Identity theft and identity fraud explained

Identity theft happens when someone gets hold of your personal details and uses them to pretend to be you. Moneysmart puts it simply: “Identity theft happens when someone uses your personal information to pretend to be you.” The Office of the Australian Information Commissioner (OAIC) uses the term identity fraud, and describes it as someone using another person’s personal information without consent, often to obtain a benefit.

This guide explains how identity theft works in Australia: how stolen details get used, the warning signs, how a credit ban and credit report checks work, and where official help is.

How identity theft works

Why some details matter more than others

Organisations confirm who you are by asking for things only you are supposed to know or have: your date of birth, address, driver licence number, passport or Medicare card, and often a code sent to your phone. A criminal who collects enough of these can answer the same questions.

That’s why identity theft rarely relies on one piece of information. The OAIC notes that even a small amount can be enough, especially when a criminal can piece together more from public sources such as social media. A name and birthday from a profile, an address from a parcel label and a licence number from a phishing form can add up to a usable identity.

How stolen details get misused

According to the OAIC, examples of identity fraud include opening a bank account, getting a credit card, applying for a passport or carrying out illegal activity in someone else’s name. Official sources describe four common patterns.

• New accounts and credit in your name. IDCARE describes bills for goods or services you never asked for, credit applications you didn’t make, and debt collectors chasing purchases or loans in your name.
• Taking over existing accounts. Moneysmart lists access to money, shares being transferred or sold without the owner knowing, and control of email or social media accounts, which can give criminals access to the owner’s contacts.
• Mobile number takeover. A Scamwatch alert (published 7 April 2026) and a matching alert from the Australian Communications and Media Authority (ACMA) describe criminals taking control of a mobile number or making unauthorised changes to a phone account. Scamwatch says that once they control the number, they can receive verification codes and reset passwords for services such as banks, myGov, subscriptions and rewards programs.
• Government online accounts. Services Australia’s scams page describes people opening a link in a suspicious text, email or social media message, giving someone their myGov sign-in details, or visiting a website that pretended to be Services Australia. Sign-in details typed into a fake site can then be tried on the real account.

The phone number is a particular weak point. Many services send reset codes by text, so whoever controls the number can often unlock everything else. The Scamwatch alert notes that number takeover can start with a compromised email account, phishing, or ID documents and passwords stolen in data breaches.

Personal details often come from phishing messages, fake job offers that ask for ID, lost or stolen documents, or data breaches.

A fictional example

Priya applied for a “remote admin job” last month and sent a photo of her driver licence to the recruiter, who then stopped replying. She thought no more of it.

Then a letter she was expecting from her bank doesn’t arrive. A week later, an email from an online lender at quickloans.example thanks her for a loan application she never made. One evening her phone suddenly shows “SOS only”. When she checks her email on her laptop, she finds password reset messages for her bank and a shopping account she didn’t touch.

Each event matches a warning sign official sources list: missing mail (Moneysmart), a credit application she didn’t make (IDCARE), a phone that switches to “SOS only” and reset emails she didn’t request (the Scamwatch alert). Following the alert’s order, Priya calls her bank first, then her phone provider, then IDCARE.

This example is fictional. Names and the website are invented.

Warning signs

Moneysmart lists:

• charges you don’t recognise on a bank statement
• mail going missing
• unexpected mail, such as a new card or a share transfer letter
• calls or texts about products or services you don’t use
• strange emails, or a sudden increase in suspicious messages, including on social media.

IDCARE adds lost or stolen identity documents, bills for goods or services you haven’t asked for, legitimate credit applications being unexpectedly declined, and contact from debt collectors about purchases or loans you didn’t make.

For mobile number fraud, the Scamwatch alert lists unexpected alerts about changes to a mobile account, verification codes you didn’t request, login attempts or password reset emails you didn’t start, and a phone that suddenly stops working, loses service, shows no signal or displays “SOS only”.

How to check your credit report and myGov account

How to get your free credit report

The OAIC says a credit reporting body must give you access to your report free once every 3 months, and also free if you’ve been refused credit in the past 90 days or your information has been corrected. Because “credit reporting bodies may hold different information about you”, the OAIC says you may need to request a copy from each.

IDCARE’s fact sheet says you can apply through each body’s website, and suggests waiting until a credit ban is in place before applying. It also notes that requesting a report makes your current contact details available to anyone who checks it, including “any lenders, creditors or debt collectors”.

What to look for on a credit report

IDCARE describes checking for:

• credit enquiries or debts you can’t explain
• personal details that are wrong, since fraudulent applications may use incorrect information
• provider names you don’t recognise. These are often trading names, so IDCARE suggests checking with the organisation you dealt with.

IDCARE says errors can be disputed with the credit reporting body or the credit provider, and that these organisations “must investigate and provide consumers with an outcome at no cost”.

How to check your myGov account

myGov’s own guidance describes checking the account history for sign-ins and settings changes, and signing in only through the myGov app or by typing my.gov.au into the browser, never through links in emails, texts or social media. It also says to “use a strong sign in option”, such as Digital ID, a passkey or an authenticator app. See passkeys explained.

If it’s already happened

The OAIC says it’s important to act quickly to minimise financial or other damage. IDCARE notes that every case is different.

