LPLC: Call first to avoid cyber fraud
LPLC tells firms to call a known number, verify instructions and make a file note of the conversation.
Official sourceProof of verification
A verification should leave evidence.
Vericode's authorised-contact register records who requested a check, the masked target, what happened and when. Ordered, hash-linked events help show whether that history remains intact.
What the schema records
The fields behind the evidence
The current authorised-contact schema is mobile-number based. It does not describe an email target, so this page does not claim one.
- Contact
- Full name and optional external reference
- Target
- Masked mobile number and last four digits
- Request
- Who requested it and when
- Verification
- Method, linked verification ID and relevant timestamps
- Outcome
- Pending, authorised or other recorded event state
- Integrity
- Sequence, previous hash, event hash and chain-valid result
Illustrative field map
What an audit record contains
An example built from the fields the API returns. It is not a screenshot of customer data.
Example record Chain valid
mobile_masked- •••• ••• 4821
requested_by- workspace actor
requested_at- UTC timestamp
verification_method- recorded method
event_type- authorisation outcome
verification_id- linked identifier
previous_hash- prior event digest
event_hash- current event digest
Outcomes
What each recorded result means
Every check ends in one of these states, and the state is kept with the record. A failed, expired or locked check is recorded just like a verified one.
- Pending
- The code has been sent and the caller hasn't entered it yet.
- Verified
- The caller read back the right code within the time limit. This shows access to the code sent to that number. It doesn't prove identity or authority.
- Expired
- Nobody entered the code within the time limit, five minutes by default.
- Locked
- Too many wrong codes were entered, five by default. Staff move to the firm's escalation step.
- Cancelled
- A staff member cancelled the check before it finished.
- Not delivered
- The SMS provider reported that the message couldn't be delivered to that number.
Why the record matters
Reasonable steps are easier to defend when they are documented.
A manual callback may be sensible but still leave the firm reconstructing evidence later. A contemporaneous record gives compliance teams, insurers and dispute reviewers a concrete artefact to examine. The source guidance below defines the obligation; Vericode does not claim that a record alone guarantees compliance.
AFCA: Published decisions
AFCA's published-decision search lets firms review how evidence and reasonable verification steps are assessed in actual disputes.
Official sourceTPB(GS) 42/2022: Proof of identity
The Tax Practitioners Board guidance sheet addresses proof-of-identity requirements and keeping evidence of checks.
Official sourceAUSTRAC: Customer identification and verification
AUSTRAC guidance explains customer due diligence, identification, verification and the associated record-keeping obligation.
Official sourceExport
Compliance-authorised users can export an authorised contact's audit in PDF or CSV. The CSV includes sequence, UTC event time, event type, actor, verification ID, hashes and details.
Visibility
Reads are scoped to the current workspace. The export endpoint checks for a compliance-level permission before returning a file.
Retention and residency
Authorised-contact audit events carry a seven-year retain-until value. Customer and verification data is hosted in Australia; staff sign-in is handled by WorkOS in the United States.
See the verification flow
Understand how a request moves from selected number to recorded outcome, or review the controls around the service.