Document ID: chunk:federal_register_of_legislation:F2022L00548:reg:9:p1
Version: federal_register_of_legislation:F2022L00548
Segment Type: reg
Provision Reference: reg 9 (pt 1/3)
Character Range: 20306–23581

9  Multi-factor Authentication Requirements
        (1)           In a case where the high-risk customer interaction is initiated by the requesting person – a carriage service provider for the telecommunications service must use one of the following identity authentication processes:
            (a) at least two account information authenticators; or
            (b) at least two personal information authenticators; or
            (c) at least:
              (i) one account information authenticator; and
              (ii) one personal information authenticator;

        and must comply with subsection (3).

        (2)           In a case where the high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer's account as the contact number for the customer – the provider for the telecommunications service must use at least one personal information authenticator, and must comply with subsection (3).

            Note: Where a high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer's account as the contact number for the customer, the carriage service provider will have met the requirement in paragraph (3)(b).
        (3) The carriage service provider for the telecommunications service must use at least one of the following identity authentication processes to confirm that the requesting person is the customer, or is the customer's authorised representative, for that service:
            (a) subject to subsection (4), confirming the requesting person has direct and immediate access to the telecommunications service; or
            Examples:
              (a)     for a public mobile telecommunications service in a retail environment– personnel representing the carriage service provider call the mobile service number listed on the customer's account while in store and verify that the call has been received by the customer's mobile device used in association with that number while the customer is instore.
              (b)     in an online environment– personnel representing the carriage service provider receiving confirmation that the customer has received a unique verification code or secure hyperlink.
            (b) subject to subsection (4), confirming the requesting person has direct and immediate access to the public number listed on the customer's account as the contact number for the customer; or
                Example: For a telecommunications service in a call centre environment, personnel representing the carriage service provider calling back the public number listed on the customer's account to confirm that the requesting person has access to the service used in association with that public number.
            (c) use of a unique verification code or secure hyperlink:
                (i) which is sent to the customer, or the customer's authorised representative as the case may be (the relevant person), by the carriage service provider:
                   (A)         by SMS message to the mobile service number which is listed on the customer's account as the contact number for the customer; or
                   (B)         by email to an email address that has been validated by