PEXA: privatising an essential public service … what could possibly go wrong?

They’ve seen prices go through the roof in NSW. They’ve see a raft of data-breaches and cyber-crimes. Rod Sims is investigating. Customers are up in arms. Yet Victoria is on the verge of selling its land registry service and the banks and state shareholders are on the verge of floating their monopoly e-conveyancing service PEXA on the sharemarket.

At michaelwest.com.au, we have received a flood of complaints about the privatisation of state land registries. Here is one email by a disgruntled customer to a PEXA director and shareholder Paul Little which sums up the tide of discontent quite nicely. PEXA’s response has been appended below.

Dear Mr Little,

DIMINISHED PUBLIC CONFIDENCE & SECURITY & INTEGRITY IN E-CONVEYANCING
& THE ELECTRONIC LODGEMENT NETWORK OPERATORS.

I refer to the above named matter and and write in relation to the share holding of the Little Group in the Electronic Lodgement Network Operator company named Property Exchange Australia Limited (PEXA).

I am, and many other members of the general public have had our confidence diminished in the overall security and integrity of the Electronic Conveyancing method of conducting Property Settlements.

Our diminished confidence has been caused by an Electronic Lodgement Network Operator.
I draw your attention to the following security incidents involving the Electronic Lodgement Network Operator (PEXA) which has caused mine, and many others, to have diminished confidence in the electronic method of transacting property settlements.

1. The case of Dani Venn (former MasterChef contestant) having $250,000 stolen by hackers during a settlement that was transacted in the workspace of an Electronic Lodgement Network Operator.

2. Cyber criminals stole $558,000 from an 83 year old woman in Western Australia.

3. Cyber criminals defrauded two South Australian property buyers of $900,000.

4. The following details of a cyber crime was received by the NO MANDATE Action Group (email [email protected] for names etc) and distributed by email on 25 June 2018:

Our Situation:

In fact one month ago our Emails were hacked.

(We were not using PEXA as although certified I refuse to use it – as I do not like to be told to use a monopoly provider. We also have an amazing Settlement Agent (Maureen Powell) and I refuse to cut her income to profit a monopoly).

We were acting for a NSW Client and had appointed Qld Solicitors to act as our Settlement Agent.
They sent us Trust Account details which we sent to our Client.

The fraudster (who had hacked our emails) then sent our Client an Email from us a few hours later advising different account details and $2,500,000.00 was transferred to the false account.

We found out the next morning when we rang the Qld Solicitors to check all in order for Settlement.
They had not got the funds.

In Qld time is of the essence in relation to Settlement and our Client’s Contract was terminated.
Our client – a developer owned two adjoining properties and their DA depended on this Property. (Potential loss $2-3 million)

After much negotiation the Vendor applied an Extension Fee of $250,00.00 and the matter Settled.

The Police are investigating.

Our client did not lodge a claim against us due to their long-standing relationship with us but my preliminary view of our policy suggests that if they did we would not have been covered as this was a crime.

Insurance

Before PEXA is mandated, all practitioners need to check industry insurances and we need to know what the additional premium will be to cover this extraordinary risk.

5. The following details of a cyber crime was received by the NO MANDATE Action Group (email [email protected] for names etc) and distributed by email on 27 June 2018:

In summary, settlement on a $750,000 property sale was due on the 14th May. When no moneys were deposited in our bank accounts by the 18th, the conveyancer realised the bank account details she received (ANZ,CBA,NAB) were not the same as the bank accounts I emailed to her (3xNAB accounts) a few days prior to settlement (by reply to her email).

PEXA was immediately notified by my solicitor, in turn my solicitor (conveyancer attached to solicitor’s office) receives confirmation by PEXA that all the banks have been notified to freeze these fraudulent bank accounts where $672,000 was deposited and distributed over the three unknown bank accounts and in three different banks.

To date, my solicitor has received confirmation by email only that the moneys namely in the CBA and NAB fraudsters accounts were not withdrawn and the funds are in fact in there and frozen. This is a total of $508,000. I must highlight here, the red tape the solicitor, the conveyancer and have been going through with these banks to date has been unbearably tedious, slow, lethargic and unprofessional to say the least.

My solicitor and I are in constant communication (being polite here) with the banks namely CBA and NAB to have the funds returned/reimbursed, the CBA has told us specifically that our case was the first scam incident since PEXA introduced the electronic settlement system a few months ago and the bank is in the process of setting up internal procedures to protect/deal with, from potentially future such incidences, using our case as their prototype in their new system and they will only release our moneys when they finish this process, period.

In the ANZ fraudsters account where $165,000 was deposited, all these funds have been withdrawn over four transactions and transferred to accounts in Thailand. Of these funds, $39,000 has been recovered by the ANZ and returned to my solicitor’s trust account. The rest … the ANZ says sorry, that’s all they were able to retrieve, end of case, end of story as far as they are concerned.

And so, after the CBA and NAB finally reimburse/return the frozen funds, we will be $126,000 short and out of pocket of the total $672,000 settlement moneys.

