Vericode helps professional firms add a practical verification step to phone disclosures and high-risk instructions, with an audit record that supports evidence of reasonable steps under the Australian Privacy Principles.
Professional firms hold the details a scammer needs to sound credible: names, advisers, recent transactions, property matters, account context and contact information. Once exposed, those facts can be reused in vishing. Familiarity is not proof that the caller is the real client.
The OAIC reported a record 1,205 data-breach notifications for the 2025 calendar year. The lesson for a firm is operational: assume an attacker may already know true information and verify through a channel the firm trusts before disclosing more or acting.
Read the OAIC's 2025 NDB statisticsPrivacy Act penalties operate through a tiered civil-penalty regime. The exposure is broader than a fine: an incident can produce investigation, remediation, notification, insurer scrutiny and lasting client distrust. This page therefore focuses on the control a team can use at the moment of risk.
Vericode does not satisfy an APP by itself. It helps a firm implement and evidence a narrow control within the firm's wider privacy program.
What the APP asks
Take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure.
How Vericode helps
Put a possession check between a caller and a disclosure or high-risk instruction. The resulting record supports evidence that the firm took a deliberate security step.
What the APP asks
Use or disclose personal information for the purpose for which it was collected, unless an exception applies.
How Vericode helps
Check the caller at the trusted number already held by the firm before discussing a file or acting on changed contact or payment instructions.
What the APP asks
Give people access to personal information about them and correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
How Vericode helps
Vericode explains rights against the information it holds and gives individuals a direct privacy request channel.
Access and correction rightsVericode uses possession-based verification. A code goes to the verified phone number held for the real person, not to the contact details supplied in the suspicious request.
Each authorised-contact check creates a timestamped, hash-chained record: who requested it, the masked target, method and outcome. That evidence can support a firm's account of the reasonable steps it took; it does not guarantee compliance or prove identity for every purpose.
Verification evidence, not client files. Vericode stores verification metadata, not a document repository, and does not require the firm to upload matter files.
Explore the threat patterns and sector workflows around caller verification, then review Vericode's security and data-residency posture.