{"id":"F2022L00548","name":"Telecommunications Service Provider (Customer Identity Authentication) Determination 2022","slug":"telecommunications-service-provider-customer-identity-authentication-determination-2022","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":102374,"registerId":"commonwealth-F2022L00548-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Name","content":"#### 1 Name\n\n  This is the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022.","sortOrder":0},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n  This determination commences on 30 June 2022.","sortOrder":1},{"sectionNumber":"3","sectionType":"section","heading":"Authority","content":"#### 3 Authority\n\n  This determination is made under subsection 99(1) of the Act.","sortOrder":2},{"sectionNumber":"4","sectionType":"section","heading":"Application","content":"#### 4 Application\n\n  For the purposes of subsection 99(1) of the Act, this determination applies to carriage service providers:\n  (a) involved in the supply of a telecommunications service; and\n  (b) when conducting a high-risk customer interaction relating to a customer of a carriage service provider.\n  but it does not apply to a customer who is an account managed customer or an integrated customer.","sortOrder":3},{"sectionNumber":"5","sectionType":"section","heading":"Objectives","content":"#### 5 Objectives\n\n  The objectives of this determination are to:\n  (a) reduce the harm caused to customers when access to their personal information, business information or telecommunications service is targeted by unauthorised persons or entities; and\n  (b) require carriage service providers to follow effective identity authentication processes to protect the security of high-risk customer interactions.","sortOrder":4},{"sectionNumber":"6","sectionType":"section","heading":"Definitions","content":"#### 6 Definitions\n\n  (1) In this determination:\n\n> access-controlled defence site means defence premises which can only be accessed through a defence access control point.\n\n> account information authenticator means a process used to establish that the requesting person is the customer, or is the customer’s authorised representative, for the telecommunications service based on the requesting person’s knowledge of a piece of the customer’s account security information.\n\n> account managed customer means a customer of a carriage service provider where the provider assigns one or more of its employees or agents to be a designated contact person for the customer, in relation to all matters relating to the customer’s telecommunications services.\n\n> account security information means information which is created for the purpose of applying security to an account and which may include one or more of:\n\n> (a) an account username or login information which is used to log into the customer’s account on the carriage service provider’s website or mobile application;\n\n> (b) an account number;\n\n> (c) an account password;\n\n> (d) a personal identification number related to the account; or\n\n> (e) the answer to a security question which has been set up for the purposes of identity authentication.\n\n> Act means the Telecommunications Act 1997.\n\n> audio visual link means a facility, including closed‑circuit television, that enables reasonably contemporaneous and continuous audio and visual communication between persons at different places.\n\n> authorised representative means a person:\n\n> (a) who is listed by the customer on their account as having authority from the customer to deal with a carriage service provider on behalf of that customer as their representative; and\n\n> (b) whose personal information is recorded on the customer’s account.\n\n> biometric data means information about any measurable biological or behavioural characteristics of an individual that can be used to verify the identity of the individual, such as their face, fingerprints or voice.\n\n> business information means information about a customer who is not an individual.\n\n> business to business service request system means a system which is purpose-built for a customer to integrate the customer’s information technology systems with the carriage service provider’s information technology systems through which transactions relating to the customer’s telecommunication service can be conducted using secure methods of communication.\n\n> Example: Secure methods of communication include, for example, an application interface which connects the customer’s computers or software with the provider’s computers prior to which connection, authentication such as IP address ranges or encrypted channels is used.\n\n> category A document means a document mentioned in Table 1 in Schedule 1.\n\n> category B document means a document mentioned in Table 2 in Schedule 1.\n\n> customer means:\n\n> (a) an individual who acquires or may acquire a telecommunications service for the primary purpose of personal or domestic use and not for resale; or\n\n> (b) a business or non-profit organisation which acquires or may acquire one or more telecommunications services which are not for resale and which, at the time it enters into the customer contract:\n\n> (i) does not have a genuine and reasonable opportunity to negotiate the terms of the customer contract; and\n\n> (ii) has or will have an annual spend with the carriage service provider which is, or is estimated on reasonable grounds by the carriage service provider to be, no greater than $40,000,\n\n> and who or which has entered into a customer contract with the carriage service provider.\n\n> customer contract means an arrangement or agreement between a carriage service provider and a customer for the supply of a telecommunications service to that customer and includes a standard form of agreement formulated by the carriage service provider for the purposes of section 479 of the Act.\n\n> defence access control point and defence premises have the same meanings as in section 71A of the Defence Act 1903.\n\n> digital mobile number means a special services number specified in Schedule 5 of the Telecommunications Numbering Plan 2015 for use with a digital mobile service.\n\n> digital mobile service means a public mobile telecommunications service supplied by a network using digital modulation techniques.\n\nemergency means an actual or imminent event (such as fire, flood, storm, earthquake, explosion or terrorist act) that:\n\n    (a) causes significant disruption to an individual or business; and\n\n    (b) that is perceived to threaten life or property.\n\n> foreign military ID card means an identification card:\n\n> (a) issued in the name of an individual by a foreign government;\n\n> (b) showing a photo of the individual; and\n\n> (c) identifying the individual as a current member of the defence forces of that government.