Document ID: chunk:federal_register_of_legislation:F2022L00548:reg:11:p1
Version: federal_register_of_legislation:F2022L00548
Segment Type: reg
Provision Reference: reg 11 (pt 1/2)
Character Range: 32438–35755

11  Identity authentication requirements for people in vulnerable circumstances
        (1)           This section applies if:
            (a)           a high-risk customer interaction is initiated; and
            (b)           an employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training, has reasonable grounds to believe that the requesting person is a person in vulnerable circumstances.
        (2)           An employee or agent of the carriage service provider for the telecommunications service who has completed fraud mitigation training, must use the following identity authentication processes to confirm that the requesting person is the customer, or the customer's authorised representative, for that service:
            (a) at least two account information authenticators; or
            (b) at least two personal information authenticators; or
            (c) at least:
              (i) one account information authenticator; and
              (ii) one personal information authenticator.

        (3) If a carriage service provider completes one or more high-risk customer transactions under this section the provider must keep a record of the details of the high-risk customer interaction including:
            (a) the identity authentication process used for the purposes of subsection (2);
            (b) the basis on which the employee or agent of the provider reasonably believed that the requesting person was a person in vulnerable circumstances; and
            (c)  any material or supporting evidence that was provided by the requesting person.
        (4) When the identity authentication processes in this section are used, the carriage service provider must, immediately after it has used an identity authentication process for subsection (2), and either prior to, or immediately after, undertaking the first high-risk customer transaction, send a notification to the customer, or the customer's authorised representative as the case may be (the relevant person):
            (a) by SMS message to the mobile service number which is listed on the customer's account as the contact number for the customer; or
            (b) by email to an email address that has been validated by the relevant person; or
            (c) by an in-app message to a carriage service provider's mobile application that has been validated by the relevant person; or
            (d) to some other device or account which has been validated by the relevant person;
        which informs the relevant person:
            (e) that a high-risk customer interaction has been initiated; and
            (f) what the relevant person can do if they did not authorise the interaction.
        (5)           The requirement in subsection (4) does not apply where there is no mobile service number, validated email address, validated mobile application or other validated device or account associated with the customer's account.
        (6)           The requirement in subsection (4) does not apply where:
            (a)           the carriage service provider has reasonable grounds to believe that the customer is affected by domestic or family violence; and
            (b)           the customer has requested that the notification not