When there's no Australian mobile on file
A client calls with a sensitive instruction, but the file holds only a landline, no number at all, or an overseas mobile. Here is how we suggest applying the published guidance to each case.
A number on file is only as good as how it got there.
LPLC uses both “previously known” and “independently sourced” to describe the number to call back on. Neither means any number saved in a file is trustworthy. Record where each number came from, and treat a recent change to it as a reason to look harder.
None of the sources below sets out a full procedure for clients without a mobile. Where this guide goes beyond their wording, it says so.
You hold a landline, not a mobile
LPLC's guidance is to call on a number you already know, not a number given in the call or a new email. Our inference: an established landline can carry the call-back, provided you are confident the number is correct. For payments, read the BSB and account number aloud, ask for them to be read back, and compare them with the details you were sent.
LPLC: Call first to avoid cyber fraud (2023)Hang up and call back on that number rather than continuing the incoming call. Scamwatch's advice is to call back on a number you have found yourself.
Scamwatch: Phone scams
You hold no number at all
Don't adopt the number the caller gives you as the trusted one. A number supplied during the call isn't independently established, and a private client often has no public listing to check it against.
Scamwatch: Phone scamsLPLC's client brochure tells clients to call or physically see a known contact at their firm. Firms can apply the same idea in reverse: meet the client, or pause until you can reach them through a channel you established earlier. That is our suggestion, not LPLC's wording.
LPLC: Cyber security, how to protect yourself (2024)Tax practitioners engaging remotely can use video to sight documents. TPB(GS) 42/2022, paragraph 28, says video engagement keeps the same requirements as face-to-face engagement. A phone call or call-back on its own is not the whole client verification process.
TPB(GS) 42/2022: Proof of identity requirements, para 28
The number on file is overseas
LPLC's advice is to independently source the number you call. It doesn't discuss foreign numbers; our suggestion is to apply the same principle to them, and to look at how the number got onto your file rather than its country code.
LPLC: Call first to avoid cyber fraud (2023)Caller ID can be faked, so an incoming call showing the overseas number on file doesn't tell you who is calling. Call back using contact details you established yourself, not the number on the incoming call display.
ACMA: Caller ID scamsA familiar voice isn't enough either. The Law Society of NSW warns that voices can now be replicated, so don't rely on recognising the client.
Law Society of NSW: Don't be a victim of cyber fraud (2023)If the client is physically overseas for a conveyancing VOI, ARNECC's Guidance Note 2 describes Australian consular services with any necessary further steps, and says an international financial institution or law practice may use its overseas personnel. That applies to where the person is, not to a foreign phone number.
ARNECC: Guidance Note 2, Verification of Identity (2024), s 5.2
Record the exception
- Which number you used, what type it is, and when and how it was first established
- Who called, who called back, and the date and time of each call
- The instruction, including any BSB and account number read back in full
- Why you couldn't use your usual check, and what you did instead
- Whether you paused the instruction, met the client, or escalated
A suggested checklist, not a statement of minimum legal requirements.
Vericode only texts Australian mobiles. These clients need a different check.
Vericode sends a short code to an Australian mobile your firm already holds and records the result. It can't send to a landline or an overseas number, so none of the cases above can be handled with a code check. Call back where you have an independently established number. Otherwise pause and arrange other appropriate checks, and record the steps you took.
Where you do hold an Australian mobile, a correct read-back shows the caller knew the code sent to that number for that check. It doesn't show who they are or who controls the phone. Vericode is not a VOI service, and a successful check does not establish compliance with any professional, VOI or AML/CTF requirement.
- LPLC: Call first to avoid cyber fraud (2023)
- LPLC: Cyber security, how to protect yourself (2024)
- Scamwatch: Phone scams
- ACMA: Caller ID scams
- ASD's ACSC: Protecting against business email compromise
- Law Society of NSW: Don't be a victim of cyber fraud (2023)
- TPB: Client verification process for tax practitioners
- TPB(GS) 42/2022: Proof of identity requirements
- ARNECC: Guidance Note 2, Verification of Identity (2024)
These organisations are cited for general guidance, not as endorsers of Vericode.
Collect a call-back number at engagement, and note where it came from.
Most of these cases are easier if the file already holds a number you trust and a note of how you got it.