13Requirements to provide fraud mitigation protections

13 Requirements to provide fraud mitigation protections

(1) A carriage service provider must: (a) have systems in place to identify customers of the carriage service provider who are at risk of fraud in relation to their telecommunications service; and (b) provide those customers with fraud mitigation protections. (2) A carriage service provider must, in response to a reasonable request made by a customer of the carriage service provider who believes they are at risk of fraud in relation to their telecommunications services, offer the customer fraud mitigation protections. (3) In subsections (1) and (2), fraud mitigation protections means additional or tailored measures taken by a carriage service provider which are designed to prevent fraud in relation to the customer’s telecommunications service and which may include: (a) notifying a customer of suspected fraudulent activity; (b) “flagging” the customer’s account as at risk of fraud; (c) using multi-factor authentication in particular sale channels; (d) pausing certain high-risk customer transactions on a customer’s account; or (e) sending notifications to a customer’s authorised representative.

Part 5—General matters

14 Minimum requirements to publish advice about customer awareness and safeguard information

A carriage service provider must publish information on its website advising customers that:

(a) to protect customers from unauthorised high-risk customer interactions, identity authentication processes will be used to authenticate the identity of the requesting person, prior to the undertaking of a high-risk customer transaction; and

(b) in the event a customer suspects that their telecommunications service or account has been subject to fraud they should immediately report the activity to:

(i) their carriage service provider; and

(ii) their financial services provider.

15 Requirement not to charge a fee for a message or notification

A carriage service provider must not charge a fee to a customer, or a customer’s authorised representative, for:

(a) a message sent for the purposes of paragraph 9(3)(c);

(b) a notification sent under subsection 10(5);

(c) a notification sent under subsection 11(4);

(d) a notification sent under subsection 12(4); or

(e) taking an action described in section 13,

except where a customer, or a customer’s authorised representative, uses a telecommunications service to initiate a high-risk customer interaction that is not associated with the customer’s account.

Part 6—Record-keeping