Financial adviser guide · Firm impersonation

The fake adviser can quote a real AFSL number

Cloned websites, spoofed caller ID and public licence details let criminals borrow the surface of a genuine advice firm. Give clients a verification ritual before the approach arrives.

Why the fake feels researched

Advice is built on trust, specialist language and long-lived client relationships. An impersonator does not need to recreate the whole firm. They need enough accurate detail to make an unexpected approach feel like the next step in a genuine relationship.

AFSL and representative information is deliberately public so consumers can check providers. A scammer can copy the same data. The licence number proves that the named business or person exists; it does not prove that the caller, website or account is controlled by them.

That distinction matters in SMSF rollover scams. The approach may mix a real register entry with a cloned page, investment bait and a caller who sounds prepared. Clients need a method that checks the channel, not another fact the criminal can copy.

A public fact is not a secret

A real AFSL number can make a scam more convincing precisely because it is real. Verify control of the relationship, not knowledge of the register.

Four impersonation patterns

  1. 01

    Cloned digital presence

    A copied website, logo, adviser biography or social profile gives the approach a professional surface. Search results and sponsored ads can place the fake in front of a client first.

  2. 02

    Spoofed contact

    Caller ID, sender names and email display names are easy to imitate. A familiar label on the screen is presentation, not proof of origin.

  3. 03

    Borrowed AFSL details

    The scammer quotes a real adviser, authorised representative or AFSL number from public registers. The detail is accurate, but the person using it is not authorised.

  4. 04

    SMSF rollover bait

    Unexpected contact promises access, returns or a simple rollover into an SMSF. The criminal may combine cold calls, online lead forms and repeated follow-up to normalise the relationship.

A client-facing message you can adapt

Have the wording approved for your firm, then use it consistently in onboarding, newsletters and incident communications.

Suggested client letter

Scammers may copy our website, caller ID, adviser names and licence details. Knowing your account or superannuation information does not prove a person represents our firm.

We will not object if you end an unexpected call and contact us using the number in your original records. Do not use a link or callback number supplied in the same message.

Before we discuss a rollover, withdrawal, changed bank detail or sensitive account information, we may send a one-time Vericode SMS code to the mobile number we already hold for you. We will ask you to read that code back while we are speaking. We will not ask for your password or a login code from another service.

If anything differs from this process, stop and contact us independently. Urgency, a familiar voice and a real AFSL number are not reasons to skip the check.

A brandable standalone client one-pager is available as PDF and editable DOCX. This block is an on-page template, not legal or approved client-communication advice.

A mutual-verification protocol

  1. 01

    Set the rule

    Tell clients during onboarding that unexpected contact, accurate personal facts and caller ID never replace the firm's verification process.

  2. 02

    Client checks the firm

    The client stops and contacts the firm using the phone number in their original engagement material or another independently sourced record, not the number in the new approach.

  3. 03

    Firm checks the client

    Before discussing holdings, rollovers, withdrawals or changed details, staff initiate a Vericode SMS check to the mobile number already held in the firm's browser-based records.

  4. 04

    Both sides name the outcome

    The client reads the one-time code back during the live interaction; staff rely on the result in Vericode, not a screenshot or forwarded message.

  5. 05

    Failure becomes an incident

    If either direction fails, stop. Preserve the approach, warn the genuine client through established channels and follow the firm's escalation procedure.

Each authorised-contact check creates a timestamped, hash-chained record of the requester, masked target, method and outcome. Compliance-authorised users can export the audit as PDF or CSV. It supports the firm's evidence; it does not guarantee identity, fraud prevention or a compliance outcome.

Proof of verificationFailed-check responseFirm impersonation guide

Official consumer warnings

ASIC SMSF rollover alert

ASIC warns consumers about self-managed super fund rollover scams.

Read source

ASIC release 24-092MR

ASIC's 2024 release warns about dodgy cold-calling operators and online baiting tactics.

Read source

Moneysmart super scams

Moneysmart explains superannuation scam warning signs and protective steps for consumers.

Read source
General information only. This guide is not legal, financial or compliance advice and does not imply endorsement by ASIC or Moneysmart.
Make “how you'll know it's us” concrete

Give clients a repeatable check before a scammer gives them a story.

Verification for financial advisers How Vericode works