Australian context for the terms that appear in scam prevention, identity checks, privacy, AML/CTF and dispute response. Definitions are orientation, not legal advice.
Scam techniques
Scam techniques
How attackers create trust, urgency and false instructions.
Vishing is voice phishing: a scam delivered by phone or voice message. The caller may impersonate a bank, adviser, client, supplier or government agency and use urgency, familiar details or a spoofed number to make the story credible. The safest response is to stop, find the organisation's published contact details independently and call back through that trusted channel. A verification code helps only when the surrounding interaction is sound; it should never override pressure, secrecy or an unsolicited caller asking for the code.
Smishing is phishing by SMS or another text-message service. A message may claim that a parcel, account, invoice or payment needs urgent action, then direct the recipient to a fake site or phone number. Sender names and message threads can look familiar, so appearance alone is not proof. Do not follow an unexpected link or share a code; open the organisation's known app or type its published address yourself. Genuine Vericode code messages are short, use the sender name VERICODE and do not ask the recipient to click a link or send money.
Phishing is an attempt to obtain money, credentials or personal information by pretending to be a trusted person or organisation. It most often arrives by email, SMS, messaging service or a fake website, but the underlying technique is deception rather than a particular channel. Warning signs include unusual urgency, changed payment details, unexpected login prompts and requests to bypass normal checks. Verify the request through contact details you already trust and report suspicious messages through the organisation's established process instead of replying to the sender.
Business email compromise is fraud that uses a compromised or convincingly imitated business mailbox to redirect a payment, release information or change an instruction. The email may contain genuine names, signatures and matter details because the attacker has observed a real conversation. Controls therefore need to test the instruction through a separately trusted channel, not merely inspect how authentic the email looks. High-risk changes such as bank details, settlement directions or withdrawals should trigger a consistent verification and escalation process before anyone acts.
A payment redirection scam changes genuine payment instructions so money goes to an account controlled by a criminal. The attacker may compromise an email account, impersonate a supplier or client, or alter an invoice shortly before payment. The strongest warning is often a change in account details combined with urgency. Staff should pause, use a trusted contact point held before the change, confirm the instruction through a controlled process and preserve evidence of that check. If money has moved, contact the sending bank's fraud team immediately.
Invoice fraud uses a false or altered invoice to cause an incorrect payment. The document may be wholly fabricated or may copy a real supplier's branding while substituting the attacker's bank account. A matching logo, purchase order or email history does not establish that the payment details are genuine. Treat new or changed bank details as a high-risk instruction, compare them with trusted records and confirm them through an independently sourced contact channel. Separate approval and payment roles can reduce the chance that one hurried decision releases funds.
Caller ID spoofing makes a call display a number or name chosen by the caller rather than a reliable origin. A scam call can therefore appear to come from a bank, firm, government agency or a familiar local number. The display is a clue, not authentication. If the call concerns money, access or sensitive information, end it and contact the organisation through a number obtained independently. A callback is only protective when the number and process are trusted, and when the attacker cannot control the return path.
An SMS sender ID is the name shown as the sender of an application-to-person text message, such as VERICODE. Australia's SMS Sender ID Register is intended to make registered sender names harder for scammers to impersonate by requiring participating telecommunications providers to handle registered and unregistered use differently. Registration strengthens a signal but does not make every message or surrounding request safe. Recipients should still assess context, avoid unexpected links and stop when an unsolicited person asks for a code, money or credentials.
Number porting moves a mobile number between services or carriers. A SIM-swap attack abuses that process so an attacker receives calls and SMS messages intended for the victim, including one-time passwords. Sudden loss of mobile service can be a warning sign, especially when paired with account alerts. Contact the mobile carrier and affected financial providers through trusted channels immediately. SMS possession is useful evidence in a live interaction, but it is not proof of identity in every circumstance and should be combined with risk-based controls for high-impact requests.
Social engineering manipulates people into disclosing information, granting access or acting against a normal control. Attackers exploit authority, helpfulness, fear, urgency and familiarity, often using facts gathered from email, social media or an earlier call. The defence is a repeatable process that does not change because the story sounds convincing. Staff should disclose as little as possible, verify through a trusted channel, refuse exceptions and escalate unusual pressure. Technical controls matter, but they work best when people are expected and supported to pause.
