Completion fraud is not a technical attack in the way people imagine. It is a patience attack. Someone quietly reads a conveyancing email thread for weeks, learns the names, the tone, the reference numbers, and waits. Then, close to completion, an email arrives that looks exactly like the client's or the other firm's, saying the bank details have changed. Please use these instead.

July and August are the danger window because the pressure is highest. Chains are long, everyone wants to move before the holidays, and firms are short-staffed while people are away. The fraudster is not being clever about the season by accident. They want the transfer requested at 4:40pm on a Friday, by a stand-in who has never met the client, with a family waiting for keys and no time to ring anyone.

The small ask - “just update the account number” - is the whole fraud. Once the money leaves for the wrong account it is usually gone within minutes, moved on through a chain of mule accounts before anyone notices. There is no button that reverses it. The recovery rate on these transfers is poor, and the sums are life-changing, which is exactly why the criminals put weeks of patience in.

The defence is a rule you decide in advance and never bend under pressure. Bank details are verified once, early, by ringing a number you already hold - not one from the email - and after that they do not change. If an email says they have changed, that is treated as suspected fraud until a phone call to the known number proves otherwise. The awkwardness of that call is nothing next to the alternative.

The reason to write it down now is that nobody makes good decisions at 4:40 on a Friday in August. A rule on paper, agreed calmly, is what protects the tired stand-in who takes the call. Judgement in the moment is precisely what the fraud is designed to defeat.