Identity theft
Identity theft is a type of fraud where someone steals your personal information and uses it to carry out illegal activities such as:
- stealing money
- gaining benefits
- applying for a passport
- taking out loans
- conducting any other business illegally in your name
- ordering goods and services that you are charged for.
It's very important you understand how to protect your identity and you know what to do if you think your identity has been stolen.
If you think your identity has been used for criminal activities, contact the police. In an emergency, call 000.
How can my identity be stolen?
There are many ways people can steal your identity. Your personal information is freely available in personal documents (eg bank statements, utility bills, medical records), in identity documents (eg driver licence, passport and other photographic IDs), in emails, in files on your computer and on social networking sites.
Identity thieves can access your information by stealing your wallet, going through your garbage, stealing your mail, hacking into your computer or breaking into your house to steal personal documents.
They may also trick you into giving them your personal details. For example, they may send you an email or call you pretending to collect information on behalf of your bank or utility provider. This is called ‘phishing’.
You should never give out personal information unless you can confirm the identity of the person asking for the information.
Protecting your identity
You can take the following steps to prevent your identity from being stolen.
You should:
- only carry essential personal documents with you
- destroy personal documents before putting them in the garbage
- secure your mailbox
- always hide your PIN at ATMs or EFTPOS terminals
- be careful about who you give your personal information to (eg if you receive a call or email from someone claiming to be your bank asking for personal information, always contact the organisation yourself to check it is really them)
- check your banking records carefully
- check your credit history regularly (see Credit reporting)
- use secure settings on your social networking sites.
The Commonwealth Department of Home Affairs website has information on how to avoid becoming a victim of identity theft.
The Australian Cyber Security Centre and the eSafety Commissioner has information about how to protect your personal and financial information online.
The Australian Securities and Investments Commission and Australian Banking Association have information about how to protect your financial identity.
What should I do if my bank or credit cards have been stolen?
If you think your bank or credit cards are missing or have been stolen, you should immediately let the bank, financial institution or credit card provider know.
Most banks and financial institutions are subscribers to the ePayments code. The code protects you from any loss as a result of unauthorised use of your bank and credit cards.
Under the ePayments code, if you let your bank or financial institution know your card has been lost or stolen within a reasonable period of time, you're protected from any loss that occurs as a result of unauthorised use of your cards. This is unless you are partially responsible for the loss suffered (eg if you did not keep your PIN secret, you acted fraudulently or you accidentally left your card in an ATM). Even if you are partially responsible for the loss, your liability may still be limited. You should get legal advice.
If you unreasonably delay telling your bank or financial institution your card has been lost or stolen, you may not be able to get your money back. You should get legal advice.
If your bank, financial institution or credit card provider will not reverse an unauthorised payment, you can lodge a dispute with the Australian Financial Complaints Authority (AFCA). Get legal advice before lodging a dispute.
For information about mistaken transactions and unauthorised transactions, see Banking.
What to do if your identity has been stolen
Report it to the police
If you think your identity has been stolen, you should immediately report it to the police. Ask the police for a police reference number and get a copy of the police report. You may need to show the police report to banks, financial institutions and government agencies.
Report the loss or theft of any compromised cards or identity information
You are legally required to report any suspected theft or fraudulent use of your identity information. You should contact the government or private sector organisation who issued the document and let them know if this information has been lost or stolen.
You may need to contact the following organisations to report lost or stolen documents:
You can report any suspected Centrelink fraud to the Centrelink Fraud Tip-off Line on 131 524.
If your bank or credit cards are lost or stolen, you should report it immediately.
Get a copy of your credit report
If you think your identity information has been used to borrow money fraudulently, get a copy of your credit report.
You can use a credit reporting agency such as:
If there are any unauthorised inquiries from companies or organisations on your credit report, contact them and alert the major credit reporting agencies in Australia that you've been a victim of identity theft. It's possible to correct mistakes or fraud on your credit report by asking the listing organisation who accessed your credit report to support the deletion. If they don't agree, you can make a request to the credit reporting agency. If you disagree with the credit agency’s response, you can make a complaint to the Australian Financial Complaints Authority (AFCA). Get legal advice before lodging a complaint.
