A first-time buyer lost £47,000 after a criminal impersonated his conveyancer's email address, according to cybersecurity experts who warn that impersonation fraud is on the rise and increasingly targeting the UK public and property market.
Impersonation fraud occurs when a criminal pretends to be a trusted person, company or organisation, such as a friend, family member, law firm, local council, utility provider or even the police. The criminal copies email addresses or creates fake websites that appear genuine, a tactic made easier by AI. In all cases, the victim is tricked into sending money or sharing data that has value to the criminals.
Expert warns of rising impersonation threat
Francis West, CEO at Security Everywhere, said: "Impersonation is rising fast and it's easier than most people think. I demo this live at talks all the time. I send someone a test email that looks like it's from their own address and it lands straight in their main inbox, not junk. People are genuinely shocked."
West said the reason it worked so easily was because, in his experience, fewer than 5% of people and 10% of businesses had their email addresses "locked down properly". He added: "I have seen the damage of impersonation first-hand: a friend's nephew lost £47,000 when his conveyancer's email was impersonated and the deposit account was switched. Both bank and firm both refused to take responsibility and the victim will now have to live with his parents for the next five to 10 years to save up for a deposit. Very sad."
Simon Baggs, executive chairman of brand and content protection at Corsearch, said impersonators' methods were becoming more advanced and AI was making things worse. He continued: "From fraudulent websites to AI-generated impersonation, bad actors are becoming more sophisticated. Consumers interact across digital channels, making deception easier. AI enables deception, including using celebrity images to appear to endorse products. The concern is consumer trust and safety: those deceived by fraudulent platforms may lose money, expose personal information or obtain unsafe products."
Property sector particularly vulnerable
Evren Ergin, founder of ValuQ, a property valuations tech platform, said impersonation was rife in the property sector. He added: "What frightens me most about property fraud is how quiet it is. There is no broken window. Someone steals your identity, poses as you and tries to sell or remortgage your home while you are still living in it, none the wiser."
Ergin noted that the most exposed homes are mortgage-free and long-owned, as no mortgage means no lender monitoring the property. He said HM Land Registry blocked fraud against £59 million of property last year, but when a case slips through, owners can lose tens of thousands, or the house itself.
Protection measures and advice
Doug Miller, director of Bath-based Lansdown Financial Services, agreed that mortgage-free properties are most at risk and advised: "Every homeowner should sign up for HM Land Registry Property Alert and consider a Form LL restriction, an optional anti-fraud measure. Both are simple, low-cost steps that can prevent significant financial and emotional distress."
Patricia Ogunfeibo, founder and non-practicing solicitor at London-based tenant2owner, said she had experienced how effective HM Land Registry's alert system was. She added: "HM Land Registry's alert system couldn't work better. I once asked a solicitor to register something on a property I own, he did it while we were speaking and within the minute the service alerted me to his activity. However, the alert only notifies, buying the crucial time to act, while a free Form LL restriction will more than likely stop a fraudulent sale or mortgage being registered at all — stopping a property thief in their tracks."
Darryl Dhoffer, founder of Bedford-based The Mortgage Geezer, said identity fraud could be devastating to victims. He recounted: "I once had a client applying for an adverse-credit remortgage, only to discover a fraudster had already exhausted their equity via a hidden charge. Because the client already had a damaged credit profile, they hadn't noticed the extra credit footprints, which I discovered on inspection of their credit reports."
Dhoffer said fraudsters love complex profiles, hoping the noise masks their crime. He added: "To protect my operations, we mandate biometric ID verification, matching live selfies against passports to beat AI fakes. Every homeowner must sign up for the free HM Land Registry Property Alert service today. It emails you the second anyone touches your deeds. For landlords or unmortgaged owners, get a Form LL restriction. It’s a total circuit-breaker."
West also offered tips to help people protect themselves against impersonation: "To start with, run a free DMARC check on your email, turn on two-step verification everywhere and stop reusing passwords. After that, check if you're already in a data breach (Have I Been Pwned has logged 17.8 billion breached accounts) and never act on a bank detail change by email alone. Always pick up the phone, using a number you already had."
