Identity protection and credit monitoring in Australia: what they do

Identity theft protection in Australia comes in two forms: free options, set up by law or run by not-for-profit and government services, and paid services that watch for signs your details are being misused. The paid services are sold by credit reporting bodies and security software companies. This guide explains both: what the free options do, what paid identity and credit monitoring services say they offer, and the limits providers themselves describe.

Nothing here says which option anyone needs. That depends on a person’s situation. IDCARE and the OAIC, listed at the end, can help with individual circumstances. For how identity theft happens and its warning signs, see identity theft explained.

What identity protection is for

Identity theft is when someone uses your personal details to pretend to be you, for example to open accounts or apply for credit. Protection tools work at different points:

• Before misuse: making it harder for a criminal to use your details. A credit ban, for example, stops your credit report being shared while it’s in place.
• Watching for signs: alerts when something changes on your credit report, or when your email address or other details turn up in leaked data.
• After misuse: help to recover, such as case management, replacing documents and fixing records.

Some of these are free by law or from support services. Others are part of paid products.

Do you need a paid service? Start with the free options

Several of the most useful protections cost nothing. These are the ones official sources describe.

IDCARE’s free support

IDCARE describes itself as “the national identity and cyber support service”, and says it is a not-for-profit organisation and registered charity. It says: “We do not charge individual community members for our base support service.” Moneysmart says IDCARE “can help you make a plan (for free) to limit the damage of identity theft”.

IDCARE’s contact page lists 1800 595 160 for individuals and 1800 595 170 for small business and organisations, plus an online Get Help form.

Free credit reports

The OAIC says a credit reporting body “must give you access to your consumer credit report for free once every 3 months”. You can also get a free copy if you’ve been refused credit within the past 90 days, or your credit information has been corrected. Because credit reporting bodies may hold different information, the OAIC says you may need to request a copy from each one. Its access page names Equifax and Experian.

IDCARE’s fact sheet suggests requesting a free report from both, “as one may hold credit information the other does not”, and says it is recommended to wait until a credit ban is in place before applying for the reports.

Credit bans

The OAIC explains that if you’ve been, or are likely to be, a victim of fraud, you can ask a credit reporting body to place a ban on your credit report. While it’s in place, the body “mustn’t use or disclose your consumer credit report”, with limited exceptions. The OAIC says:

• the ban lasts 21 days from the first request
• the body must notify you at least 5 business days before it ends
• it can be extended, with “no limit on the number of times”
• “Requesting a ban period, or an extension of a ban period, is free.”

The OAIC recommends making the request to all three credit reporting bodies, or asking one to pass it on to the others. Identity theft explained walks through the OAIC’s steps.

Breach alerts built into password managers

Some free, built-in password managers warn when a saved password appears in leaked data. Apple says its Passwords app warns if passwords “appear in known data leaks”. Google says Password Checkup shows saved passwords that are exposed, weak or reused. The guide to password managers compares these. Data breaches explained covers the official ways to check whether you were affected by a breach.

If you think your identity has been misused: the free steps

Based on the OAIC, Moneysmart and IDCARE (checked October 2026):

1. If you think your identity has been misused, contact IDCARE on 1800 595 160, or use its online Get Help form. Moneysmart describes IDCARE helping to make a free plan.
2. Request a credit ban if you’ve been, or are likely to be, a victim of fraud. The OAIC’s page links each credit reporting body’s online form.
3. Get your free credit reports. Experian says its free report is available online through CreditConnect after answering identity questions. Equifax describes its free report on its website.
4. Check the reports. Moneysmart describes checking a credit report for debts, loans or credit applications you don’t recognise.
5. Secure your accounts. The OAIC’s data breach guidance describes changing email passwords and turning on multi-factor authentication. See how to secure your online accounts.

What paid services add

Paid services mostly add convenience and extra watching: alerts, wider monitoring and someone to help with recovery. Providers describe a mix of these features, and not every service includes all of them.

• Credit report monitoring and alerts. Regular copies of a credit report, a credit score, and alerts when certain changes are made, such as a new credit enquiry. Equifax, for example, describes alerts that “let you know if there are certain changes made to your Credit File”.
• Dark web monitoring. Scanning of leaked data traded online for your details, starting with an email address and sometimes extended to phone numbers, cards, licence and passport numbers. The service notifies you if it finds a match.
• Document expiry alerts for items such as passports and licences.
• Restoration support. A case manager who helps with recovery steps after identity theft.
• Identity theft insurance, which providers describe as subject to policy terms, conditions and exclusions.

