Collecting a passport number isn't verification
AUSTRAC's May 2026 national risk snapshot flagged AI-fabricated identity documents as a growing real estate threat. Here's what 'verify' actually requires — and why most agencies aren't doing it yet.
AUSTRAC's May 2026 national risk snapshot identified AI-fabricated identity documents as an emerging threat to real estate transactions.
The fakes are convincing enough to pass a visual inspection. A photocopied passport, or a photo on a phone screen, won't catch them.
The agencies most exposed aren't the careless ones. They're the ones who believe collecting a document is the same as verifying it. It isn't.
The fastest path to getting this right
AML Simple handles the verification step for you — the part most agencies are missing.
Step 1 — Sign up (around 2 minutes) Enter your ABN. AML Simple pulls your registered business details from the ABR automatically. Your organisation profile is pre-filled.
Step 2 — Send a verification link to your client (around 3 minutes per client) From the client screen, send a secure verification link. Your client completes their own ID capture — name, date of birth, address, and document upload. AML Simple checks the document against the Document Verification Service (DVS), the Australian Government's identity-matching platform.
Step 3 — Review the result and record it The verification result is logged automatically. Pass or refer — it's recorded, timestamped, and stored for the 7 years required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
That's the collection AND verification step done. With an audit trail that holds up.
What AUSTRAC actually flagged
AUSTRAC released its national risk snapshot for real estate in May 2026. One of the key findings: criminals are using AI tools to generate photorealistic identity documents — passports, driver licences — that pass visual inspection.
The threat is not theoretical. It reflects patterns already detected in real transactions.
The snapshot reinforces what the AML/CTF Rules 2007 have always required for customer due diligence (CDD): that identity verification must use a "reliable and independent" source. AUSTRAC guidance specifies the Document Verification Service as one of the recognised methods for meeting this standard.
A scanned copy of a document, or a photo on a phone screen, is not a reliable and independent check. It is collection. Collection and verification are different obligations.
Prefer to do it yourself? Here's what's involved
Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, reporting entities (which includes real estate agencies after 1 July 2026) are required to verify customer identity — not just collect identity information.
The AML/CTF Rules 2007 set out what "reliable and independent" means in practice.
For an individual customer, the verification step involves confirming that the identity information provided matches a source that exists independently of the customer — something they cannot fabricate.
Two common approaches include (this is not an exhaustive list — other methods such as video call verification and biometric checks may also satisfy the requirement):
Document Verification Service (DVS) The DVS is operated by the Australian Department of Home Affairs. It checks whether a document (passport, driver licence, Medicare card) is valid and matches the details provided. Access requires integration with a DVS gateway provider — a certified third-party service that connects to the government system.
Original document inspection with independent source confirmation For in-person transactions, the AML/CTF Rules 2007 allow for inspection of an original government-issued photo ID, combined with confirmation of at least one detail (e.g. address) against an independent source such as a credit bureau, electoral roll, or utility record. This approach is more labour-intensive and harder to document consistently.
What doesn't count A photocopy of a document is not verification. A photo on a phone screen is not verification. A customer typing their own details into a form is not verification. These are collection steps.
Why the distinction matters more now
Before 1 July 2026, real estate agents in Australia have no federal AML/CTF Act identity verification obligations.
After 1 July 2026, agencies that complete CDD without a verification step are non-compliant — even if they have a written AML/CTF program, even if they collected identity documents in good faith.
AUSTRAC's risk snapshot makes clear that the document landscape is changing. An AI-generated fake that passes a visual check is not a new loophole — it is a reason the verification requirement exists.
The rule is not "inspect a document." The rule is "verify identity using a reliable and independent source."
Whether your process satisfies your obligations depends on how your agency applies it.
What to check in your agency's current process
Three questions worth asking before July:
1. Are you running a DVS check, or just collecting a document? If your current process stops at "client emailed us a copy of their passport," you are collecting — not verifying.
2. Is the verification result recorded and stored? Under the Act, CDD records are required to be kept for 7 years from the end of the business relationship. If the only record is an email attachment, that is likely insufficient.
3. Does your process apply to every customer, every time? CDD is required for customers before providing a designated service — in most real estate contexts, that means before acting on behalf of a buyer or seller in a property transaction. Inconsistent application is one of the patterns AUSTRAC examines during reviews.
Sources
- AUSTRAC, National Risk Assessment: Real Estate Sector (May 2026): austrac.gov.au
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) — customer identification and verification requirements
- Document Verification Service: dvs.gov.au