\n\nfraud mitigation training means training provided by a carriage service provider to its employees and agents for the purposes of implementing a strategy to detect fraudulent transactions and preventing those transactions from causing financial damage to the customer and carriage service provider.\n\ngovernment-accredited digital identity service means an online service that allows users of that service to verify their identity digitally to relying parties, where that service holds a valid accreditation status, as issued by the relevant government regulator.\n\ngovernment document means a document that is issued by the Commonwealth or a State or Territory that is evidence of the person’s identity in Australia or use of that identity in Australia.\n\n> Note: Examples of government documents include a current driver’s licence, Medicare card or Australian passport.\n\n> government online document verification service means an online service which allows users of that service to confirm the validity of information recorded on certain identification documents against the databases of the government agency that issued the relevant identification documents, in a manner authorised by that government agency or its representatives.\n\n> high-risk customer interaction means an interaction between a carriage service provider and a requesting person, in relation to a customer’s telecommunications service, initiated by either the requesting person or by the carriage service provider, during which one or more high-risk customer transactions are requested.\n\n> high-risk customer transaction means a transaction that may result in one or more of the following:\n\n> (a) a customer losing access to the customer’s telecommunications service;\n\n> (b) a change to a customer’s personal information, business information or account security information held by the carriage service provider relating to the customer’s account;\n\n> (c) adding or removing a person as a customer’s authorised representative;\n\n> (d) disclosure to the requesting person of a customer’s personal information, business information or account security information held by the carriage service provider relating to the customer’s account;\n\n> (e) an additional ongoing, or a large one-off charge being applied to a customer’s account;\n\n> Note: A carriage service provider should determine whether a charge is a large one-off charge with reference to the usual pattern of charges on a customer’s account. For example, a one-off charge of $200 may qualify as a large one-off charge for a customer with a regular monthly charge of $15.\n\n> but does not include any of the following:\n\n> (f) a transfer of title (also known as a change of ownership) where:\n\n> (i) the carriage service provider is satisfied that the end-user of a public number, who is not the customer for that number, is affected by domestic or family violence; and\n\n> (ii) the terms and conditions in the standard form of agreement, formulated by the carriage service provider for the purposes of section 479 of the Act, permit a transfer of title in those circumstances;\n\n> (g) a transaction to port a mobile number to which the Telecommunications (Mobile Number Pre-Porting Identity Verification) Industry Standard 2020 applies; or\n\n> (h) a transaction that may result in the disclosure to the requesting person of a customer’s personal information, business information or account security information where the information:\n\n> (i) is included in a bill or in other correspondence with the customer; or\n\n> (ii) is mostly hashed or obscured for the purpose of reminding a customer of the customer’s information; or\n\n> (iii) is included in notifications relating to a customer’s telecommunications service usage.\n\n> Note 1: A high-risk customer transaction includes, for example, a SIM swap request, a request to transfer a telecommunications service from being a post-paid carriage service to a pre-paid carriage service, a request for the activation of a telecommunications service where the customer is overseas, a request for a transfer of title (also known as change of ownership), a request to block an International Mobile Equipment Identity or a Permanent Equipment Identifier, a request to purchase an additional mobile communications device, and a request to add an additional carriage service to an account.\n\n> Note 2: Carriage service providers have obligations under the Telecommunications (Mobile Number Pre-Porting Identity Verification) Industry Standard 2020 to confirm that the person requesting the port (within the meaning of that standard) of a mobile service number is the rights of use holder (within the meaning of that standard) for that number. A carriage service provider which must comply with that standard is not required to comply with this determination in relation to a port.\n\n> identity authentication process means a process described in subsections 9(1), 9(2), 9(3), 10(2) or 11(2).\n\n> integrated customer means a customer who:\n\n> (a) uses an integrated service desk provided by the customer’s carriage service provider; or\n\n> (b) has a business to business service request system with a carriage service provider.\n\n> integrated service desk means a service provided to the customer which is tailored to the customer’s requirements through which the customer can communicate with the carriage service provider in relation to the customer’s telecommunications services via channels dedicated to their account, and may include a dedicated contact number, email mailbox or purpose-built applications.\n\n> mobile carriage service provider means a carriage service provider who supplies or arranges for the supply of a public mobile telecommunications service.\n\n> mobile service number means a digital mobile number issued by a mobile carriage service provider to a customer in connection with the supply of a public mobile telecommunications service (other than a satellite telephone service).\n\n> person in vulnerable circumstances means a customer:\n\n> (a) who due to their personal circumstances, is experiencing, or is at risk of experiencing, harm, detriment or disadvantage, (including a customer who is overseas who has lost their mobile communications device or a customer who has been impacted by an emergency or domestic or family violence);\n\n> (b) who due to the circumstances in (a), cannot access a telecommunication service, device, or cannot provide category A documents or category B documents for the purpose of identity authentication; and\n\n> (c) in relation to whom, the carriage service provider is consequently unable to complete the identity authentication processes under section 9(3) or subsection 10(2).\n\n> A reference to a customer in this definition, includes their authorised representative.\n\npersonal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, including the customer’s name, date of birth, and address:\n\n(a) whether the information or opinion is true or not; and\n\n(b) whether the information or opinion is recorded in a material form or not.