Their limits, as providers describe them

• Monitoring doesn’t prevent theft. Norton states that “No one can prevent all cybercrime or identity theft.”
• Coverage of the dark web is partial. Norton says no one can guarantee to monitor all of the dark web and private forums. It also says its Dark Web Monitoring isn’t available in all countries and monitored information varies by country and plan.
• Alerts come after something happens. An alert tells you about a change, such as an enquiry on your credit report, so you can act on it. A credit ban, as the OAIC describes it, works differently: it stops the report being disclosed while the ban is in place. The two do different jobs.
• One report, one body. A credit alert service run by one credit reporting body watches that body’s report. The OAIC notes that credit reporting bodies may hold different information.
• Insurance has terms. Providers say their insurance is subject to terms, conditions, exclusions and limitations, and point to a policy booklet.

What to compare

• What’s monitored. Credit report, email address, phone numbers, cards, documents, social media, bank transactions.
• Which credit report. Whose credit report the alerts cover.
• How you’re notified, and how often scans run.
• Support. Whether there’s a person to help with recovery, and their hours.
• Insurance. Whether it’s included, who provides it, and what the policy booklet says.
• Cancellation and renewal terms. Several providers describe subscriptions that renew automatically.
• How it overlaps with free options. Many features sit alongside free reports, bans and IDCARE’s support rather than replacing them.
• Sign-up and terms. Each provider’s website describes its sign-up process, and its terms and any policy booklet set out what’s covered.

How the services compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. These are the features each provider lists on its Australian website; plans change often. Pricing varies; check the maker’s site. The list isn’t exhaustive. Experian’s Australian site describes free credit reports and bans; no paid Experian monitoring product was found on its site when checked.

The service summaries further down this page set out what each provider states, with links to their pages.

Things to watch for

• Unexpected offers and codes. Equifax’s Equifax Protect page says people may receive a subscription offer “on behalf of a company”, and describes signing up with an Equifax Protect code. The OAIC says to be wary of scam emails and calls after a breach, and not to share personal information “until you are certain about who you are sharing it with”. Going to the organisation’s website directly, rather than following a link, is one way to check. See how to tell if a message is a scam.
• Automatic renewal. Norton’s pages say its subscriptions renew automatically unless cancelled.
• Free trials. Norton’s dark web monitoring page says a payment method is required for its trial.
• Your details go to the provider. Monitoring works by giving a provider the details to watch, such as card or licence numbers. Each provider’s privacy policy explains how it handles them.
• Insurance terms. Norton notes that it does not hold an Australian financial services licence, and points to the policy booklet. Product disclosure documents are where cover is defined.

Common questions

Is identity theft protection worth it?

That depends on personal circumstances, and this guide doesn’t say which option anyone needs. Several protections are free: IDCARE’s support, free credit reports every 3 months and free credit bans, as the OAIC describes. Paid services list extra features such as credit alerts, dark web monitoring, restoration support and insurance subject to policy terms. Norton states that no one can prevent all cybercrime or identity theft. See what paid services add.

What do I do if my identity has been stolen?

IDCARE offers free support on 1800 595 160, or through its online Get Help form, and Moneysmart says it can help make a free plan to limit the damage. The OAIC describes asking credit reporting bodies for a free credit ban, and getting free credit reports to check for debts, loans or applications that aren’t recognised. The OAIC’s data breach guidance also describes changing email passwords and turning on multi-factor authentication. See the free steps.

How do I get a free credit report in Australia?

The OAIC says a credit reporting body must give free access to a consumer credit report once every 3 months, and also after being refused credit in the past 90 days or after credit information is corrected. Because the bodies may hold different information, the OAIC’s page names Equifax and Experian, and IDCARE suggests requesting from both, saying it’s recommended to wait until a credit ban is in place. See free credit reports.

What’s the difference between a credit ban and credit monitoring?

A ban stops a credit report being shared; monitoring tells you after something changes. The OAIC says that while a ban is in place, a credit reporting body mustn’t use or disclose the consumer credit report, with limited exceptions. A ban lasts 21 days, can be extended, and is free. Monitoring, as providers describe it, sends alerts about certain changes, and a service run by one credit reporting body watches that body’s report. See credit bans.

What is dark web monitoring?

Providers describe it as scanning leaked data traded online for your details, starting with an email address and sometimes extended to phone numbers, cards, licence and passport numbers, then notifying you of a match. Norton says no one can guarantee to monitor all of the dark web, and that its Dark Web Monitoring isn’t available in all countries. Some free password managers also warn about passwords found in known leaks. See their limits.

Is a free identity monitoring offer after a data breach a scam?

Some offers are genuine. Equifax’s Equifax Protect page describes subscription offers made on behalf of a company, with sign-up using an Equifax Protect code. The OAIC says to be wary of scam emails and calls after a breach, and not to share personal information until certain who it’s being shared with. Going to the organisation’s website directly, rather than following a link, is one way to check; see how to check a notification is genuine.

Where to get official help

IDCARE offers free identity and cyber support on 1800 595 160 (individuals). The OAIC’s pages explain credit bans and free credit reports. For reporting identity crime and other next steps, see identity theft explained.