You can place an alert on your credit file notifying you of any requests for finance. Some credit reporting agencies may charge you a fee for this service.
Stop your credit information being used
If you think you're a victim of identity theft, you can ask a credit reporting agency not to use or disclose your credit reporting information. The credit reporting agency will put a ban on the use or disclosure of your credit reporting information for 21 days from when the request is made. This is known as a ‘ban period’. You can request this time be extended if needed. During the ban period, the credit reporting agency won't provide your credit report to any credit providers unless you've given written consent.
Close all unauthorised accounts and cancel services
If you've received unauthorised accounts or services you didn't request, you should cancel them immediately and keep a record of the cancellation. If you're contacted about money for goods or services you didn't order, you should get legal advice.
If your email or social networking accounts have been compromised, you should close all accounts and report any security breaches. Many sites will have detailed information about what to do if your account has been compromised.
Check your mailing address
Check with Australia Post or any other postal services that a redirect hasn't been placed on your mailing address. Contact any government or private organisations that may have your address and confirm your details.
Apply for a Commonwealth Victim’s Certificate
If you've been a victim of identity theft, you can apply to the Magistrates Court for a Commonwealth Victim’s Certificate.
This certificate can be used to support your claim that your identity has been misused. It can be presented to organisations, government agencies and businesses to help you negotiate with them to resolve any issues caused by the identity theft. You should get legal advice.
Dispute any liability arising from the identity theft
If someone borrows money or runs up a bill with a utility provider (eg phone, energy or water provider) using your information, you should contact the financial institution or utility provider and dispute the liability on the basis that you didn't enter into a contract with them.
You'll need to explain you've been the victim of identity theft, and give them a copy of any police reports or Commonwealth Victim’s Certificate you might have.
If you disagree with their response, you can make a complaint to the:
You should get legal advice.
Contact the Office of the Australian Information Commissioner
Contact the Office of the Australian Information Commissioner if you think your privacy has been breached or your personal information has been misused by an agency or organisation.
You can also contact the Office of the Information Commissioner if you can’t resolve any complaints or matters with an individual agency or organisation.
Acknowledgement—prepared using information copyrighted to the Commonwealth Attorney-General’s Department of Australia.
Do I need legal advice?
You may need legal advice if you think you've been the victim of identity theft.
Get legal advice
Our Consumer Protection Unit may give general legal advice about identity theft.
The following organisations may be able to help.
Community legal centres give legal advice on a range of topics. Contact them to find out if they can help.
Queensland Law Society can refer you to a specialist private lawyer for advice or representation.
Who else can help?
These organisations may also be able to help. They don't give legal advice.
Office of the Australian Information Commissioner provides information about privacy and deal with complaints about privacy breaches and misuse of personal information.
Equifax (formerly Veda) is the main credit reporting agency in Australia, and can give you a free copy of your credit history. Illion (formerly Dun and Bradstreet) and Experian are also major credit reporting agencies in Australia and can give you a free copy of your credit history.
Tasmanian Collection Service is a credit reporting agency for Tasmanian residents, and can give you a free copy of your credit history.
Commonwealth Department of Home Affairs has information about protecting your identity
Telecommunications Industry Ombudsman has a free alternative dispute resolution service for unresolved complaints about telephone or internet services.
Energy and Water Ombudsman offers a free service to help resolve disputes with electricity, gas or water suppliers.
Australian Financial Complaints Authority has an independent dispute resolution service for unresolved complaints about financial services providers.
Scamwatch has information about identity theft
The Australian Securities and Investments Commission's MoneySmart website has information about identity fraud
Stay Smart Online has information about how to protect your personal and financial information online.
Australian Securities and Investments Commission and Australian Banking Association have created a website with information about how to protect your financial identity.
Disclaimer: This content is for general purposes only and not legal advice. If you have a legal problem, please contact us or speak to a lawyer. View our full disclaimer.
Last updated 25 May 2023