Payment instruction emails and AI security: what a settlement funds email gives away in ChatGPT or Claude.

The payment instructions email tells the clients how much to send, to which trust account and by when. It is short, it has to be right, and it is often the email a junior pastes into ChatGPT or Claude for a friendlier tone. It carries the three facts a payment redirection fraud needs: the amount, the date and the account, with the practice’s own fraud warning beside them. This page marks every item in a routine funds email for a NSW purchase that bears on trust account, Scamwatch and privacy obligations, and shows how the same email is written on Ermos inside the practice.

The payment instructions email

Sent to the clients in the weeks before settlement, listing what is owed, where to send it and what to do if anything looks wrong.

An invented email. The BSB and account number are placeholders, and the duty figure is illustrative rather than an assessment. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The recipients

   Two named clients. Personal information, and the people whom a fraud email would be addressed to. Privacy Act guide.

2. 2
   The property in the subject line

   A specific address about to change hands, in the one line most email systems show first.

3. 3
   The settlement date and time

   When the money moves. Scamwatch describes payment redirection as an email asking that an upcoming payment go to another account, and the date is what tells the fraudster when to send it.

4. 4
   The amounts

   What each client must pay, in itemised form, down to the cent. With the date, the second fact a fraud needs. The itemised figures also show the clients’ cash position. Privacy Act guide.

5. 5
   The trust account details and reference

   The account clients are told to pay into. NSW Government guidance says client funds must be held in a trust account at an approved authorised deposit-taking institution and cannot be used for any other purpose, and the account’s details are what a fake email would swap for another.

6. 6
   The anti-fraud warning

   The sentence that protects the clients, almost word for word the advice Scamwatch gives: call the business using contact details you already hold, rather than those in a message. It is generic wording that many practices use.

7. 7
   The lender and the loan amount

   Which bank is lending and how much. Financial information about the buyers that shows the size of their loan and the lender they chose. Privacy Act guide.

8. 8
   The sender and the phone number

   The staff member and the number the client is told to ring. If a fraudster has this, the number can be mimicked or spoofed to answer a client’s check.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in conveyancing practices.

Common questions