\n\n> personal information authenticator means a process used to establish that the requesting person is the customer, or is the customer’s authorised representative, for the telecommunications service based on their knowledge of a piece of the customer’s personal information that is not account security information.\n\n> post-paid carriage service means a carriage service that is supplied by a carriage service provider to a person where:\n\n> (a) the service may be used fully or in part before payment for the supply of the service is made; and\n\n> (b) the person has arranged with the carriage service provider to pay either an amount notified in an invoice issued by the carriage service provider, or instalments of fixed amounts at regular intervals (whether or not, notified in an invoice), for the supply of the service.\n\n> pre-paid carriage service means a carriage service that has the following characteristics:\n\n> (a) it is a public mobile telecommunications service used in connection with a public number;\n\n> (b) the payment for the supply of the service must be made before the service is used, unless the supplier of the service has not required payment for the initial supply of the service; and\n\n> (c) it is not a post-paid carriage service.\n\n> public number means a number specified in the Telecommunications Numbering Plan 2015 for use in connection with the supply of carriage services to the public in Australia.\n\n> requesting person means a person who:\n\n> (a) has contacted a carriage service provider; or\n\n> (b) has been contacted by a carriage service provider,\n\n> in relation to a transaction that results in a high-risk customer interaction.\n\n> satellite telephone service means a carriage service with which end-users make calls via a satellite-based facility.\n\n> SIM means a subscriber identity module.\n\n> SIM swap request means the transfer of a public number connected to a public mobile telecommunications service from one SIM to a new SIM.\n\n> SMS message means a message or series of messages sent using a short message service.\n\n> special services number has the same meaning as in section 31 of the Telecommunications Numbering Plan 2015.\n\n> telecommunications service means any of the following carriage services:\n\n> (a) standard telephone service;\n\n> (b) public mobile telecommunications service;\n\n> (c) a carriage service that enables customers to access the internet.\n\n> unlisted authorised representative means a person who is authorised by the customer, or by a court or tribunal or any other body legally empowered to represent customers, to act on behalf of the customer, other than an authorised representative.\n\n> validated: see subsection (2).\n\n> Note: A number of other expressions used in this determination are defined in the Act, including the following:\n\n    (a) carriage service;\n    (b) carriage service provider;\n    (c) public mobile telecommunications service;\n    (d) standard telephone service.\n\n> Note: (2) An email address, mobile application, device or account (the contact point) has been validated by a customer or authorised representative if the customer or authorised representative has undertaken a security process required by the carriage service provider in relation to the contact point which verifies that the customer or authorised representative has access to the contact point.","sortOrder":5},{"sectionNumber":"7","sectionType":"section","heading":"References to other instruments","content":"#### 7 References to other instruments\n\n  In this determination, unless the contrary intention appears:\n    (a) a reference to any other legislative instrument is a reference to that other legislative instrument as in force from time to time; and\n    (b) a reference to any other kind of instrument is a reference to that other instrument as in force from time to time.\n\n> Note 1: For references to Commonwealth Acts, see section 10 of the Acts Interpretation Act 1901 and subsection 589(1) of the Act, and see also subsection 13(1) of the Legislation Act 2003 for the application of the Acts Interpretation Act 1901 to legislative instruments.\n\n> Note 2: All Commonwealth Acts and legislative instruments are registered on the Federal Register of Legislation. The Federal Register of Legislation may be accessed free of charge at [www.legislation.gov.au](http://www.legislation.gov.au/).\n\nPart 2—Identity Authentication Requirements","sortOrder":6},{"sectionNumber":"8","sectionType":"section","heading":"Requirement to confirm the requesting person is the customer or the customer’s authorised representative","content":"#### 8 Requirement to confirm the requesting person is the customer or the customer’s authorised representative\n\n  Subject to section 12, prior to undertaking the first high-risk customer transaction in the course of a high-risk customer interaction, a carriage service provider for a telecommunications service must confirm:\n  (a) the requesting person is the customer, or the customer’s authorised representative, for the service by use of the identity authentication process or processes in section 9; or\n  (b) if section 10 applies – the requesting person is the customer, or the customer’s authorised representative, for the service by use of the identity authentication process or processes in section 10; or\n  (c) if section 11 applies – the requesting person is the customer, or the customer’s authorised representative, for the service by use of the identity authentication process or processes in section 11.","sortOrder":7},{"sectionNumber":"9","sectionType":"section","heading":"Multi-factor Authentication Requirements","content":"#### 9 Multi-factor Authentication Requirements\n\n  (1) In a case where the high-risk customer interaction is initiated by the requesting person – a carriage service provider for the telecommunications service must use one of the following identity authentication processes:\n    (a) at least two account information authenticators; or\n    (b) at least two personal information authenticators; or\n    (c) at least:\n    (i) one account information authenticator; and\n    (ii) one personal information authenticator;\n    and must comply with subsection (3).\n    (2) In a case where the high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer’s account as the contact number for the customer – the provider for the telecommunications service must use at least one personal information authenticator, and must comply with subsection (3).\n    Note: Where a high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer’s account as the contact number for the customer, the carriage service provider will have met the requirement in paragraph (3)(b).