Guide · Mortgage brokers and financial advisers

A caller says they're your client and wants to change where the money goes

The name is right, the story is plausible, and they know the file. That still isn't enough to change a payment instruction. Here is what the published material says about payment redirection and impersonation, and a short routine your team can use before anything changes.

The short version

Hang up, call back on the number you already hold, and get a second set of eyes.

The sources below provide general guidance rather than this six-step routine for brokers or advisers. ASD recommends checking unusual requests on a verified phone number and having an approval process for payment changes. Scamwatch recommends independently sourcing contact details. The routine below is our suggestion, drawn from that guidance.

What's being reported

Payment redirection is a known pattern, and broking is named in it.

  • The National Anti-Scam Centre's combined data shows Australians reported $166.8 million in payment redirection scam losses in 2025, up from $152.6 million in 2024. That figure covers all sectors and reporting organisations, not brokers or advisers alone.

    NASC: Targeting scams, report on scams data and activity 2025

  • In its January 2024 submission on the scams codes, the MFAA described payment redirection scams where scammers get into communications between a broker and a customer to influence where the customer sends funds. It also reported members encountering scammers posing as customers and sending malicious files.

    MFAA: Scams, Mandatory Industry Codes submission (29 January 2024)

  • Impersonation runs the other way too. The National Anti-Scam Centre describes investment scams in which a fake financial adviser contacts a prospective investor and supplies professional-looking documents. Separately, ASIC's Investor Alert List includes warnings about impersonation of legitimate businesses.

    NASC: Investment scam fusion cell final report (May 2024)
What the guidance says

Check the request through contact details you already trust.

  • ASD advises businesses to verify unusual requests by calling the sender on a verified phone number, rather than a number supplied in the email. It also recommends an approval process for changes to payment details or large transfers, with clear staff guidance and escalation when someone pushes to skip it.

    ASD: Learn about account compromise

  • Scamwatch tells people checking a suspicious call never to use contact details the caller supplied, or details in an email or SMS, and to call back using details they found independently.

    Scamwatch: Phone scams

  • ASIC has warned that imposter financial services websites can display fake scam-warning banners with phone numbers that connect to scammers. A professional appearance is not evidence that a website is genuine. Independently check that a number belongs to the genuine organisation before calling it.

    ASIC: Scammers are using fake warning banners on imposter websites (March 2024)
Where the SPF fits

The 2026 SPF designation does not separately designate mortgage broking or financial advice.

  • The 2026 designation covers specified banking, telecommunications and digital platform services. Mortgage broking and financial advice aren't separately designated. Coverage turns on the services and entities, not business labels, and none of this affects your obligations under other laws.

    Federal Register: Scams Prevention Framework, Regulated Sectors Designation 2026

  • The designation's transitional exceptions for the SPF external dispute resolution membership provision ended on 1 September 2026. Most other provisions remain subject to transitional exceptions until 31 March 2027; provisions concerning sector-specific codes and ministerial authorisation of dispute resolution schemes were excepted earlier. These dates do not establish which obligations apply to your firm.

    Federal Register: Designation 2026 and explanatory statement
A suggested routine

Six steps for the person who takes the call

  1. 01Pause the request. A short line for staff: "We check changes to payment instructions independently. I'll call you back on the details we already hold."
  2. 02End the incoming call. Call the client on a number established independently before the request and recorded on their file. Don't use a new number supplied with the request.
  3. 03If the number on file is missing, was recently changed, or is disputed, don't proceed on this call. Escalate it through a separate process.
  4. 04On the call-back, ask the client to state the recipient, amount, destination account and reason for the change themselves. Confirm authority through your firm's separate process. These answers alone do not establish identity, authority or ownership of the destination account.
  5. 05Have a second person review the evidence under your firm's approval process. If you work alone, keep the request paused and use your agreed licensee or principal escalation route. If no route is available, leave the request paused until an appropriate review is arranged.
  6. 06If funds may already have gone astray, contact the relevant bank straight away, keep the evidence, and report through the appropriate channels.

Our suggestion, drawn from the sources on this page. ASD doesn't say every firm must use exactly two approvers, and this isn't a licensee, ASIC or AFCA procedure.

The file note

Record the check

  • How the request arrived, and exactly what was asked for
  • The number you called back on, and where that number came from
  • The checks you did, and anything left unresolved
  • Who reviewed it, and the outcome

ASD's incident guidance asks businesses to record what happened, when, the response, and any ReportCyber reference. Keeping a note for routine payment changes too is our suggestion, not a sourced retention rule.

Where Vericode fits, and where it stops

A matching code is an additional observation. It does not replace independent contact, authority checks or approval.

Vericode sends a one-time SMS code to a mobile number selected by staff, checks the code read back and logs the outcome. For this routine, staff must use the client's independently established number already on file. A match does not establish identity, authority or ownership of the destination account. Using Vericode does not, by itself, satisfy AML/CTF, verification of identity, SPF, licensee or other legal obligations.

Scamwatch identifies a caller asking for a one-time code as a warning sign. A firm saying it has just sent the code does not establish that the caller is genuine. Never ask for a bank, lender, login or payment-authorisation code. Do not ask clients to disregard an SMS warning against sharing its code.

Our suggested safeguard: explain the code process in advance through an independently established channel. If the client is unsure, stop the check and let them contact the firm using details they independently trust. Only request the specific Vericode code after that contact is established. A matching code can still be relayed by someone else and does not prove who received the SMS. If anything remains uncertain, leave the payment change paused.

Sources (checked 30 October 2026)

These organisations are cited for general guidance, not as endorsers of Vericode.

Before the next request

Establish the call-back number before anyone asks for a change.

Establish the call-back number independently before a change request, record its source, and resolve any doubts about it before proceeding. A call-back alone does not establish identity, authority or the legitimacy of the destination account.

Settlement-week verification checklist Hacked client email and withdrawal fraud
General information only. This guide is not legal or financial advice. Follow your licensee's procedures and current regulator guidance.