Why identity crime is a broker’s problem
The Australian Government’s identity verification services site says around one in four Australians will be a victim of identity crime at some point in their lives. A loan file holds almost everything an impersonator needs: full name, date of birth, address, employer, income, licence and passport details.
That makes your files a target, and it makes your clients a target. A criminal who gets a copy of a real person’s documents can try to borrow in that person’s name.
Remember
- One in four Australians is affected over a lifetime.
- A loan file is a full identity kit.
- Protect the file as carefully as the loan.
Facts and sources for this part
- The Australian Government’s identity verification services site says around one in four Australians will be a victim of identity crime at some point in their lives. [S12]
Checking ID documents against government records
The national identity verification services let organisations check identity documents against government records. They are meant to make it harder to use fake, changed or stolen identity documents, and an organisation needs a person’s express consent to verify their identity using them.
Our advice: find out which identity check your aggregator or lender already runs, and make sure your client knows about it and agrees to it. Do not take photos of ID on a personal phone and leave them in a camera roll.
Remember
- Government record checks exist and need the person’s express consent.
- Ask your aggregator or lender what ID checks they run.
- Do not keep ID photos in personal apps.
Facts and sources for this part
- Organisations need a person’s express consent to verify their identity using the national identity verification services, which are meant to make it harder to use fake, changed or stolen identity documents. [S12]
Someone pretending to be your client
The usual forms are a new “client” who has stolen documents, or a real client whose email has been taken over, asking you to change contact details, send documents elsewhere or pay money to a new account.
Our advice: if a client suddenly changes phone number, email address or bank account, treat it as a risk, not an update. Ring the number you already hold, and ask a question only the real client could answer. A client who is genuine will not mind.
Remember
- Sudden changes to contact or bank details are a warning sign.
- Use the contact details you already hold.
- Genuine clients accept an extra check.
Someone pretending to be you, or your lender
The Australian Cyber Security Centre warns that criminals single out mortgage lenders to intercept property settlements, and that fraudulent emails may come from hacked accounts or from domain names that are similar to a real company. They can use the same tricks on you.
Our advice: if your clients get an email “from you” that you did not send, tell them quickly and in writing. Keep a short note on your website and in your first email that says how you will and will not contact them. Use multi-factor sign-in on your email and your broking software, so a stolen password alone is not enough.
Remember
- Criminals copy brokers and lenders as well as clients.
- Tell clients how you will and will not contact them.
- Turn on multi-factor sign-in for email and broking software.
Facts and sources for this part
- The same alert says criminals also single out mortgage lenders in order to intercept property settlements. [S11]
- The fraudulent emails may come from hacked email accounts, or from domain names similar to a real company, and a successful scam can go unnoticed for weeks until someone follows up on a missing payment. [S11]
Scenario: a client who has changed everything
You get a new application. The client, Sam Okafor, sends payslips and a passport photo by email from a free webmail address, and says to call only on WhatsApp because his phone is “being repaired”. The employer in the payslips is real but the phone number on the letter does not match the one on the company’s own web page.
Slow down. Ask for a call on a landline or on a number you can verify. Check the number on the employer’s own website, not the one on the letter. Ask what the lender’s ID check will use and that Sam agrees to it. If Sam cannot or will not do these things, do not submit, and tell your licensee.
Red flags: a contact method that avoids a normal phone call, mismatched employer details, urgency, and webmail with a payslip claiming to be from a larger employer.
Remember
- A refusal to take a normal call is a red flag.
- Verify employer numbers from the employer’s own site.
- Do not submit what you cannot support.
Facts and sources for this part
- Organisations need a person’s express consent to verify their identity using the national identity verification services, which are meant to make it harder to use fake, changed or stolen identity documents. [S12]
- Lenders reported spotting falsified payslips and statements through inconsistencies in fonts and errors in the gross, net, tax and superannuation amounts, and false or old employer details. [S13]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What does an organisation need before it verifies a person’s identity using the national identity verification services?
Show the answer
Right answer: B, The person’s express consent. Organisations need a person’s express consent to verify their identity using the services. [S12]
Question 2 of 3
A client says an email “from you” was not sent by you. Where does the ACSC alert say such emails may come from?
Show the answer
Right answer: B, Hacked email accounts or look-alike domain names. The fraudulent emails may come from hacked email accounts or from domain names similar to legitimate companies. [S11]
Question 3 of 3
AUSTRAC tells lenders to verify which of these?
Show the answer
Right answer: D, Identity, employment, income and supporting documentation. AUSTRAC tells lenders to verify identity, employment, income and supporting documentation. [S8]