Find your course
Menu

Course sources and how we build it.

Every fact with a number or a rule comes from a public document we have stored with its date and digital fingerprint. The test questions are our own.

How we build the course

  1. We read the originals: the pages and guidance of the Mortgage and Finance Association of Australia, the Australian Securities and Investments Commission, AUSTRAC, the Australian Cyber Security Centre and the Australian Government’s identity verification services, not other people’s summaries.
  2. We keep a copy of each document, with the date and its SHA-256 fingerprint, so we can show what it said.
  3. Every fact carries a word-for-word phrase. An automatic check confirms the phrase is in the stored copy; if it is not, the site is not published.
  4. The questions are ours. We do not copy questions from any exam or course. The scam examples use invented names and web addresses.
  5. Reading times are counted from the real text of each lesson, at 200 words a minute.
  6. Written with AI, checked against the sources: we draft with AI from the sources above, and every fact passes the word-for-word check. If you spot a mistake, email hello@aptiaskills.com and we will fix it.

How the 2 hours are counted

The hours come from the content, not from how long you take. Reading is 58 minutes (11,769 words at 200 words a minute, rounded down). The 39 review questions and 25 test questions in one sitting count 1 minute each (64 minutes). The total is 122 minutes, rounded down to the half hour. Reading is about 48% of that total.

The certificate also prints the study time your own browser measured. These are our figures, not the MFAA’s: you decide how to record the activity, using the rules below.

What the MFAA says about CPD, and what this course is

We are a private training provider, not a public body. This course is free to study, with an optional certificate of completion. We cannot promise that any activity counts for your CPD: the MFAA leaves relevance to you, and ASIC leaves training to your licensee.

What each lesson draws on

This table is part of the training record that comes with each certificate.

Lessons, their reading time and the bodies whose sources they cite
LessonReadingSources from
1. What your CPD rules ask, and where this course fits4 minASIC, MFAA
2. Settlement money: payment redirection on a broker’s file4 minACSC
3. Doctored payslips, statements and employer letters4 minASIC, AUSTRAC
4. Identity checks and impersonation of clients and brokers4 minACSC, AUSTRAC, IDMatch
5. Patterns across files, and what happens to brokers who miss them3 minASIC, AUSTRAC
6. Four files to practise on4 minACSC, ASIC, AUSTRAC
7. Payment redirection and business email compromise6 minACCC, ACSC, FBI Internet Crime Compl, INCIBE, Scamwatch
8. AI-written phishing and impersonation by email, SMS and chat7 minACCC, ACSC, Banco de la Nación del P, Europol, FBI Internet Crime Compl, Scamwatch, US Federal Trade Commiss
9. Verification habits that stop most of these scams6 minACSC, Comisión Federal de Come, FBI Internet Crime Compl, INCIBE, Scamwatch, US Federal Trade Commiss
10. Account takeover, passwords and MFA fatigue6 minACSC, FBI Internet Crime Compl, Scamwatch, US Cybersecurity and Inf
11. Synthetic identities and fake documents6 minEuropol, Europol Innovation Lab, FBI Internet Crime Compl, INCIBE, Ministerio Público Fisca, Ministerio de Justicia y, Scamwatch, US Treasury
12. Voice clones and deepfake video calls: an emerging risk7 minACSC, Europol Innovation Lab, FBI Internet Crime Compl, INCIBE, Ministerio de Justicia y, Scamwatch, US Federal Trade Commiss, US Treasury
13. When it happens: the first hour5 minACSC, Banco de la Nación del P, FBI Internet Crime Compl, INCIBE, Scamwatch

Sources

Checked on 2026-11-02. Names of public bodies appear here only as plain text, to say where a fact comes from.

