Withdrawal and rollover forms
A signed form sent from the client’s real, compromised mailbox can still carry the attacker’s instruction.
Financial advisers & planners
The email is real. The withdrawal instruction may not be.
An attacker inside a client’s mailbox can send the signed form, answer the familiar thread and call to change bank details. Add an independent verification step, and retain evidence that it happened.
Where the procedure earns its keep
Verify before acting, or before revealing the next useful detail.
A verification procedure is not only a last barrier to a fraudulent transfer. Used earlier, it can prevent information leakage during a convincing pretext call. Focus it on moments where identity, authority and destination account all matter.
Changed bank details
A familiar voice, personal facts or urgency should not replace a separate check against a known contact channel.
Sensitive conversations
Verification can stop a pretext before an adviser discloses balances, holdings or process details that enable the next stage.
Inside the existing workflow
A deliberate pause at the point of risk.
Highlight the client’s phone number wherever it appears in a browser-based CRM, platform or email client. Right-click to send a one-time SMS code; the client reads it back on the call.
Vericode is CRM-agnostic: it works with contact details visible on screen. It does not claim a direct integration with an advice platform.
Turn policy into a repeatable action
Define triggers such as withdrawals, rollovers, changed bank details and unusual information requests. If verification fails, stop and follow the firm’s escalation procedure.
Reasonable steps need evidence
A record an AFSL can put in front of AFCA or its insurer.
Every authorised-contact check creates a timestamped, hash-chained record of who requested it, the masked target, method and outcome. Compliance-authorised users can export the audit as PDF or CSV.
Document the step
Support the firm’s case that a defined verification step was followed at the relevant time.
Trusted delivery context
Verification messages pass through Australian SMS provider MobileMessage, using the ACMA-registered sender ID VERICODE.
Transparent residency
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States.
Vericode supports a firm’s own controls and evidence. It does not guarantee a compliance, AFCA, insurance or fraud outcome, does not satisfy an AFSL condition by itself, and this page is not financial or legal advice.
Current guidance
Scam disputes turn on conduct and evidence.
AFCA scam complaints
AFCA’s annual review of scam complaints shows how evidence and a firm’s response are scrutinised when losses are disputed.
Read sourceAFCA receiving-bank rules
AFCA published updated rules for receiving banks and unauthorised account opening, effective 12 March 2026.
Read sourceReducing licensee liability
Hamilton Locke’s post-AFCA advisory focuses on practical steps licensees can take to reduce scam liability.
Read sourceASIC SMSF rollover alert
ASIC warns consumers about scams involving self-managed super fund rollovers and unexpected contact.
Read sourceMake the next instruction defensible
Give advisers a fast check and compliance a durable record.
Start with a narrow set of high-risk triggers, train the escalation path and review the resulting evidence with your licensee.
How firms check callers today
Six common checks, and where each one stops.
None of these proves who is on the phone by itself, Vericode included. Know where each one stops and write down what you did. Passing several checks still doesn't establish identity or make a request safe.
ASIC's letter to super trustees describes members being manipulated into handing over one-time passwords. A check passing doesn't mean the request is safe or informed. ASIC: Letter to superannuation trustees on scams (January 2025)
Hang up and call back on a number you already hold
Useful for: Several of the sources below recommend finding the number independently and making the call yourself. You pick the number, so a spoofed caller ID or a number in a suspicious email doesn't come into it.
Where it stops: ACMA warns the number on an incoming call may not be the caller's real number, so a matching caller ID proves little. A call-back also relies on the number on file still being the client's.
Security questions
Useful for: Lets staff compare answers with what's on file. Correct answers don't establish identity.
Where it stops: Knowing facts about a client isn't the same as being the client, and many details can be found online. In the separate context of system authentication under the Essential Eight, ASD doesn't recognise security questions as a valid memorised secret.
Recognising the voice
Useful for: Lets staff compare the voice with earlier conversations.
Where it stops: Scamwatch says scammers can use a few seconds of a voice recording to create AI clones. A familiar voice alone doesn't establish identity.
Confirming by email
Useful for: Leaves a written trail of what was asked and when.
Where it stops: Mailboxes get compromised, so a reply from the client's address doesn't show who wrote it. LPLC says firms should never solely rely on bank account details sent by email.
SMS code read-back (what Vericode does)
Useful for: Checks whether the caller can read back a code sent to the mobile number already on file, and records the result against the staff member who ran it.
Where it stops: This does not verify identity. ASIC describes people being talked into giving a scammer a one-time password, and after an unauthorised port or SIM swap a criminal can receive SMS codes.
Video call
Useful for: Gives you a face to compare, and room for follow-up questions.
Where it stops: Scamwatch warns scammers use AI to fake audio and video. A video call alone doesn't show that identity requirements have been met.
Sources checked 26 October 2026. Public guidance is cited for context only, and the citations don't imply endorsement of Vericode. Using Vericode doesn't, by itself, satisfy AML/CTF, VOI, TPB or other regulatory obligations.
Works alongside your practice software
Using Xplan or AdviserLogic?
Vericode doesn't plug into Xplan or AdviserLogic, and it doesn't need to. Sidekick runs in Chrome or Edge. When a client's record is open in a browser tab, select the mobile number you already hold, right-click and send the code. Nothing is written back to your practice software.
Sidekick needs the number on a web page, so it won't appear inside desktop-only apps. Not sure how your setup will go? Try it during the free trial with a real client record, or email [email protected].