain and software platform attacks. These cause harm across Australia’s economy but may well only affect smaller businesses. In 2022, many Australian businesses, including conveyancers, were downstream victims of ransomware attacks.

TIP

The ACSC offers guidelines on how to protect yourself and your business from ransomware attacks. cyber.gov.au/report-andrecover/recover-from/ ransomware/protect-yourselffrom-ransomware

EXPLOIT KITS

One of the more dangerous ways ransomware can access a conveyancing firm’s network is through malicious vulnerabilities written into an exploit kit.

An exploit kit is an advanced malware tool that helps cybercriminals target victims through existing security gaps from well-known software and hardware in popular technology manufacturers.

Cybercriminals publish exploit kits that are developed on the weaknesses and security holes of popular platforms such as Adobe Java, Adobe Flash, and Microsoft Silverlight.

They are a collection of malware and malicious code in an “all-in-one” platform that helps hackers carry out sophisticated cyberattacks.

HISTORY

Some of the largest cyberattacks in history, such as WannaCry, infected millions of Windows computers with ransomware. The ransomware used a stolen National Security Agency (NSA) exploit called EternalBlue that allowed cyberattackers to take advantage of a vulnerability in the Windows operating system.

Microsoft eventually released a security update that closed the vulnerability but not before millions of computers and hundreds of thousands of firms had been impacted.

14 • SPECIAL REPORT CYBER SECURITY

Staying cyber safe Verify payment details The Australian Cyber Security Centre (Acsc) “If any party to a property transaction notifies you they have updated their bank details, take extreme care to confirm changes by calling the sender’s established phone number or meeting them face-to-face before transferring any funds.”

Exercise good cyberhygiene The Attorney General’s Department “There are a range of good cyberhygiene preventative and proactive measures that can be of immediate benefit to Australian businesses like strong passwords, multi-factor authentication, and backing up data. Further guidance can be found at www.cyber.gov.au/ protect-yourself.”

Practice your cyber incident response ACSC Developed by the UKs National Cyber Security Centre and now used by the ACSC, the Exercise in a Box online tool promises to help Australian companies of any size discover how resilient they are to hostile actors. It also helps them test and practise their cyber incident response in a secure environment.

Maintain training and awareness

Check your mobile risk

The ACSC

In its cyber precedent paper, Your Firm, Their Data, the Law Council of Australia outlines ways to protect your client’s confidential information including on mobility and bringyour-own devices. And they ask: • Have you adequately secured you mobile device in case of loss or theft? Do you use a password? Does your device auto lock, requiring you to retype your password to gain access, if left unattended? How long does it take before auto lock engages?

• Who has access to the data you carry around on your phone or portable device?

• Can that equipment or the mechanisms that allow it to work be used to transmit sensitive data or create security breaches?

Information transmitted over public Wi-Fi networks can be accessed by others, for example.

• Should it be required, can you remotely find or control the device to enforce security policies? That is, can you erase the data remotely?

“Ensure staff are trained to identify suspicious emails, including requests to change bank account details or emails linking to fake websites.

The latter may be a phishing attack that could capture passwords and compromise account security.”

Deploy a trusted CIAM solution Chris Gibbs, CEOTrisearch “We recommend firms protect their businesses and their clients from cybercrime by partnering with a cybersecurity firm that provides a scaleable solution protecting a conveyancer or law firm’s infrastructure, applications and enterprise. When protecting the enterprise, firms should look to deploy a customer identity access management (CIAM) solution to establish and maintain digital trust with their users by providing a highly-secure and resilient environment for collecting and storing sensitive user information, managing privacy controls, and defending against identity fraud.”

The Law Council Of Australia

Secure your email accounts THE ACSC “Cybercriminals will attempt to access systems through compromised passwords, it is recommended that individuals and businesses use strong passphrases and enable or implement multi-factor authentication on email accounts to help prevent unauthorised access.”

