Document ID: chunk:federal_register_of_legislation:F2022L00548:reg:10:p2
Version: federal_register_of_legislation:F2022L00548
Segment Type: reg
Provision Reference: reg 10 (pt 2/3)
Character Range: 29535–32436

person in relation to a government document is matched against the databases held by the agency that issued the document and is either accepted or rejected as matched or not.
        (5) When the identity authentication process in this section is used, the carriage service provider must, immediately after it has used an identity authentication process for subsection (2), and, either prior to, or immediately after, undertaking the first high-risk customer transaction, send a notification to the customer, or to the customer's authorised representative as the case may be (the relevant person):
            (a) by SMS message to the mobile service number which is listed on the customer's account as the contact number for the customer; or
            (b) by email to an email address that has been validated by the relevant person; or
            (c) by an in-app message to a carriage service provider's mobile application that has been validated by the relevant person; or
            (d) to some other device or account which has been validated by the relevant person;
           which informs the relevant person:
            (e) that a high-risk customer interaction has been initiated; and
            (f) what the relevant person can do if they did not authorise the interaction.
        (6) The requirement in subsection (5) does not apply where there is no mobile service number, validated email address, validated mobile application or other validated device or account associated with the customer's account.
        (7)           The requirement in subsection (5) does not apply where:
            (a)           the carriage service provider has reasonable grounds to believe that the customer is affected by domestic or family violence; and
            (b)           the customer has requested that the notification not be sent.
        (8) If, in response to a notification sent for the purposes of subsection (5), a relevant person takes the action referred to in paragraph (5)(f):
            (a) where one or more high-risk customer transactions have already been completed by the carriage service provider – the provider must:
              (i) take steps to immediately reverse or remediate any completed transaction;
              (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and
              (iii) notify the relevant person of what they can do to protect the customer's account; and
            (b) where a high-risk customer transaction has not yet been undertaken by the carriage service provider – the provider must not undertake a high-risk customer transaction and must:
              (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and
              (ii) notify the relevant person of what they can do to protect the customer's account.