Digital ID: Access and Client Verification

Digital ID can help someone prove who they are online or sign in to a service. For your practice, the choice is which client details you must verify, how the check ties those details to the person and what evidence you keep.

What Digital ID Means in Australia

Digital ID in Australia covers several different jobs, so start with the service your client is trying to use.

Service	What it does	What your practice needs from it
Accredited Digital ID	Establishes a reusable digital identity under an accreditation framework	An accepted verification method and enough evidence for the client check
myID	The Australian Government’s Digital ID app for access to participating government services	Keep the client’s government sign-in separate from your identity and authority checks
Commercial identity verification	Checks a person’s supplied details, documents or face for the requesting organisation	A result explaining the checks performed and the information verified
Queensland Digital Licence	Presents Queensland licence credentials digitally	Check the credential using the issuing service’s verification method and your applicable identity requirements

myID and myGov have different jobs. myID is a digital identity app. myGov is an account that connects people to government services. A client signing in to either does not give your practice a complete proof-of-identity record.

The Australian Government’s Digital ID guidance explains how people create and use a Digital ID. Government access can require a particular identity strength and authority to act for an organisation.

For someone asking about digital ID in Queensland, the Queensland Digital Licence is the relevant licence service. It can share selected details through a compatible verifier app. An ordinary camera cannot verify its QR code. Follow the Queensland Government’s business verification instructions, then assess whether the evidence meets the tax-client check.

What Electronic Identity Verification Does

Electronic identity verification checks a client’s details against government or other trusted records without requiring you to sight original documents in person.

The three common building blocks answer different questions.

Check	Question it answers	Limit
Document Verification Service (DVS)	Do the supplied document details match an official record?	It does not compare the person’s face
Liveness and selfie matching	Is a live person present, and does their face match the document photo?	A biometric result still needs the right identity evidence and staff decision
Data-source checks	Do details such as name, birth date or address match independent records?	Coverage and matching quality depend on the source

Credit header data contains identifying details from credit records, rather than an assessment of whether the client can repay a loan. A match can support identity verification. It cannot establish a director’s authority to engage your practice.

Put the check after the client enters their details and before they sign your engagement letter. That is a practical onboarding order. The regulatory checkpoint is that you complete the required verification before providing the relevant service, subject to any applicable exception.

In a fictional example, a remote company director enters their details and photographs their licence. The document details match, but the selfie does not. Staff investigate the mismatch before accepting the identity result, then separately establish the director’s authority to engage the practice.

How a DVS Check Works

A DVS check compares the details on an identity document with government records and returns a match result. The Attorney-General’s Department operates the identity verification services. Driver licence information is accessed through NEVDIS, operated by Austroads on behalf of the states and territories.

IDMatch’s service description lists supported evidence, including driver licences, passports, Medicare cards and birth certificates. Other supported records include citizenship certificates, change-of-name certificates, ImmiCards and visas. A provider’s available document list can be narrower than the DVS list.

For driver licence verification, enter the licence number and the separate card number where required. The card number identifies the issued card. Leaving it out, entering the licence number twice or using details from a replaced card can prevent a match. The government card-number guide explains where to find it.

Capture the client’s express consent before sending the check. IDMatch permits an electronic checkbox, but consent cannot be inferred from an opt-out. The wording must confirm that the person can provide the details and authorises checking them with the issuer or official record holder through third-party systems.

The IDMatch consent guidance also requires information about how details are handled, individual rights, complaints and the consequences of declining. Use the approved collection notice and adapt it to your organisation’s actual handling of information. A generic privacy-policy checkbox does not explain all these matters.

A DVS match establishes that the supplied details match the official record. It cannot prove that the person presenting those details owns the document. Someone using stolen details can still produce a match, which is why the person-to-document check matters.

Liveness Checks and Selfie ID Verification

A liveness check assesses whether a real person is present during capture, rather than a photograph, replayed video or other impersonation attempt. Selfie ID verification compares that person’s face with the photograph on the identity document.

The client usually opens a verification request on their phone, consents to the check and allows camera access. They photograph the requested document, then capture a selfie or short video as instructed. Some services assess liveness in the background. Others ask for an action during capture.

The combination helps address the ownership gap left by a document-data match. It is still a risk check, not a guarantee against fraud. Deepfakes and camera-injection attacks make the provider’s fraud detection and handling of uncertain results part of the buying decision.

Poor lighting, glare or a camera permission setting can interrupt the check. Some older clients and clients with disability or limited digital confidence need help with the capture steps. Offer guidance without taking their passwords or completing a biometric check for them.

When the client cannot complete the check, arrange an accepted alternative. That can include sighting original documents in person or by video, or using certified copies with the necessary person-to-document comparison. Record the method used instead of treating a failed selfie as a completed identity check.

Which Electronic Checks Meet TPB and AML Rules

An electronic check meets the required standard through its evidence and method, not simply because the provider returns a green status.

The Tax Practitioners Board’s proof-of-identity guidance generally accepts electronic methods that satisfy ATO methods or AUSTRAC requirements. This does not prescribe DVS plus selfie as a universal combination. Match the method to the client, the service and the relevant standard.

For a remote individual, document matching plus a supported person-to-document check can supply evidence for your determination. A company or trust also needs evidence of its existence. Verify the representative’s identity and authority separately. See the tax-agent proof-of-identity requirements for those distinctions.

AUSTRAC’s reformed customer due diligence rules apply where your practice provides a regulated designated service. Its initial customer due diligence guidance permits reliable, independent electronic data from third-party identity services. Consider who maintains the data and whether the service is secure. The information verified must support the required matters on reasonable grounds and suit the client’s risk.

Higher risk or inconsistent information can require more evidence. Identity verification is one part of customer due diligence. Beneficial owners, authority, sanctions and politically exposed persons can require separate checks. The KYC guide for accountants explains the wider task.