A U S T R A L I A N C O N V E YA N C E R • 1 5

A go-to guide from the experts Utilise secure systems Chris Tyler, CEO Australian Institute of Conveyancers “Conveyancing is generally safe but several steps could be made to make it safer, including using a dedicated approved portal for transfer of bank details, like PEXA Key or Securexchange.”

And, Tyler advised, “using VOI (verification of identity) is a measure that makes identify theft/fraud more difficult. It doesn’t prevent it but certainly makes it harder for threat actors to navigate.”

Comply with VOI Chris Gibbs, CEO Trisearch “In the rapidly changing landscape of digital conveyancing, conveyancers and their clients should rely on access to cuttingedge verification of identity (VOI) technology.

Not only does it bring efficiencies that speed up the conveyancing workflow but it also provides a superior and differentiated level of customer service.

These efficiencies also provide conveyancers the ability to scale up their businesses by freeing up resources to service more clients.

In Australia today we have thousands of identity checks happening each second. This is far beyond what was possible prior to the introduction of mandatory VOI and the technology that has emerged that provides conveyancers and their clients with the speed and convenience of an automated VOI system.”

Install anti-virus and malware protection

Stay up-to-date

The Law Council Of Australia

Here’s a list of Australian websites to keep you updated and alerted to any new threats and recommended security measures to protect your business from ever-evolving cyberthreats.

• Purchase business grade anti-virus and email filtering (don’t use free versions) • Enforce strong passwords (min 15 character with mix of letters, numbers and symbols) • Have passwords changed on a regular basis • Limit access to systems • Only allow screened persons to view your data • Update the software regularly • Have it installed and monitored by a professional

In case of an attack The Law Council of Australia The Law Council of Australia has a handy point-by-point strategy to manage a cyberattack. In short: 1. Identify the threat 2. Neutralise the attack 3. Review your system 4. Restore and rectify your infrastructure 5. Recover your data 6. Test and allow operations to resume 7. Report and learn from the experience

Government websites

scamwatch.gov.au/ cybersecuritystrategy. homeaffairs.gov.au/ cyber.gov.au/ acorn.gov.au/

Report anything suspicious The ACCC & the ACSC If you suspect your business has been a victim of a cybercrime, stay calm and contact The Australian Cyber Security Centre’s 24/7 Hotline: 1300 CYBER1 (1300 292 371).

Follow this link to report a cybercrime to the Australian Cyber Security Centre and the police.

16 • SPECIAL REPORT CYBER SECURITY

A conveyancing transaction gone so wrong How an Australian couple lost over $270,000 last month in a single transaction.

“It’s the reputational damage that is really hard for organisations to come back from.

If customers don’t feel like they can trust you anymore, they are not going to come back to you.”

Shameela Gonzalez (pictured above)

Australian conveyancers should be alert to the alarming increase countrywide of invoice scamming, with business email compromise fraud costing unwary consumers $22 million in the past eight months.

According to the consumer watchdog the ACCC (Australian Competition and Consumer Commission) 27,698 false billing scams were reported to Scamwatch between January and September this year – a staggering 95 per cent jump from the same period last year – with criminals focusing on big purchase items such as renovations, cars and properties. Scamwatch statistics show email fraud accounted for the most losses in false billing scams, with $17.5 million stripped from 10,000 unwary online victims, including first-home buyers Simon Elvins and his wife.

The couple, who spent 10 years saving for a deposit for their million dollar dream home in the Blue Mountains of NSW, was in the final stages of settlement when they fell victim to a hacker’s convincing email in May this year.

The email – purportedly from their conveyancer – contained correct information, including the trust account and account name that matched the conveyancing company they had engaged.

The Elvins had no idea the email – asking for $274,311.57 to complete their upcoming settlement – had, in fact, come from a cybercriminal.

“It all looked fine,” said Elvins. “So, I paid it in two amounts, because the amount was too large to do in one go.”

Elvins told Australian Conveyancer Magazine he did receive an email from the conveyancer confirming receipt of one payment. However that claim has been denied by the conveyancer.