  1. [S1] Continuing Professional Development (CPD). Mortgage and Finance Association of Australia (MFAA). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 9f8c9509c050e1aa…
    https://www.mfaa.com.au/resources/cpd
  2. [S3] RG 206 Credit licensing: Competence and training (ASIC page). Australian Securities and Investments Commission (ASIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 7dc62a81089d9a43…
    https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-206-credit-licensing-competence-and-training
  3. [S4] Credit representatives. Australian Securities and Investments Commission (ASIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 45253f5fea0e1e07…
    https://www.asic.gov.au/for-finance-professionals/credit-licensees/credit-representatives
  4. [S5] MFAA FAQs. Mortgage and Finance Association of Australia (MFAA). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 0e97e94c75598e64…
    https://www.mfaa.com.au/faqs
  5. [S6] Regulatory Guide 206 Credit licensing: Competence and training (issued 1 April 2020). Australian Securities and Investments Commission (ASIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 4193f80c963cc42e…
    https://download.asic.gov.au/media/gmcnpijx/rg206-published-1-april-2020-20221025.pdf
  6. [S7] Fintel Alliance uncovers coordinated mortgage fraud across major lenders. AUSTRAC. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: cc9fcd26ecf7d788…
    https://www.austrac.gov.au/news-and-media/news/fintel-alliance-uncovers-coordinated-mortgage-fraud-across-major-lenders
  7. [S8] Major mortgage fraud risks uncovered. AUSTRAC. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 35d1fd27e52e6c7a…
    https://www.austrac.gov.au/news-and-media/article/major-mortgage-fraud-risks-uncovered
  8. [S9] 22-185MR ASIC permanently bans Adelaide mortgage broker and cancels company’s credit licence. Australian Securities and Investments Commission (ASIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 2fe9bdad96e3ffc0…
    https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2022-releases/22-185mr-asic-permanently-bans-adelaide-mortgage-broker-and-cancels-company-s-credit-licence
  9. [S10] 18-118MR Former Sydney mortgage brokers permanently banned for loan fraud. Australian Securities and Investments Commission (ASIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: b8055e259a848060…
    https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2018-releases/18-118mr-former-sydney-mortgage-brokers-permanently-banned-for-loan-fraud
  10. [S11] Property-related business email compromise scams rising in Australia. Australian Signals Directorate, Australian Cyber Security Centre (cyber.gov.au). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 52bd34c785504904…
    https://www.cyber.gov.au/about-us/alerts/property-related-business-email-compromise-scams-rising-australia
  11. [S12] Identity verification services (Document Verification Service and Face Verification Service). Australian Government identity verification services (idmatch.gov.au). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 4e8ac6a387c25848…
    https://www.idmatch.gov.au/
  12. [S13] Money laundering and terrorism financing risk assessment: non-bank lenders and financiers (2021). AUSTRAC. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 51876bbabd801d10…
    https://www.austrac.gov.au/sites/default/files/2021-06/AUSTRAC_RiskAssessment2021_NonBankLenders.pdf
  13. [S90] Repair, replace, refund, cancel. Australian Competition and Consumer Commission (ACCC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: dcb5be4167fc189e…
    https://www.accc.gov.au/consumers/problem-with-a-product-or-service-you-bought/repair-replace-refund-cancel
  14. [S91] Small business and the Privacy Act. Office of the Australian Information Commissioner (OAIC). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 67f60c5d8f044044…
    https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
  15. [KS1] Targeting scams: report of the National Anti-Scam Centre on scams data and activity 2025 (March 2026). National Anti-Scam Centre, Australian Competition and Consumer Commission. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 9d21086dedca93f0…
    https://www.scamwatch.gov.au/system/files/targeting-scams-report-2025.pdf
  16. [KS2] Phishing scams. Scamwatch (Australian Competition and Consumer Commission). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: fd34428361dd1f71…
    https://www.scamwatch.gov.au/types-of-scams/phishing
  17. [KS3] Account or identity takeover scams. Scamwatch (Australian Competition and Consumer Commission). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: ce0bdeb5f2e0d31b…
    https://www.scamwatch.gov.au/types-of-scams/remote-access-scams
  18. [KS4] Protect your small business from invoice email scams (16 Aug 2016). Scamwatch (Australian Competition and Consumer Commission). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 52ed3a5a4ee2b19a…
