How strata owners can protect their funds from fraud

Owners corporations regularly hold significant amounts of money. Levies collected from owners may be used to pay everyday expenses, maintain common property, fund insurance and build reserves for major capital works.

When a strata managing agent administers these funds, owners are entitled to ask how their money is protected. A trust account is an essential legal safeguard, but the account itself is only one part of the answer.

Effective fraud prevention also depends on how payments are approved, who can create or change supplier details, how unusual transactions are detected and whether owners can independently review their scheme’s financial information.

For NSW owners corporations, the strongest protection comes from several controls working together. No single employee should control every stage of a transaction, changes to bank details should be independently verified, and financial activity should remain visible to the people whose money is being managed.

How is Money Held in Strata?

Money received by a strata managing agent on behalf of an owners corporation is generally held as trust money.

Under the Property and Stock Agents Act 2002, licensed agents who receive money for or on behalf of another person must handle that money in accordance with NSW trust-account requirements. NSW Government guidance confirms that strata managing agents must hold client funds in an approved trust account and comply with the applicable record-keeping and audit rules.

Trust accounts are intended to keep client money separate from an agency’s ordinary business funds. The Property and Stock Agents Regulation 2022 also establishes requirements for recording trust transactions, maintaining ledgers, making electronic payments and controlling access to trust-account systems.

These requirements provide an important legal foundation. However, owners should also consider the agency’s internal financial controls: the practical procedures used before money can leave the account.

Why a Trust Account Is Not the Only Safeguard

A properly maintained trust account creates accountability and an auditable record of money received and paid. It does not, by itself, prevent every dishonest, mistaken or manipulated transaction.

Fraud risk can arise internally or externally.

Internal fraud may involve someone misusing legitimate access to financial systems, changing payment information or arranging an unauthorised transfer.

External fraud may involve a supplier’s email account being compromised, a fraudulent invoice being submitted or legitimate bank details being replaced with an account controlled by a scammer.

These risks are different, but they share a common weakness: too much reliance on one person, one email or one approval.

A sound financial-control system is designed so that a payment cannot move from invoice to bank account without several checks being completed and recorded.

Segregation of Duties Reduces Internal Fraud Risk

Segregation of duties means dividing the stages of a financial transaction between different people.

For example, the person who creates a creditor should not necessarily be able to approve the creditor, alter the bank details, process the invoice and release the payment without independent review.

This principle is particularly relevant to strata management because the person who works most closely with a building may also receive its invoices, communicate with suppliers and understand its expected expenditure. That operational knowledge is valuable, but it should not give one individual unrestricted control over the payment process.

A properly segregated process may separate:

1. Receipt and review of the invoice.
2. Creation or amendment of the creditor record.
3. Approval of the expense under the agency agreement or committee instructions.
4. Preparation of the payment.
5. Authorisation or release of the funds.
6. Review of exceptions and unusual account changes.

The NSW Fair Trading supervision guidelines for property agencies require agencies to address financial risks in their operational procedures. Among other controls, the guidelines address authorisation of withdrawals, individual system credentials, verification of deposits and withdrawals, and regular trust-account reviews.

For an owners corporation, the practical question is not simply, “Who pays our invoices?” It is, “How many independent checks occur before our money is released?”

Supplier Payments Should Follow a Controlled Process

A controlled payment process requires invoices to pass through the financial system rather than being paid informally through an online banking portal.

At Strata Choice, supplier invoices are processed through the creditors ledger within the strata-management system. Direct payments through the banking portal are not ordinarily permitted. A limited exception applies to bond refunds, which are reviewed and approved by the Head of Strata Finance before payment.

Processing invoices through the creditors ledger creates a consistent record connecting the supplier, invoice, owners corporation, approval and payment. It also allows creditor changes and transaction histories to be reviewed.

This type of system control is more reliable than depending on an individual to remember the correct procedure every time.

Who Can Create or Change a Creditor?

