ATO to taxpayer
A taxpayer gets a call claiming to be the ATO and checks it in the ATO app.
Accountants guide · ATO Verify Call
The ATO can now prove it's the ATO. How does your practice check the caller?
Verify Call protects taxpayers from fake ATO calls, and the IPA wants something similar for tax and BAS agents. Neither covers the call that actually changes a refund account: the “client” ringing your practice.
What changed
A call-verification check, built into the ATO app.
The ATO has added a Verify Call option to its app. As Accountants Daily describes it, a taxpayer who receives a call claiming to be from the ATO opens the app, logs in and selects verify call. If the call is genuine, a notification arrives within about 30 seconds. If no notification arrives, the taxpayer should hang up.
Days later, the Institute of Public Accountants asked the ATO to extend a similar feature to registered tax and BAS agents. IPA senior tax advisor Tony Greco said tax agents had “long called for such a feature in the best interests of their clients, businesses, and employees.”
That is a professional body saying out loud that its members need call verification. It is worth watching. It is also worth being clear about which direction of call it covers.
01 · Three directions of trust
Verify Call answers one question. Your practice faces another.
Tax agent to client
The IPA has asked the ATO to give registered tax and BAS agents a similar feature, so clients could confirm a call from their agent is genuine.
Client to practice
Someone calls the practice claiming to be a client and asks to change a refund account, a mobile number or an email address. No ATO feature covers this call.
The gap
Verify Call helps a taxpayer decide whether to trust a caller. Your receptionist has the same problem in reverse, with no app to open. The caller may know the client's name, TFN, address and that a refund is due, because that information can come from a compromised inbox or a stolen document. What the caller wants is the bank account for the refund changed, or the mobile number updated so every later check reaches them.
02 · Practical steps for a firm
Don't wait for an ATO feature to cover the inbound call.
None of these steps need new software. They need a decision about which requests get checked, a trusted number to check against, and a record that the check happened.
- 01
List the requests that need a check
Write down the changes that should never go through on an unverified call: refund or payment bank accounts, mobile numbers, email addresses, authorised contacts, and requests for copies of returns or notices.
- 02
Confirm a trusted number at engagement
Capture the client's mobile at onboarding and confirm it there and then. A check is only as good as the number you check against, so it has to exist before anyone needs it.
- 03
Never verify on the incoming call
Don't rely on caller ID, a familiar voice or the client knowing their TFN, address and last refund amount. Pause the request and come back through the number already on file.
- 04
Treat contact changes as high risk
A request to change the mobile or email is often the first step, because it moves every later check to the attacker. Verify a contact change through the previous details, not the new ones.
- 05
Decide what happens when it fails
If the client can't be reached or the check fails, the request stops. Name who can approve an alternate method so reception isn't left to improvise in peak season.
- 06
Record each check
Note who asked, what for, the number used and where it came from, who answered, the time and the outcome. Keep it with the client record next to the change.
03 · Where an SMS challenge fits
The same idea as Verify Call, pointed the other way.
Verify Call works because the check goes through a channel the taxpayer already controls, not the incoming call. A practice can apply the same principle to the client calling in: send a one-time code to the mobile number already on file and ask the caller to read it back while they are still on the line.
Vericode does this from the browser. Staff highlight the number in their practice system, tax portal or email client, right-click and send the code from the ACMA-registered sender ID VERICODE. Each check creates a timestamped, hash-chained record of who requested it, the masked number, the method and the outcome, exportable as PDF or CSV.
Source
Reporting is cited for context. No ATO, IPA or Accountants Daily endorsement of Vericode is implied.
Check the client before you change the account
Give reception a check that takes seconds, not a round of call-backs.
Free 14-day trial, no card required. Set it up on your own mobile first, then use it on the next request to change a refund account or contact details.
General information only. This guide is not legal, tax, AML/CTF compliance or cybersecurity advice. Vericode records whether the expected code came back for the number challenged; it does not establish a person's identity or satisfy TPB, AML/CTF or other regulatory obligations. Follow official ATO and TPB guidance for your circumstances.