10Additional Multi-factor Authentication Requirements

10 Additional Multi-factor Authentication Requirements

(1) This section applies if: (a) a high-risk customer interaction is initiated; and (b) the carriage service provider has taken reasonable steps to use an identity authentication process at subsection 9(3) but has not been able to confirm that the requesting person is the customer, or the customer’s authorised representative, for the service. (2) An employee or agent of the carriage service provider for the telecommunications service, who has completed fraud mitigation training, must use at least one of the following identity authentication processes to confirm that the requesting person is the customer, or the customer’s authorised representative, for that service:

(a) using category A documents and/or category B documents via the process described in Schedule 1; or

(b) using a government online document verification service; or

(c) using a government-accredited digital identity service.

(3) The carriage service provider is only taken to have confirmed that the requesting person is the customer, or the customer’s authorised representative, in accordance with paragraph (2)(b) if:

(a) the requesting person gives the provider:

(i) the identifying number of at least two unique government documents;

(ii) information identifying the State or Territory that issued the government documents, or confirming that the government document was issued by the Commonwealth; and

(iii) if required by the government online document verification service – any dates or other information recorded on the government documents; and

(b) the information given in relation to each of two government documents is verified on a government online document verification service.

Note: The information provided by the requesting person in relation to a government document is matched against the databases held by the agency that issued the document and is either accepted or rejected as matched or not.

(4) The carriage service provider is only taken to have confirmed that the requesting person is the customer, or the customer’s authorised representative, in accordance with paragraph (2)(c) if:

(a) the requesting person gives the provider:

(i) the identifying number of at least two unique government documents;

(ii) information identifying the State or Territory that issued the government documents, or confirming that the government document was issued by the Commonwealth; and

(iii) if required by the government online document verification service – any dates or other information recorded on the government documents; and

(b) the information given in relation to each of two government documents is verified on a government-accredited digital identity service.