I’m not however convinced that my conveyancer’s computer was necessarily the only one hacked or in fact where the hacking originated from.

Frantically and immediately trying to find out where things went wrong, a friend (of mine) with an IT background scoured through my emails and computer, discovered, in the raw data of the emails that both the conveyancer’s and real estate agents emails requesting me to reply to them with bank account details for settlement funds to be distributed a few days prior to settlement, both emails to me from them, both have the hackers email addresses embedded in their emails.

This hacker’s email address is also being programmed so that when I hit the reply button to these email requests (from both real estate and conveyancer) my emails are redirected/diverted to the hackers email address, they in turn change the account details, keep the body of the email intact as my original email and forward it onto the conveyancer and real estate agents as though the emails are sent from me, so we are all, none the wiser!!

It’s interesting to note how we did save the deposit funds from the hackers. I also replied to the Real Estate Agent’s email asking me to provide bank account details for the deposit (minus agent’s fees), for the amount of $65,000.

The office receptionist was away the day the real estate agent called me, saying he didn’t/couldn’t get into her computer, would I please send the bank account details to him via sms, I did as requested and the moneys were promptly deposited into the correct account on settlement day.

Please note this is the only reason why the deposit moneys were correctly deposited into my nominated account. Had the office girl been at work that day, the $65k would have been destined to yet another of the hackers bank accounts.

The question now is, who is responsible for the missing funds and $126,000 shortfall, the costs to fight to get the balance of our moneys back AND the loss of interest $672,000 would have been earning from the 14th May? We had planned to invest these moneys until required @5% interest rate.

I have also reported this to the police fraud dept on the 19th May, I was told, verbally and over the phone, to let it roll with/via the solicitors and if I still have a problem after that, to come back to the Police.

I’m happy to talk with someone from your organisation and show you proof of any of the above however I prefer to stay anonymous to the public.

The reason being, the property sold belonged to my 95yr old father and mother and myself, these funds are their life savings, as immigrants initially to this country they worked extremely hard, these funds were and are destined for nursing home requirements for their near and imminent future.

I have not had the heart to tell my father we were scammed of $700k. I’ve made up lies as to why the funds are not in his bank accounts yet … and I’m quickly running out of excuses. I’m hoping and praying every day the banks will reimburse the moneys very soon!! This sort of thing should not happen to innocent and hard working honest people.

In the meantime, I need to work out how to recoup the balance.

There are a few more details which you may be interested in, however I don’t want to confuse you with too much at this point, I only intended this to be a summary should this story interest you to add to what you have at hand already.

Again, I want to highlight that there are more cases out there than Pexa would like us all to know about.

I also request, in all of this Pexa saga and the email scams you are uncovering/highlighting through your program, if there appears to be an avenue for us to claim reimbursement for the shortfall, (even though to date 90% of our moneys is still outstanding), I would appreciate it if you would point me in the right direction.

6. The Commonwealth Bank breached Legal and Banking Standards by withdrawing money from the solicitors Trust Account after the Electronic Conveyancing Settlement failed. Report in the Sydney Morning Herald on 10 July, 2018, article titled “Like the Wild West”: Home sale money ‘disappears’ on PEXA e-transfer platform”.

The above are only the examples that have been reported in the media.

I know of at least one other example that has not been reported in the media.

Cyber criminals are smart and will always be one step ahead and be hacking into any system which has large amounts of money flowing through an electronic platform.

In the Echo Newspaper an article titled “Concerns about Property Transfers” quotes Dion Dosualdo, Executive Officer of the Australian Institute of Conveyancers WA as saying:

“At this stage there were no safe guards in PEXA to confirm or authenticate financial transfers as a means of verifying recipient details.

“Large sums of money are transferred blindly in the hope they reach their intended destination or recipient,’’ he said.

“This issue is largely outside of PEXA’s control, who would require the support of the broader banking industry and or the Australian Registrars National Electronic Conveyancing Council to implement account verification and make it available in PEXA.

“This concern has been identified as a major weakness which AICWA works closely with its members to mitigate against.”

An issue that causes me and many members of the public to have diminished confidence in the integrity of the whole On-Line System is the outages that are occurring in the system. I refer to a copy of the following email:

From: PEXA Support Notifications <[email protected]>
Sent: Friday, 29 June 2018 2:27 PM
To:
Subject: Electronic Lodgement Network – Service Issue
Sent: Friday, 29 June 2018 2:27 PM
To:
Subject: Electronic Lodgement Network – Service Issue
Sent: Friday, 29 June 2018 2:27 PM
To:
Subject: Electronic Lodgement Network – Service Issue

Dear Irene,

We are currently investigating an issue which is impacting financial payment file responses across the Electronic Lodgement Network in all jurisdictions.

Workspaces with financial settlement will likely remain in a status of ‘Settling’ or ‘Disbursing’ for longer than usual until the underlying issue can be resolved.

We will provide a further update in approximately 1 hour.

Regards
PEXA Support Centre

The above occurrence has been frequently occurring with Settlements.

