Caller ID
The number shown on screen is supplied by the calling side and can be spoofed. A familiar name or number on the display tells you what the caller wants you to see, not who is holding the phone.
Practice guide · Client impersonation
How do you know the caller is really your client?
For conveyancers, accountants, brokers and advisers. What doesn't prove who is on the line, the call-back method that does most of the work, where it breaks down, and what to write down.
The problem
Most phone checks test what the caller knows, not who they are.
A typical check goes like this. The number on screen matches the file, the caller gives a date of birth and address, the voice sounds about right, and the change goes through. Every one of those signals can be supplied by someone who is not the client.
Client impersonation usually comes after something else has gone wrong: a compromised inbox, a leaked document, a breach at a third party. By the time the call arrives, the caller may know more about the matter than the person answering the phone.
The question to ask is not “does this caller know the details?” but “can I reach the client through a contact point I already trusted before this request arrived?”
01 · What proves nothing
Four signals staff lean on, and why they fail.
Knowing the details
Date of birth, address, matter number, the last invoice amount. A compromised mailbox, a data breach or a social media profile can supply all of it. Knowing the file is not the same as being the client.
A familiar voice
Voices can be imitated and, increasingly, cloned from short recordings. A rushed call on a bad line also makes a stranger sound close enough.
Urgency and plausibility
The request usually makes sense: a new bank account, a changed mobile, a document needed today. Plausibility is the attacker's job, so it is not evidence.
None of this means staff should be suspicious of every client. It means the check should not depend on how convincing the caller is. A good procedure feels the same to a genuine client and a fraudster: a short, polite pause.
02 · The call-back method
Hang up, call the number on file, confirm the details.
This is the core control, and it costs nothing. It moves the decision away from the incoming call and onto a contact point the firm set up before the request existed.
- 01
Pause the request
Tell the caller you verify every change of this kind and will call them back. Do not action anything during the incoming call.
- 02
Find the number on file
Use the number recorded at engagement or from an earlier, verified interaction. Never use the caller ID or a number given during this call or in the latest email.
- 03
Call back and confirm
Ask the person you reach whether they made the request, and read back the exact details they want changed. Let them say the details first where you can.
- 04
Record the outcome
Write down who checked, which number was used and where it came from, who answered, the time, and what was confirmed or refused.
03 · Where the call-back breaks
A sound method with practical failure points.
The call-back rarely fails because the idea is wrong. It fails because of time, missing records and the absence of a decision about what to do when it can't be completed.
The busy day
Settlement week, EOFY or month-end. The check gets skipped because the queue is long and the caller sounds right. The control only works if it is applied every time, including the days nobody has time for it.
No number on file
The file only holds the number from the latest email, or nothing at all. Staff either ring the attacker or waive the check. Capture and confirm a contact number at the start of the relationship, before money or sensitive changes are in play.
The number on file was already changed
If an attacker updated the mobile a week ago, calling it back reaches the attacker. Treat any recent change to contact details as a flag, and verify the contact change itself through the previous number.
The client can't be reached
They are travelling, in a meeting or never answer unknown numbers. The pressure to proceed rises. Decide in advance who can approve an alternate method and what it is, so staff are not improvising.
No record of the check
Someone remembers calling, but nobody can show which number, who answered or what was confirmed. If it is not written down, it cannot be reviewed after a dispute or a loss.
04 · A short phone script
Words staff can use without sounding accusatory.
“Thanks for letting us know. For any change to bank or contact details we check with every client the same way, so I can't make the change on this call. I'll call you back on the number we already have on file for you. If that number has changed, I'll pass this to [authorised person] and we'll sort out another way to confirm it before anything is updated.”
If the caller pushes back
“I understand it's urgent. This check is there to protect your money and your details, and it only takes a few minutes. I'm not able to skip it.” Pressure to skip the check is itself a warning sign. Note it.
If the caller offers a new number
“Thanks, I'll note that, but I need to confirm through the details we already hold first.” Do not call or text the new number as part of the check.
05 · What to record
If it isn't written down, it can't be reviewed.
A file note made at the time is worth far more than a recollection after a dispute. Keep it with the client or matter record, next to the change it relates to.
- The request as received: who asked, what for, by which channel and when
- The number used for the check and where it came from in your records
- The staff member who ran the check
- Who answered and what they confirmed, refused or did not recognise
- Date, time and method of the check
- Any mismatch, escalation, approval and the final decision
06 · Where an SMS challenge fits
Same principle, less phone tag, and a record by default.
An SMS challenge applies the call-back principle without ending the call. While the caller is still on the line, staff send a one-time code to the mobile number already on file. The caller reads it back. If they can't, the request stops.
With Vericode, staff highlight the number in their browser-based practice system or email client, right-click and send the code. Messages come from the ACMA-registered sender ID VERICODE. Each check creates a timestamped, hash-chained record of who requested it, the masked number, the method and the outcome, which can be exported as PDF or CSV.
It helps most with two of the failure points above: the busy day, because the check takes seconds rather than a round of missed calls, and the missing record, because the record is created as the check happens.
Where this comes up
Same control, different trigger in each practice.
Conveyancers
Changed bank details for settlement funds or a deposit release.
Call before you payAccountants and tax agents
A changed refund account, a new mobile number or a request for return details.
Tax-time vishingMortgage brokers
A change to contact details or loan documents during a live application.
Reverse impersonationFinancial advisers
A withdrawal or transfer request that arrives by email and is confirmed by phone.
Hacked email withdrawalsTry it on your own number first
Make the check quick enough to do every time.
Free 14-day trial, no card required. Verify your own mobile, send yourself a test code, then use it on the next request to change bank or contact details.
General information only. This guide is not legal, compliance, AML/CTF or cybersecurity advice. Vericode records whether the expected code came back for the number challenged; it does not establish a person's identity or replace your firm's identity verification or due diligence obligations.