Keep a contemporaneous record containing the result, provider reference and check date. Add the method, information verified, staff reviewer and decision, with any discrepancy and its resolution. Your practice remains responsible when a provider performs the check. TPB does not require retaining ID copies. AUSTRAC also permits records of the document details instead of scanned copies.

The Digital ID Act framework governs accreditation, participation in the government system and related protections. Accreditation does not automatically establish that your practice has completed its TPB or AML/CTF obligations.

The TPB recognises digital driver licences as photographic evidence. For a digital ID card or an identity in Apple Wallet, establish the issuer, credential type and verification method. A wallet display alone does not tell you which required details were verified. Record the credential and how you checked it. Obtain additional identity or authority evidence where the credential leaves a required matter unresolved.

Identity Verification Companies Compared

Commercial identity verification companies perform checks for organisations. Your client completes the organisation’s request, while myID handles access to participating government services.

The following options differ in how they collect evidence and return results. Their Australian document coverage and your chosen checks decide the fit. A global photo-ID service and a DVS data match answer different parts of the identity question.

Service	Methods and document coverage	Charging basis	Practical fit and connection
greenID, from GBG	DVS and other data-source checks, with document and biometric options	Contracted datasets and services	Australian identity checking inside an organisation’s web or mobile request
FrankieOne	Orchestrates checks across providers and data sources, with document, face and liveness options	Sales-led configuration	Larger operations that need several providers through one API
IDVerse, part of LexisNexis Risk Solutions	Government photo-ID document checks, selfie matching and liveness	Sales-led proposal	Remote photo-ID capture with results staff can review in a portal
Scantek	DVS gateway access and document-to-live-image comparison	Sales enquiry	Australian businesses needing a portal for verification activity
bronID	Independent data checks or document photographs with biometrics and liveness	Portal transaction fees, with subscription and setup costs for integration	A small practice can use the portal, while larger teams can use forms or an API
Sumsub	Documents, face matching and liveness, plus an Australian DVS and credit-bureau option	Verification charges, monthly commitments and custom options	Teams combining identity checks with a broader verification request
Veriff	Photo-ID and biometric checks, plus separately configured Australian DVS databases	Verification charges, monthly minimums and add-ons	Global document coverage or a separate Australian database-check integration
Entrust Identity Verification, formerly Onfido	Document and biometric verification with data and fraud-check options	Sales-led proposal	Larger operations building verification into their own client request

greenID began in Australia and is a GBG product. FrankieOne and Scantek have an Australian focus. IDVerse grew from OCR Labs and is now part of LexisNexis Risk Solutions. Sumsub, Veriff and Entrust serve global markets. Local origin alone does not decide whether the selected evidence meets your practice’s requirements.

FrankieOne is an orchestration service: it connects an organisation to several verification providers and sources through one integration. A direct identity provider performs its own configured checks. A provider can also package partner data, so identify the actual sources behind the returned result.

For a sole practitioner checking a few clients each month, bronID’s portal is a practical starting choice because it avoids building a custom connection. For larger batches requiring several data sources, FrankieOne’s orchestration is a better fit. These choices follow the work each service supports, rather than a claim about measured pass rates.

None of those delivery methods establishes a connection to your tax software. A portal means staff use a separate screen. An API means a software connection must be implemented. A result export means staff must transfer and file it. Compare AML software for accountants when you need the wider compliance work alongside identity checks.

RapidID also describes Australian document checks against official records. Its service can suit a practice choosing a document-data check, but a document match still leaves the person-to-document question to resolve.

Completing a greenID Request

greenID is GBG’s identity checking service, which compares supplied details with the DVS and other data sources. Clients may recognise it from a bank or broker application. Completing a greenID request does not issue them a government identity card.

The organisation conducting the check supplies the invitation or embeds the request in its own service. The client enters the requested details, consents and supplies the accepted evidence. Your practice checks the returned result before recording its determination.

If a client needs help, first confirm which organisation sent the request. Help them compare the entered details with the document and confirm which evidence that request accepts. Use the requesting organisation’s support or GBG’s greenID support for a persistent problem. Arrange a permitted alternative identity method when the request cannot be completed. Never ask for the client’s government sign-in credentials.

Choosing a Check for Your Practice

Choose the identity method in the order your practice must make the decision.

1. Identify which clients are remote and which cannot complete phone-based checks. Decide how you will handle those clients before choosing a selfie-only method.
2. Establish which rules apply to the service. Select evidence for the individual and any representative, then the entity or beneficial owners where required.
3. Compare the full cost of the checks you need. Include monthly commitments, separate screening charges, failed-check treatment and integration work.
4. Decide whether staff can use a separate portal or need the check inside the client’s form. Require a usable result record and a route for resolving exceptions.

Before sending client data to a provider, explain the collection and disclosure in your practice’s privacy notice. Where the Australian Privacy Principles apply, OAIC’s collection-notice guidance covers purposes, usual disclosures, rights and likely overseas recipients. Give the notice at or before collection, or as soon as practicable afterwards. Document biometric handling and retention in the provider arrangement.

Keep a fallback for a failed electronic check. Certified copies of ID can support an accepted alternative, together with the person comparison and any further evidence your method needs. Investigate a discrepancy before deciding that changing methods resolves it.

Tax Genie runs online identity verification and AML/CTF checks inside the client request, with staff making the identity and risk determinations. Rules check client details and register matches, then AI reviews answers for common mistakes. Every TFN is removed before AI review. Those form checks improve the information received, while the selected identity method supplies the evidence for your identity decision.

Before accepting your next remote client, choose the required evidence, assign the staff decision and set the fallback. The completed record must show why your practice accepts the identity and any authority to act.