    https://www.scamwatch.gov.au/about-us/news-and-alerts/protect-your-small-business-from-invoice-email-scams
  19. [KS6] False billing: John updated supplier details and it ended up costing thousands. Scamwatch (Australian Competition and Consumer Commission). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 8690814edb65f0a1…
    https://www.scamwatch.gov.au/stop-check-protect/real-life-stories/false-billing-john-updated-supplier-details-and-it-ended-up-costing-thousands
  20. [KS7] How scammers use technology and AI. Scamwatch (Australian Competition and Consumer Commission). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: a5312102ac849c8f…
    https://www.scamwatch.gov.au/stop-check-protect/help-to-spot-and-avoid-scams/how-scammers-use-technology-and-ai
  21. [KS8] Recover from business email compromise (8 Sep 2026). Australian Signals Directorate, cyber.gov.au. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: ec3d93b13ef375f6…
    https://www.cyber.gov.au/guidance/recover-from-business-email-compromise
  22. [KS9] Protecting against business email compromise. Australian Signals Directorate, cyber.gov.au. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 6f0de95cdcce305b…
    https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/protecting-against-business-email-compromise
  23. [KS10] Learn about account compromise. Australian Signals Directorate, cyber.gov.au. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 7b35d9b14725d7aa…
    https://www.cyber.gov.au/guidance/learn-about-account-compromise
  24. [KS11] Learn about phishing scams. Australian Signals Directorate, cyber.gov.au. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: cd2a70740cbbda07…
    https://www.cyber.gov.au/guidance/learn-about-phishing-scams
  25. [KS13] Scattered Spider advisory. Australian Signals Directorate, cyber.gov.au (reproducing a joint advisory). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 2e388db94d443aff…
    https://www.cyber.gov.au/advisory/scattered-spider
  26. [KS14] Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA, 3 Dec 2024). FBI Internet Crime Complaint Center (IC3). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 5f652fda93b8482a…
    https://www.ic3.gov/PSA/2024/PSA241203
  27. [KS15] Senior US Officials Impersonated in Malicious Messaging Campaign (public service announcement, 15 May 2025). FBI Internet Crime Complaint Center (IC3). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: d7af19215c731bc5…
    https://www.ic3.gov/PSA/2025/PSA250515
  28. [KS16] 2025 IC3 Annual Report. FBI Internet Crime Complaint Center (IC3). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 7d1fe453237654d2…
    https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
  29. [KS17] FBI Warns of Scammers Impersonating the IC3 (I-072026-PSA, 20 Jul 2026). FBI Internet Crime Complaint Center (IC3). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: e352c731551538d4…
    https://www.ic3.gov/PSA/2026/PSA260720
  30. [KS18] Senior US Officials Continue to be Impersonated in Malicious Messaging Campaign (I-121925-PSA, 19 Dec 2025). FBI Internet Crime Complaint Center (IC3). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 2009970fa1c67fe0…
    https://www.ic3.gov/PSA/2025/PSA251219
  31. [KS19] How To Avoid a Scam. US Federal Trade Commission, Consumer Advice. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: eb66f787ba27f9cd…
    https://consumer.ftc.gov/articles/how-avoid-scam
  32. [KS21] Scammers use AI to enhance their family emergency schemes (March 2023). US Federal Trade Commission, Consumer Advice. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 53ae7928777dcecd…
    https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes
  33. [KS22] Fighting back against harmful voice cloning (April 2024). US Federal Trade Commission, Consumer Advice. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 2a030317d1640a8f…
    https://consumer.ftc.gov/consumer-alerts/2024/04/fighting-back-against-harmful-voice-cloning
  34. [KS23] How To Avoid Imposter Scams. US Federal Trade Commission, Consumer Advice. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 783f3c028eded810…
    https://consumer.ftc.gov/features/how-avoid-imposter-scams
  35. [KS24] Phishing attacks: defending your organisation. UK National Cyber Security Centre. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 9ab741811dfdec48…
    https://www.ncsc.gov.uk/guidance/phishing
  36. [KS25] Phishing scams: how to spot and report them. UK National Cyber Security Centre. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: d82fb6ea424f5759…
    https://www.ncsc.gov.uk/guidance/suspicious-email-actions
  37. [KS27] The near-term impact of AI on the cyber threat. UK National Cyber Security Centre (NCSC Assessment). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: da8e2361bf216f78…