\n  (3) The carriage service provider for the telecommunications service must use at least one of the following identity authentication processes to confirm that the requesting person is the customer, or is the customer’s authorised representative, for that service:\n\n    (a) subject to subsection (4), confirming the requesting person has direct and immediate access to the telecommunications service; or\n\n    Examples:\n    (a) for a public mobile telecommunications service in a retail environment– personnel representing the carriage service provider call the mobile service number listed on the customer’s account while in store and verify that the call has been received by the customer’s mobile device used in association with that number while the customer is instore.\n    (b) in an online environment– personnel representing the carriage service provider receiving confirmation that the customer has received a unique verification code or secure hyperlink.\n\n    (b) subject to subsection (4), confirming the requesting person has direct and immediate access to the public number listed on the customer’s account as the contact number for the customer; or\n\n    Example: For a telecommunications service in a call centre environment, personnel representing the carriage service provider calling back the public number listed on the customer’s account to confirm that the requesting person has access to the service used in association with that public number.\n\n    (c) use of a unique verification code or secure hyperlink:\n\n    (i) which is sent to the customer, or the customer’s authorised representative as the case may be (the relevant person), by the carriage service provider:\n\n    (A) by SMS message to the mobile service number which is listed on the customer’s account as the contact number for the customer; or\n    (B) by email to an email address that has been validated by the relevant person; or\n    (C) by an in-app message to a carriage service provider’s mobile application that has been validated by the relevant person; or\n    (D) to some other device or account which has been validated by the relevant person; and\n\n    (ii) which includes in the message in which the unique verification code or secure hyperlink is sent, a clear statement informing the relevant person:\n\n    (A) that a high-risk customer interaction has been initiated in relation to the customer’s telecommunications service;\n    (B) that the code or secure hyperlink should not be shared with any other party except the carriage service provider if the relevant person has initiated the high-risk customer interaction; and\n    (C) what the relevant person can do if they did not initiate the high-risk customer interaction; and\n\n    (iii) after the receipt of which by the relevant person, the carriage service provider receives immediate confirmation from the relevant person that the relevant person has received the unique verification code or secure hyperlink; or\n\n    (d) use of one or more forms of biometric data; or\n\n    (e) using a category A document via the process described in Schedule 1; or\n\n    (f) use of a cryptographic key.\n\n    (4) When an identity authentication process used to comply with either paragraph (3)(a) or paragraph 3(b) includes the use of a unique verification code or secure hyperlink, the carriage service provider must also comply with paragraph (3)(c).\n  (5) If, in response to a message sent for the purposes of paragraph (3)(c), the relevant person takes the action referred to in sub-subparagraph (3)(c)(ii)(C):\n  (a) where one or more high-risk customer transactions have already been completed by the carriage service provider – the provider must:\n  (i) take steps to immediately reverse or remediate any completed transaction;\n  (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and\n  (iii) notify the relevant person of what they can do to protect the customer’s account; and\n  (b) where a high-risk customer transaction has not yet been undertaken by the carriage service provider – the provider must not undertake a high-risk customer transaction and must:\n  (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and\n  (ii) notify the relevant person of what they can do to protect the customer’s account.\n  (6) A carriage service provider may attempt an identity authentication process under subsections (1), (2) and (3) more than once during a high-risk customer interaction.","sortOrder":8},{"sectionNumber":"10","sectionType":"section","heading":"Additional Multi-factor Authentication Requirements","content":"#### 10 Additional Multi-factor Authentication Requirements\n\n  (1) This section applies if:\n  (a) a high-risk customer interaction is initiated; and\n  (b) the carriage service provider has taken reasonable steps to use an identity authentication process at subsection 9(3) but has not been able to confirm that the requesting person is the customer, or the customer’s authorised representative, for the service.\n  (2) An employee or agent of the carriage service provider for the telecommunications service, who has completed fraud mitigation training, must use at least one of the following identity authentication processes to confirm that the requesting person is the customer, or the customer’s authorised representative, for that service:\n\n(a) using category A documents and/or category B documents via the process described in Schedule 1; or\n\n(b) using a government online document verification service; or\n\n(c) using a government-accredited digital identity service.\n\n  (3) The carriage service provider is only taken to have confirmed that the requesting person is the customer, or the customer’s authorised representative, in accordance with paragraph (2)(b) if:\n\n(a) the requesting person gives the provider:\n\n(i) the identifying number of at least two unique government documents;\n\n(ii) information identifying the State or Territory that issued the government documents, or confirming that the government document was issued by the Commonwealth; and\n\n(iii) if required by the government online document verification service – any dates or other information recorded on the government documents; and\n\n(b) the information given in relation to each of two government documents is verified on a government online document verification service.\n\nNote: The information provided by the requesting person in relation to a government document is matched against the databases held by the agency that issued the document and is either accepted or rejected as matched or not.\n\n  (4) The carriage service provider is only taken to have confirmed that the requesting person is the customer, or the customer’s authorised representative, in accordance with paragraph (2)(c) if:\n\n(a) the requesting person gives the provider:\n\n(i) the identifying number of at least two unique government documents;\n\n(ii) information identifying the State or Territory that issued the government documents, or confirming that the government document was issued by the Commonwealth; and\n\n(iii) if required by the government online document verification service – any dates or other information recorded on the government documents; and\n\n(b) the information given in relation to each of two government documents is verified on a government-accredited digital identity service.