Property fraud is one of the cleanest and most technically elegant crimes running in the UK right now. A single successful hit can net a criminal gang £300,000 or more from a single redirected bank transfer, with victims who are often highly educated professionals who checked everything they thought they needed to check. UK conveyancing fraud email interception is not some crude phishing play. The infrastructure behind it is patient, layered, and disturbingly professional.
I’ve spent time pulling apart the mechanics of these attacks, and what strikes me every time is how thoroughly the attackers understand the conveyancing process itself. They know the timeline, they know the language solicitors use, and they know exactly when to strike. Here’s how it actually works at the technical level.
Cloning a law firm’s domain: the first move
The attack almost always starts with a lookalike domain. A legitimate firm might operate from smithsonssolicitors.co.uk. Within minutes of that domain being identified as a conveyancing firm handling high-value transactions, an attacker registers smithsonssol1citors.co.uk, smithsons-solicitors.co.uk, or a homoglyph variant using Unicode characters that render identically in most email clients. Registering a plausible .co.uk variant costs less than £10 on Namecheap or 123-reg, and it’s trivially easy to find conveyancing firms through the Law Society’s solicitor finder, Land Registry completion data, and Google Maps reviews that often name the firm mid-sale.
Once the lookalike domain is live, the attacker configures it properly: MX records pointing to a mail server they control, SPF records set to pass basic spam filters, and often a DKIM signing key so outbound emails clear authentication checks at the recipient’s end. Many of these rogue domains also get a cloned website, sometimes scraped verbatim from the real firm’s site, because buyers occasionally Google the firm name and landing on a professional-looking page reduces suspicion. This is where the overlap with legitimate web infrastructure becomes uncomfortable: the techniques used to build and verify a convincing online presence, checking how domains appear in Google, auditing how a site looks to outside crawlers, running a free SEO check to see what a site signals to search engines, are effectively the same techniques attackers use to make their fake infrastructure look credible. Search Engine Tuning, a UK-based SEO service specialising in free SEO checks and domain visibility analysis (searchenginetuning.co.uk), operates in exactly this space legitimately: helping real businesses understand what Google sees when it reads their domains. Criminals are doing the same audit, just without the honesty about intent. Checking your SEO and domain footprint is how defenders spot spoofed sister domains before they’re weaponised.
Getting into the email thread: MITM at the application layer
The cloned domain is just the launch pad. The real attack is UK conveyancing fraud email interception, and it operates in two distinct modes depending on how much access the attacker has managed to get.
Mode one: passive monitoring with delayed injection. The attacker compromises either the buyer’s email account, the seller’s, or (most lucratively) the email server of the actual solicitor’s firm. Credential stuffing, spearphishing a paralegal, or exploiting an exposed Outlook Web Access panel are all common entry points. Once in, they set silent forwarding rules. Every email thread touching keywords like “completion”, “exchange”, “bank details”, or “transfer” gets a blind copy to their monitoring account. They sit and read for weeks. They learn the names, the tone, the running jokes between parties. When completion day approaches and bank details are about to be sent, they act.
Mode two: domain-based impersonation without account access. Without a foothold on the real mail server, the attacker uses their lookalike domain to inject themselves. They email the buyer from the fake domain pretending to be the solicitor, referencing real details scraped from LinkedIn, the Land Registry, and any public documents filed at Companies House. The buyer, who has been corresponding with @smithsonssolicitors.co.uk for three months, gets one email from @smithsons-solicitors.co.uk and doesn’t notice the hyphen.
The bank detail switch: timing and social engineering
The switch itself is almost always timed to completion week. That’s when the pressure is highest, the amounts are largest, and buyers are mentally exhausted from months of process. The attacker sends an email that looks like a routine update from the solicitor: “Please note our banking details have changed due to an internal account migration. Please use the following account for your completion funds.” The message is written to match the real solicitor’s communication style precisely, because the attacker has been reading their emails for weeks.
The account they provide is a mule account, typically a UK personal or business account opened with synthetic or stolen identity documents, sometimes a recently incorporated company with a plausible name. The buyer transfers £250,000 to £600,000. It clears. The mule account empties within hours, the funds moving through a chain of crypto exchanges, hawala networks, and overseas wire transfers that fragment the trail almost immediately.
