A bloke in Frankston found out his identity had been used to finance a car he’d never seen when a debt collector rang about missed repayments. That’s the scenario credit file freezes are built for, and it’s more common than most Australians realise. If a scammer has your name, date of birth and a driver’s licence number scraped from some old data breach, they don’t need your bank password to do damage. They just need to walk into a buy-now-pay-later sign-up or a telco contract and apply as you. Freezing your credit file (the record the credit bureaus hold on your borrowing history) is one of the few scam defences that’s genuinely free, reasonably fast, and does something concrete rather than just making you feel safer.
We get asked about this a lot in the wake of a data breach headline, and our answer is usually the same: yes, do it, but understand what it actually blocks before you bother.
What a credit freeze actually does
Three companies in Australia hold consumer credit files: Equifax, illion and Experian. When you apply for a credit card, a phone plan, a car loan or even some rental applications, the lender pulls your file from one or more of these bureaus to decide whether to say yes. A freeze, which the bureaus call a “ban” rather than a freeze (more on that naming oddity shortly), tells them to refuse any request to access your file until you lift it.
No access, no new credit approved in your name. That’s the entire mechanism, and it’s a solid one. It doesn’t stop someone draining your existing bank account, and it won’t catch a scammer who already has access to an account you hold. What it stops is a stranger opening something brand new using your identity, which is exactly the move behind a huge share of identity theft cases referenced in OAIC’s Notifiable Data Breaches scheme reporting.
Why now, specifically
You don’t need a fresh breach to justify this. Enough of our personal data is already sitting in old leaked databases from telcos, retailers and health funds that the horse arguably bolted years ago. We’d argue the more useful trigger isn’t “was I in a breach” but “do I have any reason to think my name, date of birth and ID numbers are floating around together somewhere.” If you’ve ever had a letter from a company saying your data was involved in an incident, if you’ve lost a wallet, or if the warning signs in investment scams on social media sound uncomfortably familiar, that’s reason enough.
Our slightly contrarian view: we think every adult Australian should freeze their file by default and only unfreeze it the day they’re actually applying for credit, rather than treating a freeze as an emergency response after something’s gone wrong. The usual advice treats freezing as reactive. We reckon it should be the resting state, the same way you lock your front door even on a day nothing’s scheduled to happen.
Doing it: Equifax, illion and Experian
Here’s the slightly annoying part. There’s no single national on-switch. You need to contact all three bureaus separately, because any one of them might be the one a lender checks.
- Equifax lets you place what it calls a “suppression” on your file through its online portal or by phone, free under the credit reporting provisions in the Privacy Act, which the Office of the Australian Information Commissioner administers.
- illion has an equivalent online request form for a ban period, typically defaulting to 21 days before you need to renew it or extend it.
- Experian (which re-entered the Australian consumer credit reporting market more recently) offers the same mechanism through its own site.
Each bureau will ask you to verify your identity, usually with a driver’s licence or passport number and a Medicare number as backup. That’s a bit circular, we know. You’re handing over the same identity documents to protect them. But the alternative, verifying with nothing at all, would make the whole system pointless, so we accept the irony.
Budget around twenty minutes total if you do all three in one sitting. None of them charge a fee for a consumer-initiated ban; that’s a right under the credit reporting rules, not a goodwill gesture from the bureaus.
The renewal trap nobody mentions
This is where most people’s freeze quietly lapses without them noticing. illion’s default ban period is short, measured in weeks rather than months, and if you don’t come back and renew it, your file reopens automatically. We think this is a genuinely poor design choice for a tool meant to protect people during a prolonged risk window, like the months after a major breach when your details are still being traded around.
Set a calendar reminder. Seriously, open whatever calendar app lives on your phone right now and put a recurring reminder in for three weeks out, labelled plainly “renew credit ban.” It’s the single most common reason people think they’re protected and aren’t.
What it won’t stop (and where people get overconfident)
A frozen credit file is not a forcefield. It won’t stop someone porting your mobile number to a new SIM, which is its own category of fraud and a reason to also lock down your telco account with a PIN or passphrase. It won’t stop a scammer who tricks you into transferring money yourself, the classic investment scam pattern we’ve covered before in investment scams on social media. And it won’t catch fraud on accounts you already hold, since those don’t require a fresh credit check to misuse.
Think of it as one lock on one door. The house still needs the other locks: unique passwords, multi-factor authentication where it’s offered, and the habit of checking your bank and super statements more than once a year. If you’re not sure which apps and accounts already have a foothold into your digital life, our piece on how to check which apps can see your location covers a related, often-overlooked audit worth doing on the same afternoon.
Checking your file even if you don’t freeze it
Separate from freezing, every Australian is entitled to one free copy of their credit file from each bureau every three months under the credit reporting code. This is worth doing even if you decide the freeze-and-renew cycle is too much admin for you right now. A file check shows you existing accounts, any hard inquiries you didn’t authorise, and defaults you might not know about.
We’d suggest staggering these: check Equifax in January, illion in April, Experian in July, and back to Equifax in October. That way you get a near-continuous view across the year for no cost and about five minutes of effort each quarter.
Who should bother and who can probably skip it
If you’re the sort of person who checks bank statements weekly, has unique passwords generated by a manager, and has never clicked a dodgy text link, a freeze is still worth having but you’re at the lower end of risk. If you’ve had any letter about a data breach, if your Medicare or driver’s licence number has ever been part of a leak, or if you’re helping an elderly parent manage their finances, we’d push this up the priority list considerably.
Parents managing a teenager’s first bank account might also consider it: children’s identities are a known target because nobody checks a sixteen year old’s credit file for years, giving fraud time to compound quietly in the background before anyone notices.
The afternoon version, if you want to just get it done
Open three browser tabs: Equifax, illion, Experian. Have your driver’s licence and Medicare card next to the keyboard. Go through each bureau’s ban or suppression request form, verify your identity, and confirm the freeze is active. Then open your phone calendar and set that renewal reminder for illion specifically, since it’s the one that lapses soonest.
If you’re doing a broader security tidy-up at the same time, it pairs well with the kind of check we outlined in how to tell if your phone has been hacked, since compromised phones are often how scammers harvest the identity details they need to go credit-hunting in the first place.
For a wider view of what’s actually targeting Australians right now beyond credit fraud specifically, our rundown on the top cybersecurity threats facing Australians in 2026 is a reasonable companion read.
Our verdict on whether it’s worth the admin
We think the maths here is straightforward even if the process across three separate bureaus feels clunky. Twenty minutes of setup and a recurring calendar reminder, against the very real and very slow-to-unwind mess of someone financing a car or a phone plan in your name. The ACCC’s Scamwatch service, which tracks reported losses nationally, consistently places identity-related fraud among the costliest categories to resolve, not necessarily in dollars taken directly but in the hours spent proving you didn’t take out a loan you never signed for. You can check current reported trends yourself on Scamwatch’s own statistics pages.
Go with our contrarian framing: don’t wait for a breach notification to act. Freeze now, unfreeze only when you’re genuinely applying for something, and treat the gap between those two states as the safer default rather than the inconvenient exception.
— Em Castellano, Security Writer, Tech Geek
