Identity theft in Australia: how to protect yourself — and what to do if it happens

Identity theft is when someone uses your personal information to pretend to be you — to get at your money, open accounts or apply for credit. The ABS estimates that 220,400 Australians aged 15 and over experienced it in 2024–25; stolen details were most often used to take money from a bank account, super or investments. Identity fraud was also the cybercrime individuals reported most to ASD's ACSC that year, at 30 per cent of their reports.

Free steps that make identity theft harder

• Use a strong, unique password or passphrase for each account, passkeys where you can, and multi-factor authentication — starting with your email.
• Check your statements often, and your credit report: each credit reporting body must give you a free copy every three months. Since 1 April 2026 there are two, Equifax and Experian, whose report now includes illion's former data.
• Shred letters from your bank, super fund and employer before you throw them out, and lock your letterbox.
• Store identity documents safely, and question any request to scan or photocopy your driver licence.
• Don't use links in texts or emails to reach your bank — open its app or website yourself.
• Ask Services Australia to add a secret password to your Medicare, Centrelink and Child Support records, and choose a stronger myGov sign-in, such as a passkey or Digital ID.

Warning signs of identity theft

• Transactions, debts or credit applications you don't recognise on your statements or credit report.
• Mail that stops arriving, or unexpected mail such as a new bank card.
• Being refused credit despite a good credit history, or a phone contract set up in your name.
• Debt collectors chasing debts that aren't yours.
• Centrelink payments that don't arrive, an ATO refund marked as paid that you never received, or benefits you didn't apply for.
• Your mobile showing 'SOS only': the ACMA says your number may have been ported or SIM-swapped to capture your SMS codes.

If your identity is stolen: what to do, in order

1. Contact your bank, super fund and any broker straight away, and ask them to block or freeze affected accounts and cards.
2. Log out of your accounts on all devices, then change your passwords from a safe device and turn on multi-factor authentication.
3. Report it to ASD's ACSC through ReportCyber at cyber.gov.au, and to police on 131 444 — ask for a police report or reference number to show organisations. Report it to Scamwatch too if a scam was involved.
4. Call IDCARE, the national identity and cyber support service, on 1800 595 160: a case manager can help you make a free response plan. Home Affairs says more than 120,000 identity crime victims have been helped under the Commonwealth's contracts with IDCARE.
5. Get your credit reports and consider a credit ban.
6. Tell whoever issued a compromised document, and replace it where needed.
7. Close accounts you didn't open. If your number was stolen, ask your telco to reverse the port or deactivate the SIM.
8. For myGov, Medicare or Centrelink, call Services Australia's Scams and Identity Theft Helpdesk on 1800 941 126; for your tax file number, the ATO on 1800 467 033.

Credit bans: Australia's answer to a credit freeze

If you've been, or are likely to be, a victim of fraud, you can ask a credit reporting body to ban your credit report. For 21 days it mustn't use or disclose your report, and a lender that asks for it is told about the ban — a warning of possible fraud. The ban is free, and so are extensions, with no limit on how many; at Experian an extension adds 12 months and must be requested before the first 21 days end. One credit reporting body can pass your request to the other. Experian (1300 783 684) also offers a free alert if a lender tries to access your report during a ban; Equifax is on 138 332. Applying for credit yourself may be harder while it's on, the OAIC notes.

Debts or enquiries that aren't yours? Ask the credit provider or credit reporting body to correct them — free, and within 30 days if they're satisfied the information is wrong.

Replacing documents and records

• Passport: you must report a lost or stolen passport to the Australian Passport Office (131 232). It's cancelled, even if you find it later, and you'll need a new passport rather than a renewal. There are penalties for not reporting promptly.
• Driver licence: rules differ by state and territory. In NSW you only need a new card if both your licence number and card number were exposed. In Victoria a breach means a replacement card with a new security card number; the licence number changes only with evidence of fraudulent use.
• Medicare: a replacement card has a new issue number and expiry date, and you can transfer to a new card number.
• myGov: if there's activity you don't recognise, Services Australia says the safest step is to close the account and create a new one.
• Credential Protection Register: the organisation that issued a document compromised in a data breach can add it, so it can't be verified through the Document Verification Service; a passport on the register still works for travel. IDLock, a self-service tool, is coming soon, with a national rollout planned for 2027.

If a business won't help

Complain to the business first. Banks must respond within 30 calendar days, and credit report complaints must be acknowledged within 7 days and decided within 30. Then go to AFCA, free on 1800 931 678, for banks and other financial firms — since 12 March 2026 that includes a bank that opened an account or credit in your name, even if you're not its customer — or the Telecommunications Industry Ombudsman for phone and internet services. A Commonwealth Victims' Certificate, issued by a magistrate, can also support your claim, though it doesn't oblige anyone to act.

Can security software help — and is paid protection worth it?

Partly. Moneysmart says security software can block some malware and warn you about unsafe websites, and Scamwatch recommends up-to-date anti-virus software and a firewall — useful against the phishing and malware that steal personal details. But software can't place a credit ban, close a fraudulent account or replace a document. Australia's core tools — IDCARE's help, credit bans and their extensions, and free credit reports — cost nothing, so check what any paid monitoring service adds to them.

Australia's strongest identity protections are free: a call to your bank, a credit ban and a plan from IDCARE. Do them first, and do them fast.