A Melbourne reader emailed us last month after a buy-now-pay-later account she’d never opened showed up on her credit file, sitting there next to a mobile plan she also hadn’t signed up for. She hadn’t lost her wallet. She hadn’t clicked a dodgy link that she could remember. Somewhere, her name, date of birth and driver’s licence number had been enough for a stranger to pass as her, at least for long enough to get a SIM card issued. That’s identity theft Australia style: less dramatic than the movies, more like paperwork fraud with your name stapled to it.
We get asked about this a lot, usually after someone’s had a letter from a debt collector about a loan they never took out, or a text from their bank asking why they’ve suddenly applied for a credit card in another state. Our take is that identity theft sits in an odd blind spot for most Australians. We’ve all absorbed “don’t click suspicious links” by now. Fewer people know what to actually do once their identity, rather than just their money, has been used without permission.
What identity theft actually means
Identity theft is when someone gets hold of enough of your personal information, your full name, date of birth, address, Medicare number, driver’s licence or passport details, to pretend to be you for financial or other gain. That’s different from a straightforward scam, where someone tricks you into handing over money directly. With identity theft, the criminal is impersonating you to a third party: a bank, a telco, a government agency, sometimes an employer.
The sources are mundane. A data breach at a retailer or an airline. Mail stolen from an unlocked letterbox on a street with no security cameras. A phishing email that looks exactly like it’s from the Australian Taxation Office. Sometimes it’s a scanned copy of your licence sitting in an old email attachment from when you rented a car years ago, long forgotten, sitting on a server that eventually gets breached.
Once someone has enough pieces, they can open a phone plan, apply for a personal loan, lodge a tax return in your name to intercept a refund, or get a credit card issued and max it out before you’ve noticed. The OAIC’s Notifiable Data Breaches scheme exists partly because of this chain reaction. One breach at one company can feed identity theft against people who never did business with the company that was breached, because their details were sitting in some other dataset it touched.
The warning signs most people miss
The honest answer is that most victims find out by accident, not because a system flagged it for them. Common tells include a notice of assessment from the ATO for a tax return you didn’t lodge, a “welcome” email or SMS from a bank or telco you’ve never used, a sudden hard inquiry on your credit file you don’t recognise, or mail that simply stops arriving because someone’s redirected it.
That last one is sneakier than people expect. Mail redirection fraud is a known technique precisely because it’s quiet. If your real mail stops turning up, that’s worth investigating, not shrugging off as Australia Post having a slow week.
We’d also gently push back on the assumption that this is mostly an older, less tech-savvy person’s problem. In our experience the opposite is often true: younger Australians with a thinner credit history are attractive targets precisely because a fraudulent loan or phone plan is less likely to trip an existing pattern of normal activity. A clean slate is easier to write fraud onto than a busy one.
What IDCARE actually does
IDCARE is Australia and New Zealand’s national identity and cyber support service, and it’s the one organisation in this space we consistently point people towards. It’s not a government department, it’s a not-for-profit, but it works closely with police, banks, telcos and government agencies, and its support is free to individuals.
Ring them, or work through their online form, and a case manager builds what they call a response plan: a specific, ordered list of who you need to contact, in what order, and what to say to each one. That matters more than it sounds. Call your bank first and your telco might miss the window to block a fraudulent SIM swap. Lock your credit file before reporting to police and you might complicate the paper trail an investigator needs. IDCARE’s case managers deal with this sequencing daily, which most of us simply don’t.
They also stay on the phone with you, or follow up over days and weeks, which is the bit that’s easy to underrate until you’re the one holding on hold with three different call centres in one afternoon trying to explain the same situation three times. Fair dinkum, that alone is worth the (free) phone call.
When to actually call them
You don’t need proof of fraud to ring IDCARE. Suspicion is enough: a breach notification that included your licence number, a weird SMS asking you to “verify” details you never gave that company, a friend saying someone’s been messaging under your name. Earlier contact means more options are still open, like freezing a credit file before new accounts are opened against it rather than after.
Locking down your credit file
One of the most concrete, same-afternoon steps available to Australians is a credit ban, sometimes called a credit freeze. This stops new lenders from pulling your credit report, which in turn stops most new loans or cards being approved in your name, because a lender that can’t see your file generally won’t lend against it.
We’ve written a full walkthrough on how to freeze your credit file in Australia, and it’s worth doing even if you’ve got no specific reason to suspect fraud right now. It’s free, it’s reversible when you genuinely need new credit, and the main cost is a bit of friction if you forget you’ve done it and then wonder why your own loan application stalled.
Here’s our mildly contrarian bit: we think every Australian adult should have a standing credit freeze in place by default, lifting it only for the weeks they’re actually applying for a mortgage or a car loan. The finance industry doesn’t love this idea, because friction at account opening is friction at account opening regardless of who it’s protecting. But the asymmetry is stark. The downside of a freeze is a short delay when you genuinely want new credit. The downside of not having one is someone else’s four-figure debt landing in your name while you’re none the wiser.
The first few hours matter
If you’ve had confirmation, not just suspicion, that your identity has been misused, the sequence we’d follow looks roughly like this. Contact IDCARE first if you can, because they’ll tailor the order to your specific situation rather than a generic checklist. Report to ReportCyber via the Australian Cyber Security Centre if the misuse stemmed from a hack or online compromise, since this feeds into the national picture agencies use to track organised fraud. Contact the specific bank, telco or lender where the fraudulent account was opened and ask for their identity theft or fraud team specifically, not the general queue. And request a copy of your credit file from Australia’s credit reporting bodies to see the full extent of what’s been applied for in your name.
If you’ve already had a letter telling you your data was part of a breach, we’ve got a separate piece on exactly what to do in the first hour after a data breach notification, which overlaps with a lot of this but starts one step earlier in the timeline.
Protecting the details criminals actually want
Not every piece of personal information is equally valuable to someone running this kind of fraud. Your date of birth, full name and a government identifier (Medicare, licence or passport number) are the trifecta. Password reuse matters too, because once one account is compromised, criminals will try the same login against banks, telcos and email providers hoping you’ve recycled it. If you haven’t sorted out a password manager yet, our comparison of which password manager Australians should actually use is a reasonable place to start, and it genuinely takes less than an afternoon to set up properly.
Worth remembering too that a lot of this information leaks slowly rather than in one dramatic event. Old social media posts with a full birthdate, a scanned ID sent over email years ago, a loyalty programme sign-up that asked for more detail than it needed. None of these alone is catastrophic. Together, they’re a kit.
Don’t wait for certainty before acting
The pattern we keep seeing is hesitation. People notice something odd, a letter, a text, a line on a statement, and they wait to see if it’s “really” a problem before doing anything. With identity theft, that wait is exactly the window the fraud needs to do more damage. A credit freeze takes minutes. A call to IDCARE costs nothing and commits you to nothing beyond the call itself.
We’d rather readers ring IDCARE on a hunch that turns out to be nothing than sit on a genuine case for three weeks because they weren’t sure it counted. The service exists precisely for that uncertainty, and the case managers have heard every version of “I’m probably overreacting” there is. Usually, they’re not.
