Money has moved
Call the sending bank immediately and ask its fraud team to attempt a recall. Then report the cybercrime through ReportCyber.
Customer playbook B
Someone is attempting fraud
The moment a check fails - or a caller simply feels wrong - stop the request and follow this page.
Download the printable flowchartStop for any of these
- The caller gives the wrong code repeatedly
- The caller refuses, stalls, or asks for an exception
- A code was sent but the caller cannot read it back
- The verification passes but something still feels wrong
- The caller uses pressure, urgency, or secrecy
Information leakage matters
An attacker may only be at the reconnaissance stage. Confirming a name, balance, reference, address, or staff detail arms the next call. Say less, not more.
The five-step flow
- 1
Stop
Do not action the request and do not disclose anything. The person may still be gathering facts; every detail you confirm can strengthen their next attempt. - 2
Use the exit script
Say the words below. Stay polite. Do not accuse the caller and do not explain which check failed. - 3
Flag it in Vericode
Choose Report on the verification. The suspicious record is routed to your firm's compliance queue. - 4
Tell your escalation contact
Contact the person named on your firm's escalation card. If the card is missing, contact your manager or compliance officer. - 5
Preserve everything
Keep the email, notes, caller number, voicemail, and recording. Do not delete anything and do not return the call.
Say this exactly
“I can't proceed without verification - I'll arrange for someone to follow up on the details we hold on file.”
Polite. No accusation. No detail about what failed. No tip-off.
Australian escalation directory
For the firm's compliance officer. Sources and links checked 19 July 2026.
Attempted fraud, no loss
Report the attempt to Scamwatch and record it in your firm's incident register.
AUSTRAC reporting entity
Have the AML/CTF compliance officer assess an SMR. AUSTRAC says submit within 3 business days after forming a non-terrorism-financing suspicion (24 hours for terrorism-financing suspicions). Do not tip off the person.
Client data may be exposed
Start a Notifiable Data Breaches assessment and notify your professional indemnity insurer. OAIC guidance explains when serious harm makes a breach eligible for notification.
Threats or immediate danger
Call 000. For non-urgent police assistance, use your state or territory police assistance line.
Vericode itself may be compromised
Stop using the service and email [email protected] from a safe device.
Not legal advice. This operational guide does not replace advice from your lawyer, insurer, bank, privacy officer, AML/CTF compliance officer, or police. Follow your firm's incident plan and reporting obligations.