Identity Theft — How to Protect Your Personal Information

What Is Identity Theft?

Identity theft occurs when someone steals your personal information — such as your name, date of birth, Tax File Number, Medicare number, or driver's licence — and uses it to commit fraud. This can include opening credit accounts in your name, accessing your bank accounts, lodging false tax returns, or applying for government benefits. Identity theft is one of the fastest-growing types of crime in Australia.

How Your Information Gets Stolen

Common methods include data breaches (when a company you deal with is hacked), phishing emails and text messages designed to trick you into revealing information, scams where criminals pose as your bank or the ATO, physical theft of wallets, mail, or documents, and social media oversharing — many people inadvertently share enough information for identity theft by posting birthdays, addresses, and other details publicly.

Steps to Protect Yourself

Use strong, unique passwords for each online account and enable two-factor authentication wherever possible. Never share your Tax File Number or Medicare number unless absolutely necessary and the recipient is legitimate. Shred documents containing personal information before disposing of them. Check your credit report annually for any unauthorised credit enquiries. Place a temporary ban on your credit report if you suspect your information has been compromised. Keep your computer and phone software up to date.

What to Do If Your Identity Is Stolen

Act quickly. Contact your bank and financial institutions to freeze affected accounts. Report the theft to the police and obtain a police report. Contact IDCARE, Australia's national identity and cyber support service, for free guidance (1800 595 160). Notify the ATO if your Tax File Number was compromised. Contact the relevant credit reporting agencies (Equifax, illion, Experian) to place a ban on your credit file. Document everything for evidence.

Protecting Your Financial Documents

Your Statement of Advice, super statements, and tax records contain highly sensitive information. Store them securely — preferably in a locked cabinet or encrypted digital storage. If your financial adviser holds your personal information, ask about their data security practices. Under Australian privacy law, you have the right to know how your information is stored and protected.

How Identity Theft Happens

Identity theft can happen in many ways. Data breaches at companies that hold your personal information are a growing source — when a company is hacked, your name, address, date of birth, and sometimes financial details can be exposed. Phishing attacks trick you into providing your details through fake emails, SMS, or phone calls. Physical theft of wallets, mail, or documents remains a risk, as does social engineering where scammers manipulate you into revealing information.

The 2022 Optus and Medibank data breaches exposed the personal information of millions of Australians, highlighting the scale of the risk. Since those breaches, there has been a significant increase in identity theft attempts using the stolen data. The government has introduced new laws requiring companies to report data breaches and strengthening the penalties for serious breaches.

Protecting Your Identity

Strong identity protection starts with good cyber hygiene. Use unique passwords for each online account (a password manager helps), enable multi-factor authentication wherever possible, and be cautious about what personal information you share on social media. Scammers can use seemingly harmless details like your pet's name or your mother's maiden name to answer security questions.

Monitor your financial accounts regularly for unauthorised transactions. Check your credit report annually through free services like the major credit reporting agencies (Equifax, Illion, Experian). Consider placing a credit ban if you are concerned about identity theft, which prevents new credit accounts being opened in your name without your consent. The OAIC provides guidance on protecting your personal information.

Steps to Take If Your Identity Is Stolen

If you suspect your identity has been stolen, act immediately. Step 1: Contact your bank and financial institutions to freeze accounts and place alerts. Step 2: Report the theft to your state or territory police service and obtain a police report or event number. Step 3: Contact the three major credit reporting agencies to place a credit ban (free of charge).

Step 4: Report the identity theft to the Australian Cyber Security Centre (ACSC) via ReportCyber and to Scamwatch. Step 5: If your identity documents (passport, driver's licence, Medicare card) have been compromised, contact the issuing agencies to flag your account. Step 6: Consider using the IDCARE service (Australia's national identity support service) which provides free, confidential support for identity theft victims.

Frequently Asked Questions

How do I know if my identity has been stolen?
Warning signs include: unauthorised transactions on your bank or credit card statements, bills or statements for accounts you did not open, being denied credit unexpectedly, mail going missing (redirected by identity thieves), and receiving debt collection calls for debts you did not incur.

What is a credit ban and how do I place one?
A credit ban prevents credit reporting agencies from disclosing your credit report to potential lenders, making it difficult for identity thieves to open accounts in your name. You can place a ban by contacting any of the three credit reporting agencies (Equifax, Illion, Experian). The ban lasts 21 days initially but can be extended if you provide evidence of identity theft.

How do data breaches lead to identity theft?
When a company experiences a data breach, your personal information (name, address, date of birth, sometimes driver's licence or passport numbers) can be exposed. Criminals use this information to impersonate you or to target you with more convincing phishing attacks. This is why you should change passwords after any data breach affecting a service you use.

What should I do if a company loses my data?
The company is required to notify you under the Notifiable Data Breaches (NDB) scheme. You should: change your password for the affected service, be alert for targeted phishing attacks, monitor your accounts for unusual activity, and consider placing a credit ban if sensitive identification documents were exposed.