Why do criminals target agents?
An agent has access to many taxpayers' details. The ATO says criminals try to take over the identities of honest registered agents to reach that information.
They may also pose as taxpayers and engage an agent to lodge fraudulent returns without the agent knowing. The TPB has seen a lack of proper identification processes in practices result in tax and identity fraud.
Remember
- Two routes: take over the agent, or pose as a client.
- Weak identification in the practice is how the second one works.
Facts and sources for this part
- Criminals try to take over the identities of honest registered agents to get at taxpayers' personal information, and may pose as taxpayers to get an agent to lodge fraudulent returns without knowing it. [S30]
- The TPB has seen a lack of proper identification processes in practices result in tax and identity fraud. [S7]
When must you verify identity?
Before you provide services to a new client, and on an ongoing basis for existing clients as appropriate. If you fail to properly verify a client's or representative's identity, you may breach the Code of Professional Conduct or a registration requirement.
For an individual, sight one primary photographic ID. Where there is no photo ID, sight a primary non-photographic ID and a secondary ID. An original or a certified copy is acceptable.
Remember
- Before the first service, and on an ongoing basis.
- Photo ID, or primary non-photo plus secondary ID.
- A representative needs checking too, plus proof of authority.
Facts and sources for this part
- You must verify a client's identity before providing services to a new client, and on an ongoing basis for existing clients as appropriate. [S7]
- If you fail to properly verify a client's or representative's identity, you may breach the Code of Professional Conduct or a registration requirement. [S7]
- For an individual client, sight one primary photographic ID. Where no photo ID is available, sight a primary non-photographic ID and a secondary ID. You can use an original or a certified copy. [S7]
- A representative also needs checking: sight a legal document showing their authority to engage you on the client's behalf, where applicable. [S7]
- When sighting documents, make sure the name, address and date of birth all match the details the client gave you. [S7]
Client-to-agent linking does not replace your check
ATO client-to-agent linking requires entities with an ABN (excluding sole traders) to nominate their registered agent in Online services for business. The client controls who can access their information.
The TPB is clear that linking does not override your own identity check. It does not verify the identity of the person who engaged you.
Remember
- Linking protects the client's ATO record.
- You still verify the person in front of you.
Facts and sources for this part
- Client-to-agent linking requires entities with an ABN (excluding sole traders) to nominate their registered agent in Online services for business. The client controls who can access their information. [S30]
- ATO client-to-agent linking does not replace your own proof-of-identity checks. It does not verify the identity of the person who engaged you. [S7]
Keep a note, not a copy
The TPB does not recommend keeping copies of identity documents. Keep a file note that records the check you did, and by whom.
If you must receive documents remotely, do not ask for them by plain email. Use a secure website, online mailbox or an encrypted or password protected attachment.
Remember
- File note: date, who checked, which document types, outcome.
- No ID copies in your inbox.
Facts and sources for this part
- The TPB does not recommend keeping copies of identity documents. Keep a file note that shows the identity check was done. [S8]
- Email is not considered a secure form of communication, so do not ask clients to email identity documents. Use a secure website, online mailbox, or an encrypted or password protected attachment. [S23] [S7]
A refund has gone to the wrong account. Now what?
The ATO is generally unable to intervene where a refund has already issued to the destination your client or their authorised representative instructed. It cannot trace misdirected funds.
That is why checks happen before lodgment. If you suspect a client is a victim of fraud, tell them to phone the ATO Client Identity Support Centre on 1800 467 033 and to contact the issuer of any stolen identity documents.
Remember
- After the refund is paid, recovery is slow or impossible.
- Act the same day: ATO Client Identity Support Centre, 1800 467 033.