\n\nNote: The information provided by the requesting person in relation to a government document is matched against the databases held by the agency that issued the document and is either accepted or rejected as matched or not.\n\n  (5) When the identity authentication process in this section is used, the carriage service provider must, immediately after it has used an identity authentication process for subsection (2), and, either prior to, or immediately after, undertaking the first high-risk customer transaction, send a notification to the customer, or to the customer’s authorised representative as the case may be (the relevant person):\n\n(a) by SMS message to the mobile service number which is listed on the customer’s account as the contact number for the customer; or\n\n(b) by email to an email address that has been validated by the relevant person; or\n\n(c) by an in-app message to a carriage service provider’s mobile application that has been validated by the relevant person; or\n\n(d) to some other device or account which has been validated by the relevant person;\n\nwhich informs the relevant person:\n\n(e) that a high-risk customer interaction has been initiated; and\n\n(f) what the relevant person can do if they did not authorise the interaction.\n\n  (6) The requirement in subsection (5) does not apply where there is no mobile service number, validated email address, validated mobile application or other validated device or account associated with the customer’s account.\n  (7) The requirement in subsection (5) does not apply where:\n  (a) the carriage service provider has reasonable grounds to believe that the customer is affected by domestic or family violence; and\n  (b) the customer has requested that the notification not be sent.\n  (8) If, in response to a notification sent for the purposes of subsection (5), a relevant person takes the action referred to in paragraph (5)(f):\n  (a) where one or more high-risk customer transactions have already been completed by the carriage service provider – the provider must:\n  (i) take steps to immediately reverse or remediate any completed transaction;\n  (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and\n  (iii) notify the relevant person of what they can do to protect the customer’s account; and\n  (b) where a high-risk customer transaction has not yet been undertaken by the carriage service provider – the provider must not undertake a high-risk customer transaction and must:\n  (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and\n  (ii) notify the relevant person of what they can do to protect the customer’s account.","sortOrder":9},{"sectionNumber":"11","sectionType":"section","heading":"Identity authentication requirements for people in vulnerable circumstances","content":"#### 11 Identity authentication requirements for people in vulnerable circumstances\n\n  (1) This section applies if:\n\n(a) a high-risk customer interaction is initiated; and\n\n(b) an employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training, has reasonable grounds to believe that the requesting person is a person in vulnerable circumstances.\n\n  (2) An employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training, must use the following identity authentication processes to confirm that the requesting person is the customer, or the customer’s authorised representative, for that service:\n    (a) at least two account information authenticators; or\n    (b) at least two personal information authenticators; or\n    (c) at least:\n    (i) one account information authenticator; and\n    (ii) one personal information authenticator.\n  (3) If a carriage service provider completes one or more high-risk customer transactions under this section the provider must keep a record of the details of the high-risk customer interaction including:\n  (a) the identity authentication process used for the purposes of subsection (2);\n  (b) the basis on which the employee or agent of the provider reasonably believed that the requesting person was a person in vulnerable circumstances; and\n  (c) any material or supporting evidence that was provided by the requesting person.\n  (4) When the identity authentication processes in this section are used, the carriage service provider must, immediately after it has used an identity authentication process for subsection (2), and either prior to, or immediately after, undertaking the first high-risk customer transaction, send a notification to the customer, or the customer’s authorised representative as the case may be (the relevant person):\n\n(a) by SMS message to the mobile service number which is listed on the customer’s account as the contact number for the customer; or\n\n(b) by email to an email address that has been validated by the relevant person; or\n\n(c) by an in-app message to a carriage service provider’s mobile application that has been validated by the relevant person; or\n\n(d) to some other device or account which has been validated by the relevant person;\n\nwhich informs the relevant person:\n\n(e) that a high-risk customer interaction has been initiated; and\n\n(f) what the relevant person can do if they did not authorise the interaction.\n\n  (5) The requirement in subsection (4) does not apply where there is no mobile service number, validated email address, validated mobile application or other validated device or account associated with the customer’s account.\n  (6) The requirement in subsection (4) does not apply where:\n  (a) the carriage service provider has reasonable grounds to believe that the customer is affected by domestic or family violence; and\n  (b) the customer has requested that the notification not be sent.\n  (7) If, in response to a notification sent for the purposes of subsection 4, a relevant person takes the action referred to in paragraph (4)(f):\n  (a) where one or more high-risk customer transactions have already been completed by the carriage service provider – the provider must:\n  (i) take steps to immediately reverse or remediate any completed transaction;\n  (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and\n  (iii) notify the relevant person of what they can do to protect the customer’s account; and\n  (b) where a high-risk customer transaction has not yet been undertaken by the carriage service provider – the provider must not undertake a high-risk customer transaction and must:\n  (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and\n  (ii) notify the relevant person of what they can do to protect the customer’s account.