Document ID: chunk:federal_register_of_legislation:F2022L00548:reg:9:p2
Version: federal_register_of_legislation:F2022L00548
Segment Type: reg
Provision Reference: reg 9 (pt 2/3)
Character Range: 23304–26484

the carriage service provider:
                   (A)         by SMS message to the mobile service number which is listed on the customer's account as the contact number for the customer; or
                   (B)         by email to an email address that has been validated by the relevant person; or
                   (C)         by an in-app message to a carriage service provider's mobile application that has been validated by the relevant person; or
                   (D)         to some other device or account which has been validated by the relevant person; and
                (ii) which includes in the message in which the unique verification code or secure hyperlink is sent, a clear statement informing the relevant person:
                   (A)         that a high-risk customer interaction has been initiated in relation to the customer's telecommunications service;
                   (B)         that the code or secure hyperlink should not be shared with any other party except the carriage service provider if the relevant person has initiated the high-risk customer interaction; and
                   (C)         what the relevant person can do if they did not initiate the high-risk customer interaction; and
                (iii) after the receipt of which by the relevant person, the carriage service provider receives immediate confirmation from the relevant person that the relevant person has received the unique verification code or secure hyperlink; or
            (d) use of one or more forms of biometric data; or
            (e) using a category A document via the process described in Schedule 1; or
            (f) use of a cryptographic key.

        (4) When an identity authentication process used to comply with either paragraph (3)(a) or paragraph 3(b) includes the use of a unique verification code or secure hyperlink, the carriage service provider must also comply with paragraph (3)(c).
        (5) If, in response to a message sent for the purposes of paragraph (3)(c), the relevant person takes the action referred to in sub-subparagraph (3)(c)(ii)(C):
            (a) where one or more high-risk customer transactions have already been completed by the carriage service provider – the provider must:
              (i) take steps to immediately reverse or remediate any completed transaction;
              (ii) notify the relevant person of steps taken by the carriage service provider under subparagraph (i); and
              (iii) notify the relevant person of what they can do to protect the customer's account; and
            (b) where a high-risk customer transaction has not yet been undertaken by the carriage service provider – the provider must not undertake a high-risk customer transaction and must:
              (i) notify the relevant person that the carriage service provider has not undertaken the high-risk customer transaction; and
              (ii) notify the relevant person of what they can do to protect the customer's account.
        (6) A carriage service provider may attempt an identity authentication process under subsections (1), (2) and (3) more than once during a high-risk customer interaction.