Sales and deposits
Check a buyer, seller or authorised contact against the number on file before accepting changed deposit, disbursement or settlement instructions.
Real estate & property management
Deposit day is the wrong time to trust an email alone.
Criminals mimic agency emails and calls when buyers are expecting urgent instructions. Check the caller behind a payment change, across sales, property management and rentals.
One brand, several attack surfaces
Protect more than the sale.
An agency’s trusted name can be abused to redirect a purchase deposit, issue a fake bond request or persuade a property manager to change an owner’s account. A consistent verification trigger helps staff step outside the compromised channel.
Property management
Check owners before changing disbursement accounts, approving urgent payments or discussing a tenancy and its financial details.
Rentals and bonds
Give staff a separate caller check when a supposed landlord, tenant or agency contact requests bond or rent payment changes.
Fits around agency systems
Verify from the details already on screen.
Highlight a phone number in any browser-based agency platform, portal or email client. Right-click to send a one-time SMS code; the person reads it back on the call.
The browser extension is CRM-agnostic. It adds a separate check without claiming a direct integration or asking the agency to replace its property system.
Use the known record
Send the code to contact details already held on the file, not the new number supplied in the instruction being verified.
Beyond the portal
Secure the phone call, not just the platform.
Securexchange and PEXA Key protect details inside their platforms. Vericode complements that protection by checking the caller or correspondent when an instruction arrives outside the portal: by phone, ordinary email or another browser workflow. No partnership or endorsement is implied.
Audit trail
Each authorised-contact check creates a timestamped, hash-chained record: requester, masked target, method and outcome. Compliance-authorised users can export it as PDF or CSV.
Recognisable sender
SMS travels through Australian SMS provider MobileMessage using the ACMA-registered sender ID VERICODE.
Residency, with one exception
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States.
Industry guidance
The risk is recognised across property transactions.
ACSC property BEC alert
The ACSC warns that criminals compromise property transaction emails and substitute payment instructions.
Read sourceAgency impersonation scams
Smart Property Investment reports a surge in scams where criminals mimic real estate agency emails.
Read sourceREIQ cyber-crime guidance
REIQ’s public guidance describes cyber-crime risks for agencies and the need for practical safeguards.
Read sourceAUSTRAC real estate fact sheet
AUSTRAC’s Tranche 2 fact sheet sets out AML/CTF obligations applying to relevant real estate services from 1 July 2026.
Read sourceBefore money or information moves
Make verification part of every high-risk agency workflow.
Define the triggers for sales, trust money, owner disbursements, rentals and bonds, then give staff a clear escalation path when a check does not succeed.
How firms check callers today
Six common checks, and where each one stops.
None of these proves who is on the phone by itself, Vericode included. Know where each one stops and write down what you did. Passing several checks still doesn't establish identity or make a request safe.
The REIQ notes real estate businesses are a lucrative target because they facilitate high-value transactions. REIQ: Submission on the Cyber Secure Queensland Strategic Plan (2023)
Hang up and call back on a number you already hold
Useful for: Several of the sources below recommend finding the number independently and making the call yourself. You pick the number, so a spoofed caller ID or a number in a suspicious email doesn't come into it.
Where it stops: ACMA warns the number on an incoming call may not be the caller's real number, so a matching caller ID proves little. A call-back also relies on the number on file still being the client's.
Security questions
Useful for: Lets staff compare answers with what's on file. Correct answers don't establish identity.
Where it stops: Knowing facts about a client isn't the same as being the client, and many details can be found online. In the separate context of system authentication under the Essential Eight, ASD doesn't recognise security questions as a valid memorised secret.
Recognising the voice
Useful for: Lets staff compare the voice with earlier conversations.
Where it stops: Scamwatch says scammers can use a few seconds of a voice recording to create AI clones. A familiar voice alone doesn't establish identity.
Confirming by email
Useful for: Leaves a written trail of what was asked and when.
Where it stops: Mailboxes get compromised, so a reply from the client's address doesn't show who wrote it. LPLC says firms should never solely rely on bank account details sent by email.
SMS code read-back (what Vericode does)
Useful for: Checks whether the caller can read back a code sent to the mobile number already on file, and records the result against the staff member who ran it.
Where it stops: This does not verify identity. ACMA warns that once a criminal has your number, they can receive SMS verification codes. A client can also be talked into reading a code out.
Video call
Useful for: Gives you a face to compare, and room for follow-up questions.
Where it stops: Scamwatch warns scammers use AI to fake audio and video. A video call alone doesn't show that identity requirements have been met.
Sources checked 26 October 2026. Public guidance is cited for context only, and the citations don't imply endorsement of Vericode. Using Vericode doesn't, by itself, satisfy AML/CTF, VOI, TPB or other regulatory obligations.
Works alongside your practice software
Using PropertyMe, PropertyTree or Reapit?
Vericode doesn't plug into PropertyMe, PropertyTree or Reapit, and it doesn't need to. Sidekick runs in Chrome or Edge. When a client's record is open in a browser tab, select the mobile number you already hold, right-click and send the code. Nothing is written back to your practice software.
Sidekick needs the number on a web page, so it won't appear inside desktop-only apps. Not sure how your setup will go? Try it during the free trial with a real client record, or email [email protected].