This has resulted with many people, with their belongings, waiting to move into their new homes. In some cases, this has been many hours and the people have had to bear the additional cost of the delay to the Settlement.

There is no guarantee that the Settlement will occur at the time nominated.

The Electronic Lodgement Network Operator (PEXA) will increase the cost of property settlements for the “Mums and Dads” in Australia due to the increased costs that a solicitor/conveyancer have in conducting an electronic property settlement. These costs will be passed onto to the consumer.

The increased costs are the cost of Insurance against theft when doing the settlement, increased cyber security costs, increased cost of upgrading of computers and software.

Additionally, there is no guarantee that the Electronic Lodgement Network Operator (ELNO) PEXA will not dramatically increase their charges to the Users of their System after July 2019 when you can no longer do paper settlements and/or when the company is floated on the stock market.

For your information, below is the email I sent to the Australian Registrars’ National Electronic Conveyancing Council (ARNECC) on 4 July 2018 in relation to Electronic Lodgement Network Operators.

The Australian Registrars’ National Electronic Conveyancing Council (ARNECC) has the power to suspend or revoke the authority of an Electronic Lodgement Network Operator to conduct business on their Network.

My questions (and I am sure the media would like to know your answers) are:

1. 1. Why is the Little Group investing in a company that will increase the cost of buying and selling property for the “Mum’s and Dad’s” and individuals in Australia and also increasing the money required to make a first property purchase or upsize or downsize on the property ladder?
   2. Does the Little Group think, when floated on the stock market, potential investors (potentially “Mum & Dad” investors) will be interested in a company that has increased the cost of buying and selling property in Australia.
   3. Does the Little Group think, when floated on the stock market, potential investors (potentially “Mum & Dad” investors) will be interested in a company that has a system whereby customers could potentially have their money stolen in an electronic property settlement system?
   4. Why is the Little Group continuing to own shares in a company that has electronic property settlement System that is seen as flawed by the general public and public confidence that has been diminished in the electronic property settlement system?
   5. Will the Little Group sell their shareholding in the Property Exchange Australia company now that you are aware that the general public has diminished confidence in the Electronic Conveyancing system to complete their property sales/purchases and that the general public has no confidence in the integrity and security of the system?

I do not believe public confidence will return to the electronic method of completing property settlements as they are angry about the lack of protection with the possibility of having their money stolen by cyber criminals.

The public is outraged by the thought that anyone of them could have their money stolen in a property settlement at anytime.

We (the media, the public and me) look forward to receiving answers, to the questions posed, from you as the head of the Little Group.

Yours sincerely,

(Name withheld)

EDITOR’S NOTE:
The facts of this email have not been verified. A response from PEXA is welcome.

PEXA RESPONDS

I am writing to you in response to the above-mentioned article published on your website on 22 August 2018. We note that you state the facts of the email quoted in your article (Email) have not been verified. We have some concerns that the email contains a number of errors and exaggerated claims.

The introductory paragraphs of the Email refer to incidents involving PEXA, but items 2, 3 and 4 listed in the Email do not appear to relate to PEXA transactions at all. These were frauds perpetuated in paper-based transactions. Item 1 in that list of incidents has been well publicised. To claim these additional matters are incidents involving PEXA is incorrect and misleading.

While the recent fraud incidents certainly highlighted the very real risk of cyber-crime, we believe PEXA is still a vastly safer system in contrast to paper. In May, Martin Hoffman, Secretary, Department of Finance, Services and Innovation stated that since 2013 the NSW Registrar General has paid out $2.1m for errors in paper transactions and $7.3M for fraud. In the same period, not one single payment has been made on any electronic lodgements.

PEXA has consulted extensively with the various PI insurers in relation to e-conveyancing and PEXA processes on an ongoing basis since at least 2014. The PI insurers regularly publish bulletins and guidance for practitioners, including in relation to e-conveyancing. In June, Lawcover published a paper “Email impersonation fraud” to give comfort that “Lawcover’s professional indemnity insurance (PII) policy covers third party losses arising from an alleged e-conveyancing error such as this example, where the lawyer is at fault”. There have been numerous other recent publications warning practitioners of, and providing guidance on, cyber crime.

The PEXA platform has reliably maintained its 99.8% availability as prescribed under the Model Operating Rules set by its regulator, ARNECC. The vast majority of the system outages experienced by members have been as a result of third party integrated systems – such as land registries and banks. PEXA has built in resilience measures and business continuity planning to ensure in these instances, settlements can still proceed. Even where there are third party system outages, approximately 99% of transactions have still settled on the prescribed date as a result of these initiatives. The claim that settlement delays result in people waiting to move into their new homes is exaggerated.

Finally, in relation to pricing, PEXA has regulatory and contractual obligations which effectively limit PEXA price increases in line with CPI.

PEXA is always open to providing background or on-the-record comments where we can and would appreciate this type of commentary is fact checked first considering the nature of many of the allegations, which we don’t believe are representative of the wider electronic conveyancing community.