Before settlement funds move
Verify changed destination accounts and urgent payment instructions against a known contact record before authorising disbursement.
Conveyancers & property lawyers
Call before you pay. Prove that you did.
One compromised mailbox and one “updated bank details” message can redirect an entire settlement. Check the caller behind the instruction, then keep a record built for the file.
The payment instruction is the risk event
Day-one identity does not authenticate a day-41 bank change.
Verification of identity establishes a person at the start of a matter. It does not prove that a later email, call or account change came from that person. LPLC’s “call first” guidance addresses this gap; a consistent procedure makes the call easier to perform and defend.
Before trust money moves
Apply the same independent check to deposits, refunds, controlled money and instructions affecting the firm’s trust account.
When the channel looks genuine
A real mailbox can be compromised. Step outside the email thread and record the check rather than relying on familiar wording.
Operationalise “call first”
A known number, a one-time code, a recorded outcome.
Highlight the client’s phone number in the browser-based practice system, workspace or email client already on screen. Right-click to send a one-time SMS code; the client reads it back on the call.
The extension is system-agnostic and does not claim a direct practice-management or PEXA integration. Use contact details already held on file, not the new number supplied in the instruction.
If the check fails, stop the payment
Escalate through a second known channel, record suspicious activity and require fresh authority before releasing settlement or trust funds.
Evidence for the matter and the firm
A callback becomes a control when it is consistent and reviewable.
Hash-chained record
Each authorised-contact check records requester, masked target, method, timestamps and outcome. Compliance-authorised users can export the audit as PDF or CSV for file review, insurers and auditors.
Recognisable sender
SMS is delivered through Australian SMS provider MobileMessage using the ACMA-registered sender ID VERICODE.
Transparent residency
Customer and verification data—recipient details, messages and verification records—is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States.
AUSTRAC Tranche 2
From 1 July 2026, documented verification is an operating discipline, not a future talking point.
Tranche 2 brings relevant designated legal services into the AML/CTF regime. Vericode does not replace customer due diligence or guarantee compliance; it gives the firm a documented step, inside the broader program, for checking that a caller can receive a code at the number already on file before acting on a high-risk instruction.
Legal-sector guidance
The doctrine is established. The missing piece is proof.
LPLC: Call first
LPLC tells practices to call a known number before paying and to make a file note. Vericode operationalises that doctrine with a structured record.
Read sourceLPLC Cyber Guide
LPLC’s practice-risk guide gives firms a broader framework for preventing and responding to cyber fraud.
Read sourceLaw Society of NSW scam alerts
The Law Society publishes current trust-money and fidelity-fund scam warnings for legal practices.
Read sourceVLSB+C red flags
Victorian guidance sets out cyber-security red flags and good practices for lawyers handling client matters.
Read sourceBefore the next settlement
Turn “call before you pay” into a procedure the file can show.
Start with changed bank details, settlement disbursements and trust-account instructions. Define who can authorise release after a failed check and what evidence must be retained.
How firms check callers today
Six common checks, and where each one stops.
None of these proves who is on the phone by itself, Vericode included. Know where each one stops and write down what you did. Passing several checks still doesn't establish identity or make a request safe.
Lawcover describes property sale proceeds, and LPLC describes estate funds, sent to fraudsters' bank accounts. In Lawcover's example, the fraudster called the practice to confirm the details. Checking a payment instruction, checking who is calling and formal VOI are three different questions. LPLC: Call first to avoid cyber fraud (2023)
Hang up and call back on a number you already hold
Useful for: Several of the sources below recommend finding the number independently and making the call yourself. You pick the number, so a spoofed caller ID or a number in a suspicious email doesn't come into it.
Where it stops: Lawcover stresses the practice initiating the call. It still relies on the number on file being the client's. After an unauthorised port or SIM swap, calls to that number can reach a criminal.
Security questions
Useful for: Lets staff compare answers with what's on file. Correct answers don't establish identity.
Where it stops: Knowing facts about a client isn't the same as being the client, and many details can be found online. In the separate context of system authentication under the Essential Eight, ASD doesn't recognise security questions as a valid memorised secret.
Recognising the voice
Useful for: Lets staff compare the voice with earlier conversations.
Where it stops: Scamwatch says scammers can use a few seconds of a voice recording to create AI clones. A familiar voice alone doesn't establish identity.
Confirming by email
Useful for: Leaves a written trail of what was asked and when.
Where it stops: Mailboxes get compromised, so a reply from the client's address doesn't show who wrote it. LPLC says firms should never solely rely on bank account details sent by email.
SMS code read-back (what Vericode does)
Useful for: Checks whether the caller can read back a code sent to the mobile number already on file, and records the result against the staff member who ran it.
Where it stops: This does not verify identity. ACMA warns that once a criminal has your number, they can receive SMS verification codes. A client can also be talked into reading a code out.
Video call
Useful for: Gives you a face to compare, and room for follow-up questions.
Where it stops: QLS considers that a video meeting does not create a Safe Harbour, while noting there's no definitive authority on the point. Whether it amounts to reasonable steps depends on the circumstances.
Sources checked 26 October 2026. Public guidance is cited for context only, and the citations don't imply endorsement of Vericode. Using Vericode doesn't, by itself, satisfy AML/CTF, VOI, TPB or other regulatory obligations.
Works alongside your practice software
Using LEAP or Smokeball?
Vericode doesn't plug into LEAP or Smokeball, and it doesn't need to. Sidekick runs in Chrome or Edge. When a client's record is open in a browser tab, select the mobile number you already hold, right-click and send the code. Nothing is written back to your practice software.
Sidekick needs the number on a web page, so it won't appear inside desktop-only apps. Not sure how your setup will go? Try it during the free trial with a real client record, or email [email protected].
Guides for law and conveyancing firms
- Checking callers who need a different approach
- Anatomy of a settlement redirection
- Call before you pay: policy with proof
- Company director phone instructions in conveyancing
- Phone instructions from one of two joint clients
- When there's no Australian mobile on file
- VOI day 1, caller verification day 41