Creditor records contain the details used to direct payments to suppliers. Access to create or amend those records should therefore be restricted.

At Strata Choice, only authorised personnel can create or change creditor details. This separation limits the ability of an employee processing an invoice to independently redirect its payment to another account.

Changes are also reviewed before daily payment runs. The Head of Strata Finance generates and examines an exception report intended to identify unusual or potentially fraudulent changes, including:

• changes made by an unauthorised user;
• several creditors being updated with the same bank-account details; and
• other unusual amendments requiring further investigation.

Exception reporting is valuable because it focuses attention on activity that falls outside the expected pattern. Rather than relying entirely on someone noticing a problem by chance, the system identifies changes that require review before payments are completed.

How Should New or Changed Bank Details Be Verified?

Bank-account verification is one of the most important protections against external payment fraud.

Business email compromise occurs when a criminal impersonates a supplier or gains access to a genuine email account. They may send an invoice containing different payment details or request that future payments be directed to a new account.

A reply to the same email address is not an independent check. If the account has been compromised, the person responding may be the fraudster.

When a new creditor is created or an existing creditor’s details are changed, Strata Choice requires an employee to:

• obtain a valid contact number for the creditor from a reliable source;
• avoid relying solely on the contact information contained in the request to change the details; and
• call the creditor directly to confirm the bank-account information verbally.

A reliable source may include previously verified records, the supplier’s established public contact details or information confirmed through an appropriate committee member or other trusted contact.

This verification should occur for both brand-new suppliers and established suppliers requesting a change. A long trading history does not make an emailed change of bank details automatically safe.

Significant or Unusual Payments Need Additional Review

A payment may be legitimate but still warrant closer examination because of its size or unusual nature.

Many schemes use committee approval workflows for invoices. Depending on the scheme’s instructions and its strata management agreement, the committee may review invoices before payment or authorise expenditure through resolutions, budgets and delegated limits.

At Strata Choice, non-routine invoices above $10,000 require another level of external authorisation, including where committee approval is not otherwise mandatory. Approval from the strata manager alone is not sufficient to release the payment.

This additional checkpoint is designed to ensure that significant or unexpected expenditure is independently considered before owners corporation funds are transferred.

The appropriate controls may vary between schemes, but committees should understand:

• which expenses require committee approval;
• what spending authority has been delegated to the strata manager;
• whether higher-value payments receive extra scrutiny;
• how urgent payments are handled; and
• whether the approval history is recorded.

Owners Need Meaningful Financial Visibility

Internal controls are strongest when they are supported by external visibility.

Owners and committee members should receive financial reports that allow them to understand the scheme’s income, expenses, cash position and liabilities. Committees should also be able to review invoices and investigate transactions that appear unexpected.

The Strata Choice Owners Portal, powered by SMATA, gives owners and committee members centralised access to key building documents, invoices, financial information and management activity. Dynamic reports representing live data are also available through the portal.

Access to current information does not replace professional accounting controls. It provides an additional layer of oversight by allowing committee members and owners to review what is happening within their own scheme.

A committee that only sees a financial statement once a year may have fewer opportunities to identify anomalies than one with ongoing access to financial records.

What Should Owners Do if a Transaction Looks Suspicious?

If an owner or committee member identifies an unfamiliar payment, the first step is to raise it promptly with the strata manager and request the supporting invoice and approval record.

The committee should establish:

• who requested the payment;
• what authority supported it;
• whether the creditor’s details had recently changed;
• how those details were verified;
• who prepared and authorised the payment; and
• whether similar transactions have occurred.

Where fraud is suspected, early action can be critical. The relevant financial institution should be contacted promptly, access credentials may need to be secured, and the matter may need to be reported to police, Scamwatch, NSW Fair Trading or another appropriate authority depending on the circumstances.

Committees should avoid making public allegations before the relevant records have been examined. The immediate priority should be preserving evidence, attempting to stop or recover the payment and obtaining appropriate professional advice.