She Noticed One Extra Letter in an Email. It Saved AU$1.2 Million.

Most of the stories in this series are about digital arrest scams in India. This one is different — and worth including precisely because of that. It shows the same core lesson shows up everywhere, in a completely different scam, on the other side of the world.

What happened in Perth

A young mother was buying her first home and preparing for property settlement — the final step where the purchase money changes hands. She visited Westpac's Riverton branch to make what she believed was a routine transfer, based on an email she'd received about the settlement.

Her personal banker, Neet Kukreja, had worked with her throughout the homebuying process and immediately sensed something was off. "The tone was slightly different. It didn't read like the previous emails, and that made me pause," Kukreja later said. The email asked for funds to be sent to a "settlement account" in a way that didn't match how these payments usually work.

Instead of processing the transfer, Kukreja cross-checked it against earlier communication and found that the staff member named in the reply was actually on leave. Then she spotted the detail that confirmed her suspicion: the sender's email address had one extra letter, invisible unless you were looking closely.

Rather than act on the email, she paused, brought in the branch manager, and contacted the settlement agent directly. The agent confirmed no such payment request had been sent. It turned out the agent's own email account had been compromised, and scammers were using it to send convincing, fraudulent payment instructions. The AU$1.2 million transfer never happened.

Why this isn't really "her email got hacked"

The most important detail in this story is the one that's easy to miss: it wasn't the customer's email account that was compromised, and it wasn't Kukreja's. It was a third party — the settlement agent — sitting in the middle of a legitimate transaction. That's the defining shape of a business email compromise (BEC) scam: attackers don't need to hack the person who's about to pay. They just need to hijack one trusted voice in a chain of emails everyone already expects to receive.

This is exactly why "check if my email's been leaked" isn't the whole story. Your own inbox can be spotless and you can still be targeted through someone else's compromised account, as long as that account is one you'd normally trust without a second thought.

What actually stopped it

• A mismatch in tone. Kukreja knew the customer's earlier emails well enough to notice this one read differently — familiarity with a normal pattern is what made the anomaly visible.
• Cross-checking, not trusting. Instead of acting on the email's instructions, she verified against records she already had.
• A single character. The scam depended entirely on a lookalike email address close enough to pass a glance but not close scrutiny.
• Direct verification with a real person. Contacting the settlement agent by a known channel — not by replying to the suspicious email — is what confirmed the fraud.

What to do if you're expecting a large transfer

• Verify any change in payment details by phone — using a number you already have, never one provided in the email itself.
• Read the sender's address character by character before trusting an email involving money, especially during a settlement, invoice payment, or any multi-party transaction.
• Treat urgency as a warning sign, not a reason to move faster. Real settlement processes rarely require an immediate, unverified transfer.

Business email compromise scams like this one rely on impersonating people you already trust — which is part of why knowing what's publicly discoverable about you and the people you work with matters. A Scan My Shadow report shows you what's already exposed about your own phone number and email, so you have a clearer picture of what a convincing impersonation attempt might be built from.

For the mechanics behind how attackers piece together enough detail to sound credible, see what OSINT is and how it's used to find information about you.

Similar interventions keep showing up internationally wherever this kind of scam is tried — see also The Renfrew Pensioner Who Nearly Lost £10,000 — Twice — Until Bank Staff Stepped In and The Grocery Store Cashier Who Stopped an 89-Year-Old From Being Scammed.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.