Verification of identity forms and AI security: what a VOI record gives away in ChatGPT or Claude.

A verification of identity form is the densest page in a conveyancing file. It records who the client is, which documents were sighted, how they were checked and, since the AML/CTF reforms, where the money comes from. Staff paste it into ChatGPT or Claude to tidy the notes or to fill a checklist, and in doing so send identity numbers to a provider the client never agreed to. This page marks every item on a routine VOI record for a NSW purchase that bears on the ARNECC rules, the AML/CTF obligations and the Privacy Act, and shows how the same record is handled on Ermos inside the practice.

The verification of identity form

Completed at the first face-to-face meeting with each client, before the practice acts for them in an electronic conveyancing transaction, and kept on the matter file afterwards.

An invented verification of identity record. The passport, licence and Medicare numbers are placeholders, and the employer is fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   Full names and dates of birth

   Two identities. Personal information, and with the documents below the material identity theft is built from. Privacy Act guide.

2. 2
   Identity document numbers and expiry dates

   Passport, driver licence and Medicare numbers. The ARNECC guidance says the Verification of Identity Standard requires copies of identity documents sighted to be retained, so these numbers are on file by design and are exactly what should not travel further.

3. 3
   Address and contact details

   Where the clients live now, their mobile and email. Enough to contact them while pretending to be the practice. Privacy Act guide.

4. 4
   The check performed and who performed it

   The evidence that reasonable steps were taken. ARNECC guidance says evidence supporting verification of identity must be kept under rule 6.6 of the Model Participation Rules for at least seven years from lodgement. It is the record that protects the practice if the check is ever questioned.

5. 5
   The client authorisation

   The clients’ signed permission for the practice to act for them in the transaction. ARNECC guidance lists it among the evidence a subscriber must retain, and it is what someone would need to impersonate to act in their name.

6. 6
   Occupation and employer

   Where each client works and in what role. Personal information that also shows where each of them is on a weekday. Privacy Act guide.

7. 7
   Source of funds, including a named third-party gift

   AUSTRAC’s conveyancing starter kit covers source of funds and source of wealth in customer due diligence. The entry names the clients’ parents, whose personal information appears without their involvement. The OAIC says the Privacy Act applies to personal information handled for AML/CTF obligations, even in a small business. Privacy Act guide.

8. 8
   The customer risk rating

   The practice’s own assessment of the client, with screening results. An AML/CTF compliance record that a human assessed and signed.

9. 9
   The retention note

   A statement of how long the record is kept. Generic practice wording that identifies no one.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in conveyancing practices.

Common questions