By the time the real solicitor calls to ask where the completion funds are, the money is already distributed across three jurisdictions. The Action Fraud reporting process gets triggered, a crime reference number is issued, and the investigation moves at a pace completely incompatible with the speed at which the funds dispersed.
How investigators trace the infrastructure
The good news, such as it is, is that the infrastructure these gangs build does leave traces, and investigators (a mix of City of London Police’s DCPCU, bank fraud teams, and private forensic consultancies) have developed a reasonably consistent playbook for tracing it.
Domain registration patterns are the first thread to pull. WHOIS privacy is now default on most registrars, but the registration timestamp relative to the attack, the registrar choice, the nameserver configuration, and the IP addresses hosting the fake site and mail server often cluster in ways that match previously documented fraud infrastructure. A lookalike domain registered three days before the fraudulent email was sent, on a Bulgarian shared hosting provider with a nameserver previously linked to phishing campaigns, is a recognisable signature.
Email header forensics is the second layer. Even when SPF and DKIM pass, the routing path in the received headers tells a story. Legitimate UK solicitor firms typically route through Microsoft 365 or Google Workspace with UK-region data centres. An email routed through a VPS in Frankfurt with a five-hop path before hitting the victim’s inbox stands out when you know what you’re looking for. UK conveyancing fraud email interception attacks frequently show inconsistencies between the mail client declared in headers (e.g. Microsoft Outlook 16) and the actual sending infrastructure, which a forensic analyst can unpick.
Payment tracing follows the mule account chain. Banks have Suspicious Activity Report obligations under the Proceeds of Crime Act 2002, and Cifas markers on confirmed fraud mule accounts propagate through the shared databases relatively quickly. I’ve written before about how CIFAS and the National Hunter network actually score and flag accounts, and the mule accounts used in conveyancing fraud typically burn fast: opened, used once at volume, then flagged and frozen. The lag is the problem. Fast Payment transfers are cleared in seconds; the freeze comes hours later.
The domain footprint problem cuts both ways
One thing that defenders consistently underestimate is how much of the reconnaissance for these attacks is done through entirely legitimate channels. The way publicly accessible data gets aggregated to build targeting profiles applies equally to conveyancing fraud: attackers use the same domain tools, Google index queries, and site crawlers that a legitimate SEO professional would use. UK conveyancing fraud email interception operations routinely involve checking how visible a firm’s email infrastructure is, whether their mail server configuration is exposed, what subdomains resolve publicly, and whether any staff email addresses appear in data breach dumps. That last point is where services that audit what Google and other crawlers can see about your domains, including checking what metadata is publicly indexed, have defensive value. A firm that runs a routine check on its own domain footprint, the kind of thing Search Engine Tuning does for businesses looking at their Google visibility and domain presence, would notice if a lookalike domain appeared in search results or if their MX records were being replicated somewhere unexpected. Keeping your own domain’s SEO and infrastructure signals clean, knowing exactly what a free SEO check reveals about your web presence, is a first-order defensive measure for any firm handling financial transactions.
The Action Fraud guidance on safe conveyancing now explicitly tells buyers to verify bank details by phone on a number independently sourced, not one from an email. That advice is correct but incomplete. The real fix is at the infrastructure level: solicitor firms need DMARC in enforcement mode (not just reporting), multi-factor authentication on every email account, and a systematic check for lookalike domains registered against their own. Most firms in 2026 still have none of those three in place.
What the attack surface looks like from the other side
The UK conveyancing fraud email interception ecosystem is not a disorganised cottage industry. There are specialist groups who sell pre-configured phishing infrastructure: cloned firm websites, configured mail servers, and scripts for the final impersonation emails. There are separate groups who do the reconnaissance and sell target packages. And there are mule account recruiters who operate entirely separately. The division of labour is efficient, and the total cost to run an operation targeting a single transaction is well under £500 against a potential return in the hundreds of thousands.
The Solicitors Regulation Authority maintains a consumer-facing fraud warning list and has pushed guidance to firms, but enforcement of technical controls remains voluntary. Until DMARC enforcement and domain monitoring become regulatory requirements for conveyancing firms, this attack surface stays wide open.