An authorised recipient with the provided tracking reference can use the public tracking route for the limited status information it exposes. Treat the reference as access information and share it only as intended. It is not permission to view account records or identity documents.