\n\nPart 3—Requirements for unlisted authorised representatives","sortOrder":10},{"sectionNumber":"12","sectionType":"section","heading":"Requirements where an unlisted authorised representative initiates a high-risk customer interaction","content":"#### 12 Requirements where an unlisted authorised representative initiates a high-risk customer interaction\n\n  (1) This section applies if:\n\n(a) a high-risk customer interaction is initiated; and\n\n(b) the requesting person asserts that they are an unlisted authorised representative in relation to the telecommunications service.\n\n(2) Prior to undertaking the first high-risk customer transaction in the course of a high-risk customer interaction, an employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training must be satisfied that the requesting person is an unlisted authorised representative on the basis of documentary evidence (such as an enduring power of attorney or a financial management order) provided by the requesting person.\n\n  (3) If a carriage service provider completes one or more high-risk customer transactions under this section the provider must keep a record of the details of the transaction including:\n  (a) the basis on which the employee or agent of the provider was satisfied that the requesting person is an unlisted authorised representative; and\n  (b) any material or supporting evidence that was provided by the requesting person.\n  (4) If a carriage service provider completes, or is intending to complete, one or more high-risk customer transactions under this section, either prior to, or immediately after, undertaking the first high-risk customer transaction, the provider must send a notification to the customer, or the customer’s authorised representative (the relevant person):\n\n(a) by SMS message to the mobile service number which is listed on the customer’s account as the contact number for the customer; or\n\n(b) by email to an email address that has been validated by the relevant person; or\n\n(c) by an in-app message to a carriage service provider’s mobile application that has been validated by the relevant person; or\n\n(d) to some other device or account which has been validated by the relevant person;\n\nwhich informs the relevant person:\n\n(e) that a high-risk customer interaction has been initiated; and\n\n(f) what the relevant person can do if they did not authorise the transaction.\n\n  (5) The requirement in subsection (4) does not apply where there is no mobile service number, validated email address, validated mobile application or other validated device or account associated with the customer’s account.\n  (6) The requirement in subsection (4) does not apply where:\n  (a) the carriage service provider has reasonable grounds to believe that the customer is affected by domestic or family violence; and\n  (b) the customer has requested that the notification not be sent.\n  (7) If, in response to a notification sent for the purposes of subsection (4), a relevant person takes the action referred to in paragraph (4)(f):\n  (a) an employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training must investigate the basis on which the satisfaction required by subsection (2) was attained; and\n  (b) if the employee or agent is satisfied that there has been fraudulent activity in relation to the high-risk customer interaction,\n  then:\n  (c) if one or more high-risk customer transactions have already been completed by the carriage service provider, the provider must:\n  (i) take steps to immediately reverse or remediate any completed transaction;\n  (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and\n  (iii) notify the relevant person of what they can do to protect the customer’s account; or\n  (d) if a high-risk customer transaction has not yet been undertaken by the carriage service provider, the provider must not undertake a high-risk customer transaction and must:\n  (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and\n  (ii) notify the relevant person of what they can do to protect the customer’s account.\n\nPart 4—Additional protections requirements","sortOrder":11},{"sectionNumber":"13","sectionType":"section","heading":"Requirements to provide fraud mitigation protections","content":"#### 13 Requirements to provide fraud mitigation protections\n\n  (1) A carriage service provider must:\n  (a) have systems in place to identify customers of the carriage service provider who are at risk of fraud in relation to their telecommunications service; and\n  (b) provide those customers with fraud mitigation protections.\n  (2) A carriage service provider must, in response to a reasonable request made by a customer of the carriage service provider who believes they are at risk of fraud in relation to their telecommunications services, offer the customer fraud mitigation protections.\n  (3) In subsections (1) and (2), fraud mitigation protections means additional or tailored measures taken by a carriage service provider which are designed to prevent fraud in relation to the customer’s telecommunications service and which may include:\n  (a) notifying a customer of suspected fraudulent activity;\n  (b) “flagging” the customer’s account as at risk of fraud;\n  (c) using multi-factor authentication in particular sale channels;\n  (d) pausing certain high-risk customer transactions on a customer’s account; or\n  (e) sending notifications to a customer’s authorised representative.\n\nPart 5—General matters\n\n14 Minimum requirements to publish advice about customer awareness and safeguard information\n\nA carriage service provider must publish information on its website advising customers that:\n\n(a) to protect customers from unauthorised high-risk customer interactions, identity authentication processes will be used to authenticate the identity of the requesting person, prior to the undertaking of a high-risk customer transaction; and\n\n(b) in the event a customer suspects that their telecommunications service or account has been subject to fraud they should immediately report the activity to:\n\n(i) their carriage service provider; and\n\n(ii) their financial services provider.\n\n15 Requirement not to charge a fee for a message or notification\n\nA carriage service provider must not charge a fee to a customer, or a customer’s authorised representative, for:\n\n    (a) a message sent for the purposes of paragraph 9(3)(c);\n\n    (b) a notification sent under subsection 10(5);\n\n    (c) a notification sent under subsection 11(4);\n\n    (d) a notification sent under subsection 12(4); or\n\n    (e) taking an action described in section 13,\n\nexcept where a customer, or a customer’s authorised representative, uses a telecommunications service to initiate a high-risk customer interaction that is not associated with the customer’s account.