“We don’t know whether that email came from the scammer or not,” he said. When there was no news on the progress of the settlement after a week, he contacted his real estate agent and the conveyancer who both claimed they had not received any payment from him.

Then, when the real estate agent provided the couple with the correct account information, Elvins started to smell fraud. “I thought, ‘This account doesn’t look the same as the last one. Maybe they’ve got two accounts’ ... the realisation that we had been scammed became quite clear,” said Elvins, who believes scammers must have hacked

A U S T R A L I A N C O N V E YA N C E R • 1 7

his conveyancer’s emails to concoct the fraudulent invoice.

Elvins contacted his bank, Westpac, immediately. Their fraud team contacted NAB – the scammer’s bank – but it was too late. A week had passed since Mr Elvins had transferred the settlement funds and the couple only managed to recover $270.72 of their savings. They had been scammed for more than a quarter of a million dollars but estimate their aggregate losses will be closer to $825,000 when extra mortgage payments, more monies borrowed and other costs, including legal fees, are accounted for.

“Business email compromise is very prevalent and conveyancers are particularly vulnerable,” Shameela Gonzalez, the director, strategy and consulting FSI Lead at CyberCX told Australian Conveyancer, adding there are mitigating strategies all conveyancers should put in place.

“In the conveyancing business, I would look at

urgency. What could a cybercriminal say to your customer that would make them panic and not think things through and require them to make a payment immediately? What could the criminal threaten them with that would make a customer feel like there’s a need to not exercise their better judgement? That’s the thing that will result in direct financial loss.”

Gonzalez said the pecuniary losses to a conveyancer and their clients would be just the start of the damage business email compromise can cause.

“It’s the reputational damage that is really hard for organisations to come back from,” she said. “If customers don’t feel like they can trust you anymore, they are not going to come back to you.” Which is certainly the case for Simon Elvins.

“I’m angry with the legal system, with the banks and the process of buying properties,” said Elvins, who is furious his conveyancer had no cybercrime insurance.

“There is also no recourse, with complaints to AFCA (the Australian Financial Complaints Authority) and NSW Fair trading claiming my complaint was out of their jurisdiction. “I want my money back. We have been through hell.

“We are first time buyers. The conveyancer should have held our hands and taken us through all the pitfalls. They should have insisted we call them and double check any bank details before we transferred any money.”

Gonzalez advised conveyancers to tell every client to always double- and triple-check any request for funds transfer – by phone or face-to-face – to ensure all account details are correct and corresponding before making a payment.

Meanwhile, the ACCC has been calling for the banks to introduce “confirmation of payee” – a system already adopted in the UK and Europe – to help stop the problem of business email compromise.

Some banks have started implementing their own measures to help mitigate the risks. CommBank has introduced NameCheck, which compares account details with names and highlights potential differences. While Westpac uses Verify, which presents customers with a scam risk rating when entering a new payee for the first time.

“I’m angry with the legal system, with the banks and the process of buying properties.”

Simon Elvins (pictured left)

18

q+a

JOHN COLBERT Partner and director at Corporate Edge since 2007

PHOTO: JULIAN ANDREWS

A U S T R A L I A N C O N V E YA N C E R • 1 9

Leadership, evolution and bringing a team along for the journey Early in his corporate sales career, John Colbert was promoted from successful team member to team leader.

Great reward for a driven a salesman but Colbert soon realised that his continued success would be dependent on the success of the professional group under his care.

More than 20 years on, he admits this was a pivotal moment.

From then on he has explored and dissected team dynamics in the pursuit of best-practice leadership.

Colleagues say he is highly energetic and dynamic with a unique ability to inspire people.

His style is about building a connection with others through his humility, passion and empathy but then quickly breaking down the issues so that people see a clear and compelling vision of what needs to change, with simple and achievable steps to make it happen.

Colbert is also a professional in high demand – at his best when in front of senior executives or large groups who require a significant shift in their thinking, need to believe in new possibilities or have a real risk or opportunity that requires organisational culture alignment.

As the conveyancing industry continues its evolution, we sat with him to share his insights on leadership, managing change and bringing the team along for the ride.