Pretexting is a social-engineering technique in which an attacker invents a believable role and situation to obtain information or action. The caller might pose as a client travelling urgently, a new employee, an auditor or a supplier correcting an account. A strong pretext anticipates routine questions and may include genuine stolen details. Test the request against known records and policy rather than debating the story. Do not reveal which answer failed, because that feedback can help the attacker improve the next attempt.
A deepfake is synthetic or manipulated media made to resemble a real person. Voice cloning can reproduce speech from a small sample and may be used to imitate a client, executive or family member. Familiar sound is therefore not reliable authentication for a high-risk instruction. Use a trusted contact point and an independent verification process, ask for no unnecessary personal facts, and escalate pressure or unusual requests. The goal is to validate the channel and instruction without relying on the realism of the voice.
A "Hi Mum" scam begins with a message claiming that a family member has a new phone number, then develops into an urgent request for money or account access. The language may be affectionate and plausible, but the new number prevents an ordinary recognition check. Contact the family member through the number or channel already saved, or ask another relative to confirm independently. Do not send funds merely because the sender knows names or personal details; those facts may come from social media or a prior data breach.
A remote access scam persuades a person to install software or grant screen control to someone pretending to provide technical, banking or government help. Once connected, the attacker may observe passwords, alter payments or hide activity on screen. Legitimate verification does not require a recipient to install remote-control software or let a caller operate their device. Disconnect the device from the network, contact the bank and affected services from a safe device, and follow current cybercrime reporting guidance if access was granted.
Identity theft is the unauthorised use of another person's personal information to impersonate them, obtain credit, access accounts or commit fraud. The information may come from phishing, stolen documents, a data breach or public sources. A person who knows accurate biographical details is not necessarily the genuine client. Organisations should minimise collection, protect records and use controls suited to the action's risk. Victims may need to contact financial providers, government identity services, credit-reporting bodies and police depending on what was exposed or used.
Identity verification is the process of checking that a claimed identity is supported by appropriate evidence. Depending on purpose and risk, that may involve documents, authoritative data sources, biometrics or other controls. It is broader than confirming that someone can access a phone number during a live interaction. Vericode is not an identity-document verification platform: it supports CDD-adjacent contact verification and produces evidence of that check. Firms should keep the distinction clear when designing onboarding and later transaction controls.
In Australian electronic conveyancing, verification of identity commonly refers to the ARNECC model requirements used to take reasonable steps to verify a client's identity. The process has its own standards, categories and professional context; it is not interchangeable with a one-time SMS contact check. A VOI completed at onboarding also does not prove that a later caller or email sender is the same person. Conveyancing practices need both the prescribed or risk-based identity process and controls for later high-risk instructions.
Know your customer, or KYC, is an industry term for processes used to identify a customer, understand relevant risk and meet applicable onboarding or regulatory requirements. Its exact content depends on the organisation, service and legal regime. Vericode supports CDD-adjacent contact verification and produces evidence of that check. It is not a KYC platform, does not verify identity documents, does not screen sanctions or politically exposed persons, and is not a complete AML/CTF program. A phone-number check should not be labelled as completion of KYC.
Customer due diligence is a risk-based process for identifying and verifying customers and relevant beneficial owners or representatives, understanding the relationship and applying controls required by an AML/CTF program. It can include initial and ongoing measures and enhanced checks for higher risk. Vericode supports CDD-adjacent contact verification and produces evidence of that check, but it does not perform the complete CDD process. Each reporting entity must determine and document the measures required for its designated services, customers and risks.
Ongoing customer due diligence keeps customer information, risk assessments and monitoring appropriate throughout the relationship. Changes in authority, behaviour, ownership, contact details or transaction patterns may trigger review, re-verification or enhanced measures under the entity's AML/CTF program. It is distinct from a one-off onboarding check. Contact verification can contribute evidence when a later high-risk instruction is received, but the reporting entity remains responsible for monitoring, escalation, reporting and the wider due-diligence decision.
AUSTRAC is Australia's anti-money laundering and counter-terrorism financing regulator and financial intelligence unit. It administers the AML/CTF framework, receives prescribed reports and publishes guidance for reporting entities. AUSTRAC does not endorse Vericode, and using a contact-verification tool does not guarantee compliance. A business must assess whether it provides designated services, understand its commencement and enrolment position, build an appropriate program and obtain qualified advice where the legislation or guidance does not resolve its circumstances.