\n\nPart 6—Record-keeping","sortOrder":12},{"sectionNumber":"16","sectionType":"section","heading":"Requirement to keep records","content":"#### 16 Requirement to keep records\n\n    A carriage service provider must:\n    (a) keep records that are sufficient to demonstrate its compliance with the requirements in Parts 2, 3, 4 and 5 of this determination; and\n    (b) retain the records required to be kept by paragraph (a), subsection 11(3) and subsection 12(3) for a minimum of one year.","sortOrder":13}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its original intent. It establishes customer identity authentication requirements for telecommunications providers, which aligns with the document's stated objectives in section 5 (reducing harm from unauthorised access and requiring effective identity authentication). The scope remains focused on high-risk customer interactions and does not appear to have expanded beyond this core consumer protection purpose."},"complexity_factors":["47 defined terms in section 6, including nested definitions (e.g., 'person in vulnerable circumstances' has 3 sub-elements with cross-references to other defined terms)","Multiple conditional pathways for identity authentication: standard multi-factor (section 9), escalated verification (section 10), vulnerable circumstances (section 11), and unlisted representatives (section 12)","Extensive cross-referencing to external instruments: Telecommunications Act 1997, Defence Act 1903, Telecommunications Numbering Plan 2015, and Telecommunications (Mobile Number Pre-Porting Identity Verification) Industry Standard 2020","Nested exceptions within exceptions in the definition of 'high-risk customer transaction' (paragraphs 6(f), (g), (h) with multiple sub-sub-paragraphs)","Duplicated notification and remediation requirements across sections 9, 10, 11, and 12 with slight variations","Schedule 1 referenced but not included in the provided text (external document dependency for Category A and B documents)","Conditional logic requiring fraud mitigation training for staff in multiple sections (10, 11, 12)","Complex application clause (section 4) with both inclusive and exclusive conditions"],"plain_english_summary":"This law requires phone and internet providers to verify your identity before making high‑risk account changes, aiming to stop SIM‑swap and identity‑theft scams. It protects individual and small business customers by mandating multi‑factor checks (at least two different methods) and special measures for vulnerable customers or verified representatives, while exempting large corporate accounts with bespoke arrangements. The result: stronger fraud prevention and clearer obligations on carriers to confirm who they’re dealing with."},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":false,"description":"This determination implements identity-authentication requirements under subsection 99(1) of the Telecommunications Act 1997 to reduce unauthorised access and fraud in relation to high‑risk customer transactions (s 3, s 5). Its provisions stay within that technical purpose: prescribing how CSPs must confirm identity, provide notifications, train staff and keep records. It does not substantially expand the statutory subject matter beyond authentication and fraud mitigation (no new regulatory domains, tax powers, or broad licensing changes). Therefore it has not grown significantly beyond its original, instrument‑authorised purpose."},"complexity_factors":["Extensive definitions section with over 40 defined terms (Part 1, s 6)","Layered conditional logic across Parts 2–3: different authentication rules depending on who initiates interaction, whether initial checks fail, vulnerable status, or unlisted authorised representative (ss 8–12)","Multiple authentication methods allowed (biometrics, cryptographic keys, verified documents, secure links, direct access checks) each with different procedural requirements (s 9(3), s 10)","Cross-references to external instruments and standards (Telecommunications Act 1997, Telecommunications Numbering Plan 2015, Defence Act 1903, and Mobile Number Pre-Porting Industry Standard) increasing interpretive dependencies (ss 3, 6, notes)","Exceptions and carve-outs (account-managed/integrated customers, domestic/family violence exceptions, porting exclusion) adding conditional branches (s 4; s 6 exclusions; ss 10(7), 11(6), 12(6))","Training and record-keeping obligations tied to specific operational steps (fraud mitigation training requirement; record retention minimums in s 16; ss 11(3),12(3))","References to Schedules (Schedule 1 and Schedule 5) for document lists and numbering that are necessary to apply the rules but are external to the main text","Notification timing requirements and the ‘immediate’ confirmation/response expectations create operational timing constraints (ss 9(3)(c)(iii), 10(5), 11(4), 12(4))"],"plain_english_summary":"**What this instrument does (mechanics)**\n\n- Establishes mandatory identity-authentication rules that carriage service providers (CSPs) must follow before carrying out any “high-risk customer transaction” on a customer’s telecommunications service (see ss 4, 5, 8 and definition of high-risk customer transaction in s 6).\n- Applies to CSPs when dealing with customers who are ordinary consumers or small/non-negotiating businesses (the statutory definition of “customer”) but excludes \"account managed\" and \"integrated\" customers (s 4 and definitions in s 6).\n- Sets layered authentication requirements depending on who starts the interaction and the customer’s circumstances:\n  - If the requesting person starts the interaction: the CSP must use multi-factor authentication (two account authenticators, or two personal authenticators, or one of each) and one of several specific confirmation methods (s 9(1),(3)).\n  - If the CSP calls a customer on the public number on file: at least one personal-information authenticator is required, plus one confirmation method (s 9(2),(3)).\n  - If earlier checks fail, specially trained staff must use stronger verification (government online document verification, government-accredited digital identity, or category A/B documents) (s 10).\n  - Where the requesting person appears to be in vulnerable circumstances, specially trained staff must apply a defined multi-factor combination and keep extra records (s 11).\n  - If the requester claims to be an unlisted authorised representative (e.g. enduring power of attorney) specially trained staff must be satisfied by documentary evidence before any high-risk transaction and must record and notify as required (s 12).\n- Lists specific ways to confirm identity: direct access to the service or public number, unique verification code/secure hyperlink (SMS, validated email, in‑app), biometrics, category A documents (see Schedule 1), or cryptographic keys (s 9(3)).\n- Requires CSPs to notify customers (by validated SMS, email, in‑app message or other validated account) when certain stronger authentication paths are used and to provide instructions on what to do if the interaction was unauthorised (ss 9(5), 10(5), 11(4), 12(4)). There are carve-outs for situations where notifications would risk further harm (domestic/family violence) or where no validated contact exists (ss 10(6)–(7), 11(5)–(6), 12(5)–(6)).