Refund bank-detail changes
Check the client through a known contact record, alongside your identity and authority checks, before changing the destination of a tax refund or other payment.
Accountants & tax agents
“Change my refund account” is an identity event.
At tax time, a caller can know enough to sound like the client, or spoof the firm’s own domain back to them. Check the caller behind the instruction and keep a record of the check.
The obligation exists today
TPB client verification predates Tranche 2.
TPB(GS) 42/2022 already expects registered tax practitioners to take appropriate proof-of-identity steps and retain relevant records. A Vericode check record shows which staff member sent a code to which number on file, when, and whether the caller read it back. Whether that belongs in your client records is your call. It is not TPB-endorsed, certified or approved, and it does not replace professional judgement.
Tax-time information requests
Stop a pretext caller from collecting identity, return or account details that make the next impersonation more convincing.
Client payment instructions
Use the same verify-then-pay discipline for supplier account changes and high-risk instructions your business clients bring to you.
Caller and instruction verification
A control beside the practice system, not another identity platform.
Highlight a phone number or email in any browser-based practice system, tax portal or email client. Right-click to send a one-time SMS code; the client reads it back on the call.
The generic browser extension works with whatever contact record is visible on screen. It complements identity and access controls with a recorded caller check at the moment staff are asked to act.
Use details already on file
Do not send the code to the new number supplied by the caller. If the known channel is unavailable or the check fails, stop and escalate.
A record for review
Make the verification step visible after tax time.
Exportable evidence
Each check creates a timestamped, hash-chained record of requester, masked target, method and outcome, exportable in PDF or CSV.
Recognisable sender
SMS is delivered through Australian carrier MobileMessage using the ACMA-registered sender ID VERICODE.
Transparent residency
Customer and verification data is hosted in Google Cloud Sydney (Australia); staff sign-in identity is handled by WorkOS in the United States.
Tranche 2 adds to the case
Build the documented habit now; extend it as obligations change.
For accountants providing designated services, AML/CTF obligations from 1 July 2026 add another reason to define verification triggers, escalation and retention. Vericode supports a documented instruction-verification step; it does not replace customer due diligence or guarantee compliance.
Read the AUSTRAC Tranche 2 explainerCurrent guidance and threat evidence
Tax practices are trusted, and impersonated.
TPB(GS) 42/2022
The Tax Practitioners Board guidance sheet sets out proof-of-identity requirements, client verification and record-keeping expectations.
Read sourceTPB client verification process
The TPB’s process guidance explains when and how registered tax practitioners should verify clients.
Read source275-firm impersonation check
Accountants Daily reports that most firms in a checked sample of 275 could be impersonated by email.
Read sourceATO and myGov impersonation
Scamwatch warns about impersonation scams trading on the authority and urgency of ATO and myGov communications.
Read sourceVerify, then act
Protect your firm, and model the control for business clients.
Start with refund changes and sensitive disclosures. The same verify-then-pay discipline can become practical advice for clients facing supplier and invoice impersonation.
How firms check callers today
Six common checks, and where each one stops.
None of these proves who is on the phone by itself, Vericode included. Know where each one stops and write down what you did. Passing several checks still doesn't establish identity or make a request safe.
For tax and BAS work, the TPB requires proof of identity checks before serving new clients, and on an ongoing basis for existing clients as appropriate. Its requirements are the same remotely as face to face. TPB: FAQs on proof of identity for client verification
Hang up and call back on a number you already hold
Useful for: Several of the sources below recommend finding the number independently and making the call yourself. You pick the number, so a spoofed caller ID or a number in a suspicious email doesn't come into it.
Where it stops: ACMA warns the number on an incoming call may not be the caller's real number, so a matching caller ID proves little. A call-back also relies on the number on file still being the client's.
Security questions
Useful for: Lets staff compare answers with what's on file. Correct answers don't establish identity.
Where it stops: Knowing facts about a client isn't the same as being the client, and many details can be found online. In the separate context of system authentication under the Essential Eight, ASD doesn't recognise security questions as a valid memorised secret.
Recognising the voice
Useful for: Lets staff compare the voice with earlier conversations.
Where it stops: Scamwatch says scammers can use a few seconds of a voice recording to create AI clones. A familiar voice alone doesn't establish identity.
Confirming by email
Useful for: Leaves a written trail of what was asked and when.
Where it stops: Mailboxes get compromised, so a reply from the client's address doesn't show who wrote it. The TPB says its proof of identity requirements are the same remotely as face to face.
SMS code read-back (what Vericode does)
Useful for: Checks whether the caller can read back a code sent to the mobile number already on file, and records the result against the staff member who ran it.
Where it stops: This does not verify identity. ACMA warns that once a criminal has your number, they can receive SMS verification codes. A client can also be talked into reading a code out.
Video call
Useful for: Gives you a face to compare, and room for follow-up questions.
Where it stops: Scamwatch warns scammers use AI to fake audio and video. A video call alone doesn't show that identity requirements have been met.
Sources checked 26 October 2026. Public guidance is cited for context only, and the citations don't imply endorsement of Vericode. Using Vericode doesn't, by itself, satisfy AML/CTF, VOI, TPB or other regulatory obligations.
Works alongside your practice software
Using Xero Practice Manager, FYI Docs or MYOB?
Vericode doesn't plug into Xero Practice Manager, FYI Docs or MYOB, and it doesn't need to. Sidekick runs in Chrome or Edge. When a client's record is open in a browser tab, select the mobile number you already hold, right-click and send the code. Nothing is written back to your practice software.
Sidekick needs the number on a web page, so it won't appear inside desktop-only apps. Not sure how your setup will go? Try it during the free trial with a real client record, or email [email protected].
Guides for accounting practices
- Checking callers who need a different approach
- ATO Verify Call: who verifies the client calling your firm?
- When a client asks to change their bank or refund details
- Your accounting firm can be impersonated by email
- Tax-time vishing: ATO, myGov and the 'client' who calls
- TPB says verify your client. Tranche 2 says keep verifying
- When there's no Australian mobile on file