AML/CTF means anti-money laundering and counter-terrorism financing. Australia's framework requires covered reporting entities to understand and manage relevant risks, conduct customer due diligence, keep records and make required reports. The details depend on the designated services provided and the applicable law and rules. Vericode is not a complete AML/CTF program; it can support CDD-adjacent contact verification and evidence a particular check. Governance, risk assessment, monitoring, sanctions or PEP screening, reporting and identity-document verification remain separate responsibilities.
Tranche 2 is the common name for extending Australia's AML/CTF obligations to specified services provided by newly regulated professional sectors, including certain legal, accounting, real-estate and trust-and-company services. Professional title alone does not determine coverage; the designated service and facts matter. The new obligations commence from 1 July 2026, with enrolment timing depending on when the business begins providing a captured service. Firms should map services and use current AUSTRAC material rather than assume every engagement is either included or excluded.
Designated services are the activities listed by Australia's AML/CTF legislation that can bring a provider within the reporting-entity regime when the statutory conditions are met. Coverage turns on the service, customer and Australian connection, not simply the provider's profession. Under Tranche 2, examples can include specified real-estate transactions, trust or company services and management of client assets. A firm should map each service line carefully and seek advice for borderline work rather than applying a broad label to the whole practice.
The Privacy Act 1988 is the principal Commonwealth law regulating how covered Australian organisations and agencies handle personal information. It includes the Australian Privacy Principles and the Notifiable Data Breaches scheme, along with other rights and obligations. Coverage and exceptions depend on the entity and circumstances, so the Act should not be reduced to a generic consent rule. Organisations using verification services remain responsible for their own notices, lawful handling, security, access and correction processes, retention decisions and response to eligible data breaches.
The Australian Privacy Principles are the baseline standards in the Privacy Act for the handling of personal information by APP entities. They address matters including open and transparent management, collection, use and disclosure, direct marketing, overseas disclosure, security, access and correction. Which principles apply depends on the activity and organisation. A supplier's technical controls do not remove the customer's APP responsibilities; contracts, notices, data minimisation, access governance and incident procedures all need to reflect the organisation's actual use of the service.
An APP entity is an agency or organisation that is covered by the Australian Privacy Principles under the Privacy Act. Whether a business is covered can depend on turnover, sector, activities and specific statutory inclusions or exemptions. The label matters because APP entities have obligations across the personal-information lifecycle, not only when a breach occurs. Businesses should confirm their own status and avoid assuming that a supplier's compliance position determines theirs. Even where an exemption may apply, contractual, professional and security duties can still require careful information handling.
The Notifiable Data Breaches scheme requires covered entities to assess suspected eligible data breaches and notify affected individuals and the OAIC when the statutory test is met. Broadly, the test concerns unauthorised access, disclosure or loss likely to result in serious harm where remedial action has not prevented that likelihood. Not every security incident is automatically notifiable, but delay can make response harder. Organisations need an incident process that preserves evidence, contains exposure, assigns assessment responsibility and records the basis for notification decisions.
The Office of the Australian Information Commissioner is the independent Commonwealth regulator responsible for privacy and freedom-of-information functions. For privacy, the OAIC publishes guidance, receives eligible data-breach notifications and can investigate complaints and possible interferences with privacy. It is the authoritative starting point for APP and NDB guidance, but its public material is not a substitute for advice on a particular incident. Organisations should keep links and internal escalation details current before a breach occurs.
A data breach occurs when personal information is accessed, disclosed or lost without authorisation. Causes include malicious intrusion, a misdirected email, stolen credentials, lost devices and accidental publication. A breach is broader than a confirmed cyberattack and is not automatically an eligible breach under the NDB scheme; the entity must assess the facts and likely serious harm. Immediate priorities are containment, evidence preservation, risk assessment, legal and insurer escalation where appropriate, remediation and clear records of the notification decision.
Data residency describes where data is hosted or stored. Data sovereignty describes the legal authority and jurisdiction that can apply to data and its service providers; the terms are related but not identical. For Vericode, customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the subprocessor information on the data-residency page. Claims that all data stays in one country would miss that qualification.
The General Data Protection Regulation is the European Union's data-protection regime. It can apply beyond the EU in defined circumstances, including some offerings to or monitoring of people in the European Economic Area. It uses concepts such as controller, processor, lawful basis and data-subject rights that do not map perfectly onto Australian Privacy Act terminology. An Australian business should not assume that APP compliance establishes GDPR compliance, or vice versa. Scope and role allocation need assessment based on the actual processing and people affected.
