Financial adviser guide · Procedure and evidence

When the “client” on the phone isn't your client

Scam complaints turn a fast instruction into a slow reconstruction: what did the firm check, what did it record, and what else does the evidence show?

Scam complaints test the instruction and the evidence

A firm may receive an instruction through the client's genuine mailbox, on a familiar thread and with a signed form. A genuine email account, familiar thread or signed form may be relevant evidence, but may not resolve whether the client authorised the particular instruction.

AFCA decides what is fair in all the circumstances. It considers the applicable legal principles, codes or guidance, good industry practice and relevant determinations, together with the facts and evidence of each complaint. From 12 March 2026, AFCA expanded its jurisdiction over eligible scam complaints involving receiving banks and accounts or credit facilities opened in the complainant's name without consent or authority, including complaints by non-customers. The change expands access to AFCA for these complaints; liability still depends on the applicable obligations and circumstances, and it does not determine or discharge an advice firm's separate obligations.

Bank scam determinations illustrate the importance of context and evidence. They do not establish that a particular adviser workflow or SMS check satisfies a legal duty.

What to keep

Record the instruction, the checks performed, their results, approvals and exceptions, so the firm can explain its actions if a dispute arises.

How a disputed instruction can unfold

An illustrative scenario, not a summary of a particular AFCA determination.

  1. 01

    The instruction looks ordinary

    A withdrawal, rollover or changed-account request arrives from the client's real email address or is supported by a caller who knows the portfolio and recent conversations.

  2. 02

    The firm follows the channel

    Staff test the document, signature or email for surface consistency, but do not check the instruction through a contact route established independently of it.

  3. 03

    Money moves

    The destination belongs to the scam. The genuine client later disputes authority, and the firm's procedure, warnings, records and response become part of the evidence.

  4. 04

    The dispute reconstructs conduct

    Contemporaneous records help reconstruct what happened, alongside the parties' recollections and other relevant circumstances.

Suggested controls for a licensee to assess

An AFS licensee can assess these suggested controls against its services, risks, legal obligations and approved procedures. No cited AFCA determination or ASIC guidance prescribes this workflow or treats an SMS check as sufficient.

  1. 01

    Define triggers

    Define when your approved procedure requires additional checks, including for withdrawals, rollovers, changed payment details, unusual disclosure requests and other identified risks.

  2. 02

    Use a trusted record

    Use independently established contact details from a trusted record, and investigate recent or suspicious changes before relying on them. Never use contact details supplied in the message being checked.

  3. 03

    Separate the checks

    Treat the contact-check result separately from any required identity, authority, account-ownership, document and approval checks.

  4. 04

    Pause on failure

    If a check fails, pause the instruction, preserve relevant records and follow the approved investigation and escalation process, using independently established contact details. A failure can have an innocent explanation.

  5. 05

    Retain the records

    Retain relevant records under the firm's record-keeping and privacy requirements, including the instruction, checks, approvals and exceptions.

  6. 06

    Review exceptions

    Review exceptions and bypasses, and require documented reasons, appropriate approval and any additional controls.

A record of the contact check

Turn “we called the client” into a record of the check.

A number you already hold

Send the one-time SMS code only to a number independently established under the firm's procedure. A successful result does not establish identity or transaction authority.

Timestamped result

The check is logged with its time, method and outcome. Review the available record and export fields before building them into your procedure.

Exportable record

Users with the required permissions can export available audit records as PDF or CSV for retention alongside the firm's other records. The result is one part of the evidence of the firm's process; its significance depends on the circumstances and other evidence.

Vericode records a contact-check result. It does not verify identity or transaction authority, shift liability, determine compliance, or satisfy AFSL, AFCA, SPF, AML/CTF or other regulatory obligations. It does not guarantee any fraud, insurance or dispute outcome.

What a check record containsRecords retentionIncident register

The Scams Prevention Framework

As at 27 October 2026, the SPF has a staged implementation. Covered banks, telcos and digital platforms were required to join AFCA from 1 September 2026. Most obligations apply from 31 March 2027, and AFCA's SPF complaint jurisdiction covers relevant matters occurring on or after that date. Existing AFCA financial-services jurisdiction continues separately. Holding an AFSL does not, by itself, make an advice firm subject to SPF obligations.

Scams Prevention Framework explainer

Sources

AFCA Annual Review 2024-25

AFCA reports scam-complaint trends, including 5,977 scam complaints. It does not prescribe this procedure or assess Vericode.

Read source

AFCA: receiving banks and unauthorised account opening

AFCA's guidance on its jurisdiction over receiving banks and accounts opened without consent, effective 12 March 2026.

Read source

AFCA Rules and Guidelines

The current AFCA Rules, including Rule A.14 on how AFCA decides what is fair in all the circumstances.

Read source

ASIC RG 104: AFS licensing, meeting the general obligations

ASIC's guidance that compliance measures depend on the nature, scale and complexity of the licensee's business.

Read source

Scam lessons from AFCA (HN Law)

Law-firm commentary on AFCA scam determinations, including an HSBC unauthorised-transaction determination under the ePayments Code. Commentary, not AFCA or ASIC guidance.

Read source

AFCA rules and the Scams Prevention Framework (HWL Ebsworth)

Law-firm commentary written before the SPF instruments were made, so some of its dates are out of date. Use the legislation and AFCA's publications for current dates.

Read source

Sources checked 27 October 2026. References to AFCA, ASIC and AUSTRAC explain the regulatory context. They do not indicate endorsement, approval or certification of Vericode.

Not legal or financial advice. This general information does not determine an AFS licensee's obligations or guarantee an AFCA, insurance or compliance outcome. Obtain advice on your circumstances and approved procedures.
Make conduct reconstructable

Define the check, train it and retain its outcome.

Caller checks for financial advisers Build an escalation path AUSTRAC explainer
Related guides