Documents and databases establish identity. A code sent to the number on file gives one recorded signal about a later interaction, without establishing identity or authority. Firms need both controls in their proper place.
CDD and KYC tools answer foundational questions. They gather evidence about a person or entity, establish ownership and authority, support screening and help the firm assess customer risk. Under an AML/CTF program, ongoing CDD keeps that assessment current as the relationship changes.
A later call or email creates a different problem. The real customer may exist and have passed every onboarding check while a criminal controls their mailbox, knows the matter and presents a fraudulent instruction. Re-running a document check can confirm the real customer exists without identifying who controls today's interaction.
| Question | CDD / KYC | Caller verification |
|---|---|---|
| When it happens | Before a designated service begins in most cases, then throughout the relationship as risk and information change. | At a consequential interaction: a changed payment destination, sensitive request, new representative or other high-risk trigger. |
| What it asks | Who is the customer, beneficial owner or representative, and what risk does the relationship create? | Does the person in this call or email interaction control the trusted contact point already held for the authorised person? |
| Typical methods | Identity documents, biometrics, reliable databases, ownership information, screening and risk assessment, depending on the program and provider. | A possession challenge sent independently to a phone number on file that predates the instruction under review. |
| Evidence produced | Customer identification and verification material, risk profile, ownership and authority records, monitoring decisions and review history. | A timestamped record of the requester, masked trusted target, method and outcome for the authorised-contact check. |
| What it does not prove | A correct onboarding result does not prove every future caller, mailbox or payment instruction is genuine. | Possession of a known phone does not verify an identity document, screen sanctions, establish source of funds or prove payment details are correct. |
Day 1
The firm performs the CDD, KYC or professional identity process appropriate to the engagement, confirms authority and records trusted contact details from an independent source.
Days 2–40
Work proceeds. Ongoing CDD responds to changes in ownership, purpose, behaviour and risk. A mailbox or account can still be compromised after a valid onboarding check.
Day 41
A caller, email or message changes a bank account, requests a release, seeks confidential information or introduces an unexpected representative. Familiar matter details make it sound credible.
Before action
Return to the trusted contact point established earlier, challenge possession, compare the complete instruction, apply approvals and document the outcome before acting.
“Day 41” is a memorable risk frame, not a claim about average matter length. The second check belongs at any later moment when the channel, authority or instruction carries enough consequence to justify independent verification.
VOI and CDD can correctly establish a client at engagement. Weeks later, a compromised mailbox requests that settlement proceeds go to a new account. The live control returns to the trusted client number, verifies possession and reads the full instruction out and back before funds move.
Explore the workflowThe practice knows the director and has completed its onboarding controls. An urgent caller then asks staff to release a tax refund, payroll file or portal credential. Caller verification tests the current interaction; it does not replace the practice’s authority, privacy or payment-approval checks.
Explore the workflowAn agency has identified the vendor and assessed customer risk. Near settlement, an email supplies a replacement account for sale proceeds. The agency uses the vendor number already in its records, records a caller check and confirms the complete account details through the approved workflow.
Explore the workflowA broker collected identity evidence for the application, but a later caller seeks the client file or asks to redirect correspondence. The check records whether the caller returned the code sent to the mobile number on file, before staff complete their other checks.
Explore the workflowAn adviser has an established client profile and investment authority. A polished call requests a withdrawal to an unfamiliar account. The firm pauses, records a caller check on a pre-existing number and applies its withdrawal, escalation and record-keeping controls.
Explore the workflowVericode uses possession-based verification. A code goes to the mobile number already on file, not to the contact details supplied in the suspicious request. Codes are sent through Australian SMS provider MobileMessage using the ACMA-registered sender ID VERICODE.
Each check is logged with who requested it, the masked target number, its time, method and outcome. Authorised-contact register events also form a per-contact hash chain. Compliance-authorised users can export the record as PDF or CSV. The record belongs beside the firm's instruction, approval and escalation evidence; it does not replace those records.
Verification evidence, not client files. Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the subprocessor information.
Public guidance is cited for context only. No AUSTRAC endorsement of Vericode is implied.
Keep CDD and KYC in their proper place, then check the caller again when a high-risk interaction could change where money, information or authority goes.