Under GDPR terminology, a controller determines the purposes and essential means of processing personal data, while a processor handles data on the controller's documented instructions. The role is determined by facts, not merely by the label in a contract, and one organisation can hold different roles for different processing. Australian privacy law uses different statutory language, though contracts often borrow these terms for clarity. Customers and suppliers should document instructions, security, subprocessors, assistance, deletion or return, audit rights and responsibility for individual requests.
A data processing agreement, or DPA, sets contractual terms for one party's processing of personal data on behalf of or in connection with another. Depending on the governing law and relationship, it may cover documented instructions, confidentiality, security measures, subprocessors, breach assistance, international transfers, audits and deletion or return. A DPA is not itself proof that the processing is lawful or secure; the parties must operate the controls it describes. Buyers should check that schedules and subprocessor details match the actual service architecture.
A subprocessor is a third party engaged by a service provider to process personal data while delivering the service, often in hosting, identity, messaging or support infrastructure. Customers need enough information to understand the function, location and contractual safeguards of material subprocessors. Vericode's residency statement distinguishes Australian hosting of customer and verification data from staff sign-in handled by WorkOS in the United States. A subprocessor list should be read together with the DPA, security material and the organisation's own cross-border assessment.
An audit trail is a chronological record that helps reconstruct who did what, when and with what result. In Vericode, each authorised-contact check creates a timestamped, hash-chained record of who requested it, the masked target, method and outcome. The current authorised-contact schema is mobile-number based and does not describe an email target. Compliance-authorised users can export the result as PDF or CSV. An audit trail supports review and evidence, but it does not by itself prove that every surrounding instruction was legitimate or compliant.
Multi-factor authentication requires more than one type of factor to gain access, commonly something known, possessed or inherent. It protects an account or session, while caller verification addresses whether a person in a later interaction can access a selected contact channel. The controls can complement one another but should not be treated as interchangeable. SMS is widely used as a possession factor, yet phishing and SIM-swap risks mean higher-risk systems may prefer phishing-resistant methods such as passkeys or hardware security keys.
A one-time password is a short-lived code intended for a single authentication or verification event. It may be generated by an app, hardware token or service and delivered through a channel such as SMS. Codes expire quickly and a newer request can supersede an earlier code. A recipient should only use or read back a code in the interaction they initiated or recognise, and should never give it to an unsolicited caller. Organisations should avoid treating possession of one code as conclusive proof in every risk context.
Australia's Scams Prevention Framework is a legislative framework for sector-specific scam prevention obligations, beginning with designated sectors and supported by rules, codes and regulators. It is intended to strengthen prevention, detection, disruption, reporting and consumer redress across the scam lifecycle. The precise duties depend on whether an entity and service are covered and on instruments made under the framework. Vericode is a verification control, not a guarantee that a business has met every SPF obligation or that a particular loss will receive redress.
The Australian Financial Complaints Authority is the external dispute-resolution scheme for complaints about member financial firms. Consumers generally need to complain to the financial firm first, then may be able to take an unresolved eligible complaint to AFCA. AFCA is independent of Vericode and does not endorse a particular verification control. Records of instructions, warnings, contact attempts and checks can matter in a dispute, but the outcome depends on jurisdiction, facts, applicable codes and the conduct of the parties.
Professional indemnity insurance can respond to covered claims arising from professional services, subject to the policy's terms, exclusions, excess and notification conditions. It is not a substitute for scam-prevention controls, and a verification record does not guarantee indemnity. Firms should understand insurer guidance for high-risk transactions and notify circumstances promptly when the policy requires it. After suspected fraud or data exposure, preserve evidence and involve the designated internal contact, broker or insurer before making admissions or taking steps that could prejudice the response.
Trust account fraud targets money held on behalf of clients, often by changing payment instructions, impersonating a client or supplier, or compromising staff email. The impact can be immediate because the funds may be transferred onward quickly and professional trust obligations are strict. Firms should segregate duties, control changes to bank details, verify high-risk instructions through trusted contact points and retain evidence. If money is sent incorrectly, contact the bank's fraud team immediately, then follow the firm's insurer, police, cybercrime and regulatory escalation process.