Facts and sources for this part
- The ATO is generally unable to intervene where a refund has already been issued to the destination the client or their authorised representative instructed. It cannot trace misdirected funds. [S13]
- If you suspect a client is a victim of fraud, tell them to phone the ATO Client Identity Support Centre on 1800 467 033 and to contact the issuer of any stolen identity documents. A complaint about a practitioner goes to the TPB. [S13]
Help clients lock their side down
A Strong myID is the most secure sign-in option for clients, because the client must verify their ID in the app. That makes it harder for fraudsters to impersonate them.
The ATO asks agents to raise this with clients. To report suspected fraud that is not about your own client, the ATO Tax Integrity Centre hotline is 1800 060 062.
Remember
- Ask clients to set up myID and raise it to Strong.
- Report suspected fraud to the Tax Integrity Centre, 1800 060 062.
Facts and sources for this part
- A Strong myID is the most secure sign-in option for clients, because the client must verify their ID in the app, which makes it harder for fraudsters to impersonate them. [S13]
- The ATO asks you to talk with clients about setting up myID and raising it to Strong strength, and to use a Strong myID if they have been compromised before. [S14]
- To report suspected fraud, phone the ATO Tax Integrity Centre hotline on 1800 060 062. [S31]
Scenario: a new client who only communicates by email
A new client emails asking you to lodge a return and send the refund to a bank account in a different name. There has been no call and no visit.
Do not proceed until identity is verified. Ask for documents through a secure channel, not plain email. Phone the client on a number you can find independently, ask why the account name differs, and keep a file note of what you did. If the client cannot be verified, decline the work.
Remember
- No verification, no lodgment.
- A different account name is a prompt to ask, not to assume.
Facts and sources for this part
- You must verify a client's identity before providing services to a new client, and on an ongoing basis for existing clients as appropriate. [S7]
- Email is not considered a secure form of communication, so do not ask clients to email identity documents. Use a secure website, online mailbox, or an encrypted or password protected attachment. [S23] [S7]
- The TPB does not recommend keeping copies of identity documents. Keep a file note that shows the identity check was done. [S8]
Scenario: someone says they act for a company
A caller says they are the new director of a company client and wants the contact details changed. They sound confident and know the company's ABN.
Knowing an ABN proves nothing, because it is public. Check the person's identity and ask for a legal document showing their authority to engage you on the client's behalf. Then record the check.
Remember
- Public facts are not proof of authority.
- Ask for a document, then write a file note.
Facts and sources for this part
- A representative also needs checking: sight a legal document showing their authority to engage you on the client's behalf, where applicable. [S7]
- For an individual client, sight one primary photographic ID. Where no photo ID is available, sight a primary non-photographic ID and a secondary ID. You can use an original or a certified copy. [S7]
Checklist: what goes in the identity file note
The date, who did the check, which document types were sighted, whether the name, address and date of birth matched, and the outcome. Do not keep copies of the documents unless a law requires it.
If a representative acts for the client, note the document that shows their authority.
Remember
- Date, checker, document types, match, outcome.
- No copies of ID.
Facts and sources for this part
- The TPB does not recommend keeping copies of identity documents. Keep a file note that shows the identity check was done. [S8]
- When sighting documents, make sure the name, address and date of birth all match the details the client gave you. [S7]
- A representative also needs checking: sight a legal document showing their authority to engage you on the client's behalf, where applicable. [S7]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
When must you verify a client's identity?
Show the answer
Right answer: C, Before providing services to a new client, and on an ongoing basis for existing clients. The TPB says you must verify identity before providing services to new clients and on an ongoing basis to existing clients, as appropriate. [S7]
Question 2 of 3
What should you keep after checking a client's identity?
Show the answer
Right answer: C, A file note showing the check was done, not copies of the documents. The TPB does not recommend keeping copies of identity documents. Keep a file note about the check. [S8]
Question 3 of 3
You suspect a client is a victim of identity fraud. Which number should they phone?
Show the answer
Right answer: B, The ATO Client Identity Support Centre on 1800 467 033. The ATO recommends the Client Identity Support Centre on 1800 467 033. The other numbers belong to different services. [S13]