Contact IDCARE

Moneysmart says IDCARE can help you make a free plan to limit the damage. IDCARE’s contact page lists 1800 595 160 for individuals and 1800 595 170 for small business and organisations, plus an online Get Help form.

Tell your bank and other financial providers

Moneysmart says to contact your bank, stockbroker and super fund to block affected accounts and cancel any linked cards.

If your mobile number may have been taken over

The Scamwatch alert describes contacting your bank immediately, then your phone provider. The ACMA’s alert says: “Telcos have obligations to use additional fraud protections when you make a reasonable request.”

How to place a credit ban

A credit ban (the OAIC calls it a ban period) stops a credit reporting body from using or disclosing your credit report while it’s in place, except with your written consent or where the law requires it. The OAIC says that if a credit provider asks for your report during a ban, the credit reporting body tells it about the ban, which alerts it to possible fraud.

Based on the OAIC’s description (checked October 2026; the OAIC’s page has the latest details):

1. Check you’re eligible. The OAIC says you can request a ban if you’ve been, or are likely to be, a victim of fraud, including identity fraud.
2. Contact the credit reporting bodies. Each one has an online ban request form, and the OAIC’s page links to them. The OAIC recommends making the request to each of them “in case they maintain a consumer credit report on you”. Alternatively, ask one to pass the request to the others, which the OAIC says they must do as soon as reasonably practicable.
3. Note the dates. The ban lasts 21 days from your first request. The OAIC says the body must notify you at least 5 business days before it ends.
4. Extend it if needed. The body must extend the ban if it believes you’ve been, or are likely to be, a victim of fraud. The OAIC says “there is no limit on the number of times that a ban period can be extended”, and that requests and extensions are free.
5. Lift it early if you want to. The OAIC says this is done through an online form on the credit reporting body’s website.

The OAIC notes that applying for credit yourself may be harder during a ban, because a lender may need to collect more information directly from you.

If myGov, Centrelink or Medicare details were involved

Moneysmart and Services Australia’s scams awareness brochure give the Scams and Identity Theft Helpdesk number as 1800 941 126. Services Australia’s scams page gives its hours as Monday to Friday, 8 am to 5 pm AEST (AEDT during daylight saving), and says to call if you opened a link in a suspicious message, gave someone your myGov sign-in details or other personal information, or visited a website that pretended to be Services Australia or downloaded a fake app.

Report it

The OAIC lists lodging a report through ReportCyber, contacting police on 131 444 for a police report or reference number, notifying any organisation whose information may have been stolen, and reporting to Scamwatch if it was part of a scam.

Secure accounts and devices

The OAIC describes logging out of accounts on all devices, changing passphrases from a safe device, and checking accounts for changes, because misuse may not happen straight away. IDCARE also lists removing stored images of identity documents from devices and email, and checking settings such as email forwarding rules. See how to secure your online accounts.

Replace compromised documents

The OAIC says to contact the relevant agency or organisation about the information that was taken, such as the agency that issued a driver licence, Medicare card or passport. The OAIC also says a victims’ certificate “may help you with problems in your personal or business affairs caused by identity crime”.

Common questions

What do I do if my identity has been stolen?

The OAIC says it’s important to act quickly to minimise the damage. Moneysmart says IDCARE (1800 595 160) can help you make a free plan, and to contact your bank, stockbroker and super fund to block affected accounts. The OAIC also lists reporting through ReportCyber, contacting police on 131 444 and securing your accounts. See if it’s already happened for each step.

How do I know if someone is using my identity?

Moneysmart lists warning signs such as charges you don’t recognise, mail going missing, unexpected mail like a new card, and calls or texts about products you don’t use. IDCARE adds bills for things you haven’t asked for, credit applications being unexpectedly declined and contact from debt collectors about loans you didn’t take out. See warning signs.

How do I put a ban on my credit report?

You contact the credit reporting bodies, each of which has an online ban request form linked from the OAIC’s page. The OAIC says you can request a ban if you’ve been, or are likely to be, a victim of fraud. The ban lasts 21 days, can be extended, and requests and extensions are free. See how to place a credit ban.

How do I get a free credit report in Australia?

The OAIC says a credit reporting body must give you access to your report free once every 3 months, and also free if you’ve been refused credit in the past 90 days. Because the bodies “may hold different information about you”, it says you may need to request a copy from each. IDCARE suggests waiting until a credit ban is in place first. See how to get your free credit report.

Can someone take over my mobile number?

Yes. A Scamwatch alert and a matching ACMA alert describe criminals taking control of a mobile number, then receiving verification codes to reset passwords for services such as banks and myGov. Signs include verification codes you didn’t request and a phone that suddenly shows no signal or “SOS only”. The Scamwatch alert describes contacting your bank immediately, then your phone provider. See if your mobile number may have been taken over.

What’s the difference between identity theft and identity fraud?

The terms overlap. Moneysmart says identity theft “happens when someone uses your personal information to pretend to be you”. The OAIC uses the term identity fraud, and describes it as someone using another person’s personal information without consent, often to obtain a benefit, such as opening a bank account or getting a credit card in their name. See how stolen details get misused.

Where to report and get help

See where to report scams and cybercrime in Australia for a directory of the official services mentioned here, and account hacked? where official guidance says to start if an online account has been taken over.