\n- CSPs must offer and implement fraud‑mitigation protections for customers at risk and keep systems to identify such customers (s 13).\n- CSPs must publish customer‑awareness advice on their websites and must not charge customers for the messages/notifications required by the determination (ss 14–15).\n- CSPs must keep sufficient records to show compliance and retain specified records for at least one year (s 16).\n\n**Who this affects**\n\n- Primarily retail customers (individuals and small non‑negotiating businesses as defined in s 6) of carriage service providers supplying telephone, mobile or internet services (s 6 definition of telecommunications service).\n- Carriage service providers (telecom companies and resellers) — they must change processes, train staff, integrate technical solutions (SMS, email validation, in‑app messaging, biometric or cryptographic checks), and keep records (ss 8–16).\n- Third‑party identity services — government online document verification and government‑accredited digital identity services are explicitly referenced as acceptable verification channels (ss 10(2)(b),(c), 10(3)–(4)).\n\n**Why it matters (stated objective and practical effects)**\n\n- The stated objectives are to reduce harm from unauthorised access to customer accounts and require CSPs to follow effective identity authentication for high‑risk interactions (s 5).\n- Mechanically, the instrument raises the minimum standard of identity checks before CSPs can perform actions that could cut service, disclose account data, change authorised representatives, or impose large charges (definition of high‑risk customer transaction, s 6). That changes CSP operational decisions (who is allowed to do what and when).\n\n**Costs, incentives and trade-offs (implementation and behavioural effects)**\n\n- Who pays: CSPs bear the direct compliance costs — implementing multi‑factor flows, integrating with government verification services, training staff in fraud mitigation, maintaining recording and notification systems (ss 9–13, 16). Those costs may be passed to customers indirectly via prices or service changes.\n- Operational impact: CSPs will need more time and system checks for high‑risk requests (call‑centre flows, in‑store verification, secure links), which increases handling time per interaction and may change sales or support workflows (s 9 examples and s 13(c)).\n- Smaller providers and resellers may face proportionally higher compliance burden than large vertically integrated operators because of fixed costs (integration, training, audits). The instrument partially narrows scope by excluding account‑managed and integrated customers (s 4, definitions) which reduces burden for large enterprise contracts.\n- Notification rules (ss 9(5), 10(5), 11(4), 12(4)) shift some monitoring burden to customers: customers receive alerts they cannot be charged for (s 15). Where customers have no validated contact points, CSPs are not required to notify (ss 10(6), 11(5), 12(5)).\n- Privacy and data handling: verification steps may require collection and transient storage of government document identifiers, biometric data or cryptographic keys (ss 9(3)(d),(e),(f); ss 10(3)–(4)). The determination does not itself set security‑of‑storage standards; CSPs must balance verification needs against privacy and data‑security obligations under other laws.\n- Fraud‑prevention vs friction trade‑off: higher verification will reduce some fraud vectors (e.g. SIM swap) but also increases false rejections and friction for legitimate customers, particularly those in vulnerable circumstances or customers overseas (definition of person in vulnerable circumstances, s 6; ss 11 and 9 guidance). The instrument requires special handling and record‑keeping for vulnerable customers (s 11(2)–(4)), but also allows tailored protections (s 13).\n- Market effects: the instrument creates demand for government‑accredited digital identity and document‑verification services, and potentially for third‑party providers of cryptographic key or biometric checks. That is an indirect commercial opportunity but may concentrate demand on certified providers (ss 9(3)(e), 10(2)(b),(c)).\n\n**Implementation risks and compliance complexity**\n\n- CSPs must train staff in fraud mitigation (s 6 definition; ss 10(2), 11(1), 12(2)) and maintain auditable records for at least one year (s 16), which creates operational and audit risk.\n- Multiple conditional rules: different authentication paths apply depending on who initiates the interaction, whether prior checks succeeded, whether the customer is in vulnerable circumstances, or whether the requester is an unlisted authorised representative (ss 8–12). Misapplication could lead to unlawful disclosures or service denials.\n- Carve‑outs and exceptions (e.g. transfers of title in domestic/family violence cases, porting governed by a separate industry standard) mean CSPs must coordinate compliance with other instruments (definition exclusions in s 6; note about Mobile Number Pre‑Porting standard in s 6 Note 2).\n\n**Concrete behavioural changes required (who decides and what changes)**\n\n- CSPs must decide which authentication methods to implement, define what counts as a validated contact point, configure notification templates and thresholds for “large one‑off charge”, and set up exception procedures for domestic/family violence and vulnerable customers (ss 6, 9, 10, 11, 13).\n- Customers may be required to maintain validated contact points (validated email, in‑app account, or mobile number) to avoid service friction and receive notifications (s 9(3)(c), notes in s 6).\n\n**Reference to specific provisions**\n\n- Scope and exclusions: s 4; definitions in s 6.\n- Authentication options and multi‑factor rules: s 9 (and s 9(3) list).\n- Escalated verification (govt verification services/documents): s 10(2)–(4).\n- Vulnerable customers and unlisted authorised representatives: ss 11 and 12 (training and record requirements: ss 11(3), 12(3)).\n- Fraud mitigation, publication and no‑fee rules: ss 13–15.\n- Record keeping: s 16.\n\n(Technical note: the instrument relies on Schedules and other instruments—Schedule 1 for category A/B documents and external instruments such as the Telecommunications Act 1997, Telecommunications Numbering Plan 2015, Defence Act 1903, and the Telecommunications (Mobile Number Pre‑Porting Identity Verification) Industry Standard 2020—for definitions and cross‑checks.)"},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022","history":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022/history","analysis":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022/analysis","conflicts":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022/conflicts","importantCases":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022/important-cases","documents":"/api/acts/telecommunications-service-provider-customer-identity-authentication-determination-2022/documents"}}