A convincing pretext
A breached aggregator or client mailbox can expose lender, property and settlement details that make an impersonator sound legitimate.
Mortgage & finance brokers
The caller knows the loan details. That does not make them the client.
After a data breach, a scammer can call mid-settlement with the property, lender and payout details already in hand. Check the caller behind a high-risk instruction before money or information moves.
Why broking is exposed
A genuine detail can carry a fraudulent instruction.
Brokers sit at the junction of identity documents, credit data, property transactions and urgent payment decisions. Public warnings from the MFAA, ASIC and the ACSC show that the threat is recognised across the sector. Those sources do not endorse or have any affiliation with Vericode.
Two directions of fraud
A criminal can pose as the broker to redirect a client deposit, or pose as the client to change payout or bank details.
Evidence after the call
A file note says what someone remembers. A timestamped verification record shows who initiated the check, the masked target and the outcome.
Fits the workflow
Add a check without replacing the CRM.
Highlight a phone number or email visible in your browser-based CRM, lender portal or email client. Right-click to send a one-time verification code by SMS or email; the client reads the code back on the call.
That generic browser-extension mechanic works with whatever is already on screen: Salestrekker, BrokerEngine or another browser-based system. It is not a claimed direct integration with those products.
A practical trigger
Require verification before accepting changed payout details, disclosing loan information, resending documents or acting on a time-critical deposit instruction.
Evidence, not just a good intention
Make the callback procedure provable.
Audit trail
Each verification creates a timestamped, hash-chained record, exportable in PDF or CSV for compliance officers, insurers and auditors.
Recognisable message
SMS is sent through Australian SMS provider MobileMessage using Vericode's ACMA-registered sender ID, VERICODE.
Residency disclosed
Customer and verification data—recipient details, messages and verification records—is hosted in Google Cloud Sydney (Australia). Staff sign-in is handled by our identity provider, WorkOS, in the United States.
Industry reading
The warning signs are already public.
MFAA practical scam resource
The MFAA launched a member scam resource in August 2025, reflecting an industry-wide need for practical controls.
Read sourceGuidance after the youX breach
Broker Daily reported MFAA guidance following the youX data breach and the risks exposed for brokers and their customers.
Read sourceFraud risk across broking
Broker Daily reported that 15% of Australians had been hit by fraud as broking-sector risks continued to rise.
Read sourceSettlement-week BEC warning
The ACSC warns that property transactions are targeted through compromised email accounts and changed payment instructions.
Read sourceSet the rule before settlement day
Give every broker a record of the check when someone asks how they knew
Start with high-risk changes, document the trigger in your procedure, and retain the verification result beside the client file.
How firms check callers today
Six common checks, and where each one stops.
None of these proves who is on the phone by itself, Vericode included. Know where each one stops and write down what you did. Passing several checks still doesn't establish identity or make a request safe.
The MFAA tells borrowers to confirm unexpected requests with their broker or lender using contact details they already have. For a caller claiming to be your client, calling back on details you established independently is the same idea, though on its own it doesn't establish identity. MFAA: Cybersecurity and scams
Hang up and call back on a number you already hold
Useful for: Several of the sources below recommend finding the number independently and making the call yourself. You pick the number, so a spoofed caller ID or a number in a suspicious email doesn't come into it.
Where it stops: ACMA warns the number on an incoming call may not be the caller's real number, so a matching caller ID proves little. A call-back also relies on the number on file still being the client's.
Security questions
Useful for: Lets staff compare answers with what's on file. Correct answers don't establish identity.
Where it stops: Knowing facts about a client isn't the same as being the client, and many details can be found online. In the separate context of system authentication under the Essential Eight, ASD doesn't recognise security questions as a valid memorised secret.
Recognising the voice
Useful for: Lets staff compare the voice with earlier conversations.
Where it stops: Scamwatch says scammers can use a few seconds of a voice recording to create AI clones. A familiar voice alone doesn't establish identity.
Confirming by email
Useful for: Leaves a written trail of what was asked and when.
Where it stops: Mailboxes get compromised, so a reply from the client's address doesn't show who wrote it. LPLC says firms should never solely rely on bank account details sent by email.
SMS code read-back (what Vericode does)
Useful for: Checks whether the caller can read back a code sent to the mobile number already on file, and records the result against the staff member who ran it.
Where it stops: This does not verify identity. ACMA warns that once a criminal has your number, they can receive SMS verification codes. A client can also be talked into reading a code out.
Video call
Useful for: Gives you a face to compare, and room for follow-up questions.
Where it stops: Scamwatch warns scammers use AI to fake audio and video. A video call alone doesn't show that identity requirements have been met.
Sources checked 26 October 2026. Public guidance is cited for context only, and the citations don't imply endorsement of Vericode. Using Vericode doesn't, by itself, satisfy AML/CTF, VOI, TPB or other regulatory obligations.
Works alongside your practice software
Using ApplyOnline, Salestrekker or Mercury Nexus?
Vericode doesn't plug into ApplyOnline, Salestrekker or Mercury Nexus, and it doesn't need to. Sidekick runs in Chrome or Edge. When a client's record is open in a browser tab, select the mobile number you already hold, right-click and send the code. Nothing is written back to your practice software.
Sidekick needs the number on a web page, so it won't appear inside desktop-only apps. Not sure how your setup will go? Try it during the free trial with a real client record, or email [email protected].