20 • Q+A • CHRIS TYLER

“The business needs to constantly look to innovate and evolve.

It’s one of the biggest risks to a business if they are not evolving.”

AUSTRALIAN CONVEYANCER: The conveyancing industry is a rapidly evolving one. How do operational teams prepare for these inevitable changes and challenges?

JOHN COLBERT: When we are aware these things

are going to affect the business, you have to bring the team together and talk openly about what’s happening.

When the team doesn’t know things about what going on around them, the situation triggers uncertainty.

So that means talking about what is going on now and what will happen in the future. Then you can then start to involve the team in some of the things we need to do.

AC: How do you explore this and how do you get this through this process?

COLBERT: It’s often pretty

simple; it’s just about having conversations, and the change is the first thing you talk about.

It’s important for the leaders to explain the context of the change very clearly so people can understand it. Not everyone is exposed to the things that a team leader is. What is happening in the environment and the market? And what is contributing to the situation?

Then you say, here’s the vision and where we would like to get to and start getting ideas – you’re your people.

AC: How critical is it that the team owns the challenge?

COLBERT: It’s massive because the only

way you’re going to get through the changes is by everybody helping out. By feeling involved they are going to take ownership.

AC: Where does the team begin looking for answers? We can imagine it is important to get ideas from all parties

then distil them into something intelligible for the business.

COLBERT: It’s more challenging for bigger businesses

where you have larger teams, but part of the process is letting everybody know what that process is going to look like and what we are going to do with the information.

Give people some guiding principles – a framework – so that when we are sharing feedback it is still part of the scope of the change we are dealing with. You want most of the ideas to be within a field of play.

Then you’ve got to let the people know what you are going to do with these ideas.

When it’s done and you are making decisions it’s important to let the team know what the thinking process is.

Talk about the pro and cons, the factors considered, and why we landing on a particular piece.

Just explaining the “why” is often all that the team needs.

AC: Does this happen in a structured environment or are these casual conversations?

COLBERT: You need some structure for

bigger businesses to ensure you are going through all the right channels, but honestly, the best way to do it is by having conversations.

We also need explain the strategy for the business and then we are able to describe what is important for the business.

AC: How a can business best equip itself to confront the issues of profitability?

COLBERT: The business needs to

constantly look to innovate and evolve.

It’s one of the biggest risks to a business if they are not evolving.

How you ready yourself for that is to create a team culture where everybody feels that they can share

A U S T R A L I A N C O N V E YA N C E R • 2 1

ideas and challenge the status quo. That comes from leaders constantly creating conversation moments and asking the questions that motivates us to think differently.

Then we have to make people understand the reality of where the business is at. If there are a lot of profitability challenges and cost pressures some business owners and leaders will worry about letting the team know that for fear of how they are going to react.

And while you don’t want to create too much fear, uncertainty and panic, if you’re not sharing the bad news, then it’s all on your shoulders to solve it.

But you need the team’s help to find new ways to grow, find new revenue sources, and find ways to be efficient.

AC: The bedrock of those conversations is clearly going to be trust. How do you imbue confidence that no idea is a dumb idea?

COLBERT: That’s going to come down to the leaders’

ability to create what we call psychological safety.

This hugely important for all businesses these days.

Making you team feel that whatever they share is valued.

Even if the idea is left of centre, the positive is that the team is actually sharing ideas so we need to make them feel appreciated and recognised for that.

But it is also about how you respond to those ideas. Ensure that you respond in a positive way just so they can keep being open.

Psychological safety means that no one feels silly, that no one is going to judged or punished for what they say. That is a big part of it.

Being a great listener is so important as it is for a leader to be humble in those conversations.

AC: What prompted your passion for helping businesses and teams navigate change and grow?

COLBERT: In my corporate career, I had a pivotal

moment when I was promoted to a position with leadership responsibilities.

I realised that success in that role depended on the team’s ability to work cohesively. When I saw the team evolve, grow, and perform better, I recognised

the importance of creating a positive team culture.