    https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat
  38. [KS28] Steal, deal and repeat: how cybercriminals trade and exploit your data (IOCTA 2025). Europol. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 8feae25dde74a8f2…
    https://www.europol.europa.eu/cms/sites/default/files/documents/Steal-deal-repeat-IOCTA_2025.pdf
  39. [KS30] Facing reality? Law enforcement and the challenge of deepfakes. Europol Innovation Lab. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 1e48071951f58c63…
    https://www.europol.europa.eu/cms/sites/default/files/documents/Europol_Innovation_Lab_Facing_Reality_Law_Enforcement_And_The_Challenge_Of_Deepfakes.pdf
  40. [KS31] FinCEN Alert FIN-2024-Alert004: Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (13 Nov 2024). US Treasury, Financial Crimes Enforcement Network (FinCEN). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 5e02f6647ee023ff…
    https://www.fincen.gov/system/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf
  41. [KS32] Implementing Phishing-Resistant MFA (fact sheet, October 2022). US Cybersecurity and Infrastructure Security Agency (CISA). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 0f8fff1a8208b305…
    https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
  42. [KS33] Implementing Number Matching in MFA Applications (fact sheet, October 2022). US Cybersecurity and Infrastructure Security Agency (CISA). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 0b752a0400d4ff03…
    https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
  43. [KS34] Fraude del CEO: el engaño que puede vaciar la cuenta de tu pyme (page in Spanish). INCIBE (Instituto Nacional de Ciberseguridad de España). Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: c3977d5f89991274…
    https://www.incibe.es/empresas/blog/fraude-del-ceo-el-engano-que-puede-vaciar-la-cuenta-de-tu-pyme
  44. [KS35] Suplantación del CEO utilizando la técnica de inteligencia artificial deepvoice (page in Spanish). INCIBE, línea de ayuda en ciberseguridad: casos reales. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 3ba736a024d2e3fe…
    https://www.incibe.es/linea-de-ayuda-en-ciberseguridad/casos-reales/suplantacion-del-ceo-utilizando-la-tecnica-de-inteligencia-artificial-deepvoice
  45. [KS36] Una empresa sufre una estafa millonaria al suplantar al CEO vía Teams (page in Spanish). INCIBE, línea de ayuda en ciberseguridad: casos reales. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 1cbfb18fb417f1d4…
    https://www.incibe.es/linea-de-ayuda-en-ciberseguridad/casos-reales/una-empresa-sufre-una-estafa-millonaria-al-suplantar-al-ceo-teams
  46. [KS38] Deepfake (Explorador INCIBE) (page in Spanish). INCIBE. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 93ca5da41381afc1…
    https://www.incibe.es/exploradorincibe/deepfake
  47. [KS39] ¿Qué es el voice hacking? (page in Spanish). INCIBE, blog para la ciudadanía. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 4cd1c2d5e14e6fdb…
    https://www.incibe.es/ciudadania/blog/que-es-el-voice-hacking
  48. [KS40] Cómo evitar una estafa (page in Spanish). Comisión Federal de Comercio de Estados Unidos (FTC), Consumidor. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: d9fc7ce2c9f324c5…
    https://consumidor.ftc.gov/articulos/como-evitar-una-estafa
  49. [KS42] Autoridad Nacional de Protección de Datos Personales brinda recomendaciones ante nueva modalidad de estafa por clonación de voz (page in Spanish). Ministerio de Justicia y Derechos Humanos del Perú, en gob.pe. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: c92ce49edb198cf6…
    https://www.gob.pe/institucion/minjus/noticias/805436-autoridad-nacional-de-proteccion-de-datos-personales-brinda-recomendaciones-ante-nueva-modalidad-de-estafa-por-clonacion-de-voz
  50. [KS43] Una llamada de tu Banco, podría no serlo: spoofing telefónico (page in Spanish). Banco de la Nación del Perú, en gob.pe. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 1cc4ae2cf8f2bb09…
    https://www.gob.pe/institucion/bn/noticias/821482-una-llamada-de-tu-banco-podria-no-serlo-spoofing-telefonico-suplantacion-de-numero-telefonico
  51. [KS44] ¡Cuidado con la suplantación de identidad! Recomendaciones para proteger tu información personal (page in Spanish). Ministerio de Justicia y Derechos Humanos del Perú, en gob.pe. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: 5e4176179ac7d182…
    https://www.gob.pe/institucion/minjus/noticias/1163916-cuidado-con-la-suplantacion-de-identidad-minjusdh-te-brinda-recomendaciones-para-proteger-tu-informacion-personal
  52. [KS45] Suplantación de identidad: orientación (page in Spanish). Ministerio Público Fiscalía de la Nación del Perú, en gob.pe. Checked on 2026-11-02. SHA-256 fingerprint of our stored copy: b497fd983a29bf0f…
    https://www.gob.pe/25712-suplantacion-de-identidad