Refund bank-detail changes
Verify the client through a known contact record before changing the destination of a tax refund or other payment.
Accountants & tax agents
“Change my refund account” is an identity event.
At tax time, a caller can know enough to sound like the client—or spoof the firm’s own domain back to them. Verify the person behind the instruction and keep a record of the check.
The obligation exists today
TPB client verification predates Tranche 2.
TPB(PN) 5/2022 already expects registered tax practitioners to take appropriate proof-of-identity steps and retain relevant records. Vericode’s verification record can support those record-keeping expectations as part of the practitioner’s own process. It is not TPB-endorsed, certified or approved, and it does not replace professional judgement.
Tax-time information requests
Stop a pretext caller from collecting identity, return or account details that make the next impersonation more convincing.
Client payment instructions
Use the same verify-then-pay discipline for supplier account changes and high-risk instructions your business clients bring to you.
Caller and instruction verification
A control beside the practice system—not another identity platform.
Highlight a phone number or email in any browser-based practice system, tax portal or email client. Right-click to send a one-time SMS code; the client reads it back on the call.
The generic browser extension works with whatever contact record is visible on screen. It complements identity and access controls by authenticating the caller or instruction at the moment staff are asked to act.
Use details already on file
Do not send the code to the new number supplied by the caller. If the known channel is unavailable or the check fails, stop and escalate.
A record for review
Make the verification step visible after tax time.
Exportable evidence
Each check creates a timestamped, hash-chained record of requester, masked target, method and outcome, exportable in PDF or CSV.
Recognisable sender
SMS is delivered through Australian carrier MobileMessage using the ACMA-registered sender ID VERICODE.
Transparent residency
Customer and verification data is hosted in Azure Australia East; staff sign-in identity is handled by WorkOS in the United States.
Tranche 2 adds to the case
Build the documented habit now; extend it as obligations change.
For accountants providing designated services, AML/CTF obligations from 1 July 2026 add another reason to define verification triggers, escalation and retention. Vericode supports a documented instruction-verification step; it does not replace customer due diligence or guarantee compliance.
Read the AUSTRAC Tranche 2 explainerCurrent guidance and threat evidence
Tax practices are trusted—and impersonated.
TPB(PN) 5/2022
The Tax Practitioners Board practice note sets out proof-of-identity requirements, client verification and record-keeping expectations.
Read sourceTPB client verification process
The TPB’s process guidance explains when and how registered tax practitioners should verify clients.
Read source275-firm impersonation check
Accountants Daily reports that most firms in a checked sample of 275 could be impersonated by email.
Read sourceATO and myGov impersonation
Scamwatch warns about impersonation scams trading on the authority and urgency of ATO and myGov communications.
Read sourceVerify, then act
Protect your firm—and model the control for business clients.
Start with refund changes and sensitive disclosures. The same verify-then-pay discipline can become practical advice for clients facing supplier and invoice impersonation.