Witnessing team members get promoted and attribute their growth to my leadership was a turning point that ignited my passion for leadership and team development.

AC: What are the key differences between leadership and management, and how should leaders approach their role in small conveyancing businesses?

COLBERT: Leadership and management are distinct

but complementary roles. Here’s how they differ: • Leadership is primarily about people. Leaders focus on inspiring, coaching, developing, and motivating their teams. They set the vision, values, and culture of the organisation, caring for the people within it.

• Management is primarily about things. Managers are responsible for putting structures and systems in place, making sure processes run efficiently, and ensuring resources are utilised effectively.

In small businesses, leaders often have to play both roles. However, it’s crucial to understand the balance and when to wear each hat.

AC: How should leaders balance business-as-usual activity with innovation and change?

COLBERT: Leaders should not let innovation distract

from what the business does best but they also need to allocate time for innovation.

It’s a balancing act. The key is to maintain a symbiotic relationship between the core business and innovation. The core supports and provides resources for innovation, while innovation opens doors to new possibilities.

AC: What strategies can leaders employ to conduct difficult conversations around accountability?

COLBERT: Difficult conversations should be

approached with care. Leaders can express their desire for open, honest dialogue.

When discussing accountability, they should connect the conversation to shared values and standards, emphasising that the goal is to help team members improve. Careful communication and active listening can make these conversations less intimidating.

Five things business leaders can take away from this interview

1 2 3 4 5

Clearly define your purpose and vision.

Establish strong communication structures within your team.

Cultivate a people-first culture that values care and inclusivity.

Prioritise your own selfdevelopment.

Balance innovation with your core competencies.

2 2 • C O N V E YA N C E R ’ S T O O L B O X

events NSW

NSW

AICNSW November Webinar

Australian Property Institute 2023 NSW Public Sector Property Conference

November 9, 5pm-6pm Location: Online Presented by Tony Cahill (left), this webinar looks at recent changes in legislation. A look at the issues a purchaser should consider when buying a newly constructed dwelling or a dwelling with extensive renovations. Points for consideration include: • What investigations can and should a purchaser make where there has been new work done?

• What information does a vendor need to disclose in the contract where new work has been carried out (mandatory v recommended)?

• What information should the purchaser of a newly constructed dwelling (or renovations) request from the vendor?

• What is the role of the Occupation Certificate?

• Purchaser’s rights where additional work has been tweaked following the issue of the OC. • Are OCs “proof of compliance” – can they be relied on by successors in title?

• What steps is a private certifier required to take when issuing an OC? • What protections does a purchaser have in the face of an error by the private certifier?

• What info does the private certifier have to provide?

• Also, there are still some interim occupation certificates being issued depending on DA date – is this still acceptable?

• Complying development – what is it? – evidence of compliance • Dual occupancies and issues around shared services register.aicnsw.com.au/

November 16, 8am-2:30pm Location: 5 CPD, Swissotel Sydney, 68 Market Street, Sydney A program covering a diverse range of topics like an economic update, Just Terms updates, a panel discussion on current market trends and changes occurring within the public sector property market. An informative session to help guide those who work specifically in this industry.

Presenters: Phil Western, national director, government & legal (valuation & advisory) – Colliers International.

Gareth Aird, head of Australian economics – Commonwealth Bank of Australia Dr Louise Camenzuli, head of environment & planning – Corrs Chambers Westgarth Samantha Yeung, senior associate – Corrs Chambers Westgarth Janet McKelvey, barrister – Martin Place Chambers Dr. Nick Brunton, partner – Norton Rose Fulbright Anneliese Korber, partner – Norton Rose Fulbright Stewart McLachlan, chief executive officer – Valuation NSW Sally Dale, valuer general – Valuation NSW api.org.au/professional-development/eventswebinars-online-courses/events/nsw-publicsector-property-conference

A U S T R A L I A N C O N V E YA N C E R • 2 3

QLD

QLS: Celebrate, Recognise, Socialise: Gold Coast October 26, 6.30-10pm Location: Hilton Surfers Paradise (right)

VIC

Australian Property Institute VIC Regional Conference November 15, 8.30am-6pm 6 CPD, Geelong Regional Library, Wurdi Youang - The High Ground, Geelong Regional Library (above) Discussing regional issues to Victoria but also a number of developments central to Geelong that are driving this regional hub and it’s surrounding towns and districts.

The API Victorian Regional Conference brings together government representatives, bank representatives, mining industry professionals, and environmental experts for a comprehensive discussion on the future development of regional areas. api.org.au/professional-development/eventswebinars-online-courses/events/vic-regionalconference/

Legalwise Seminars Complex Conveyancing Issues November 23, 9am–1.15pm Location: 4 CPD, Online Based on Victorian legislation, delve into the intricate world of property rights, restrictions, and agreements as you unlock the secrets to seamless conveyancing. Catch up on the latest conveyancing cases, master easements and covenants, understand how to handle squatters’ rights and adverse possession, heritage and more in this essential guide. legalwiseseminars.com.au/course/?eventtemplate =3266-complex-conveyancing-issues&event=11747

QLS invites you to the annual Celebrate, Recognise, Socialise event on the Gold Coast. This is your opportunity to partake in a long-standing member tradition as we celebrate not only our member milestones, but our profession’s collegiality and recognise the significant contribution of our members. Enjoy a three-course dinner, beverages and a night of celebration as we bring together the legal profession in the Gold Coast region. qlsevents.eventsair.com/celebrate-recognisesocialise-gold-coast/general/Site/Register

QLS: Practice Management Course – Sole to small focus November 13 Location: Online Tailored for practitioners who currently practice in, or intend to practice in, a legal practice of less than 20 practising certificate holders. The focus of the PMC is to successfully transition you from employed solicitor to principal, prepare you for entering a partnership, starting your own firm as a sole practitioner or becoming an ILP legal practitioner director. qls.com.au/Education/Practice-ManagementCourse

QLS: Property Central A hub dedicated to keeping you informed about property and conveyancing in Queensland. This page includes upcoming events, news, toolkits and access to tech solution providers. It’s updated regularly with live information so you can stay up to date. A good one to bookmark! qls.com.au/Practising-law-in-Qld/Resources/ Property-Central

2 4 • A U S T R A L I A N C O N V E YA N C E R

the toolbox

TAKING THE LEAD The art of prospecting

The thought of prospecting may seem daunting, especially when handling multiple sale and purchase matters simultaneously.

Prospecting is the process of initiating and developing new business by searching for potential customers, clients, or buyers for your products or services.

For a conveyancer, the goal is to generate interest in their services and ultimately convert leads to loyal customers. Tips include:

1 TARGETED MARKETING Develop a well-defined target catchment and create tailored marketing campaigns to reach potential clients who are most likely to engage.

Utilise platforms like CoreLogic or recent census data to determine best demographic reach and leverage social media platforms to promote your services, and share content.

2 NETWORKING AND COMMUNICATION Networking events can establish your presence in the industry and generate leads.

Join professional associations and build strong relationships with professionals such as mortgage brokers and property developers to gain referrals.

Effective communication is essential. After initial contact or meetings, always follow up promptly.

3 DEVELOP A REFERRAL PROGRAM Ideally, your clients will prospect for you. Happy clients refer others and provide credibility to your services. Develop a referral program that incentivises clients to refer your services to their friends and colleagues.

Developing new business can be difficult in a competitive environment. Diligent prospecting is therefore essential. Make it part of the weekly sales routine.

DISCLAIMERS The content provided in this publication is of a general nature and does not take into account future market conditions or your individual circumstances. You should exercise your own skill and judgment when considering investment decisions and seek professional advice where appropriate.

While triSearch uses commercially reasonable efforts to ensure the content contained in this publication is current, triSearch does not warrant the accuracy, currency or completeness of the content and to the full extent permitted by law excludes all loss or damage howsoever arising (including through negligence) in connection with this publication.