What to do if you are a victim of identity theft

Identity theft occurs when someone uses your personal information without permission to access money, services, accounts or government records. Criminals may obtain details through phishing emails, fake investment offers, data breaches, stolen mail, compromised passwords or social media profiles. The consequences can include unauthorised transactions, fraudulent loans, false tax activity and damage to your credit history.

Acting quickly can limit the loss and create a clear record of what happened. Your first priorities are to secure affected accounts, contact the organisations involved, preserve evidence and report the incident through the appropriate Australian channels. Avoid communicating with a suspected scammer after you have gathered the basic information needed for a report.

Identity fraud can feel confusing, particularly when several agencies are involved. A written timeline, copies of messages and a list of affected accounts can help you stay organised. If the incident involves threats, family violence, immigration concerns or a complex legal dispute, independent legal advice may also be appropriate.

Secure your accounts immediately

Start with the account that appears to have been compromised. Contact your bank or card provider using the telephone number printed on your card, shown in the official banking app or listed on the institution’s genuine website. Ask the bank to block or replace cards, stop unauthorised payments, reset online banking access and investigate disputed transactions. Do not rely on a phone number supplied in a suspicious text message.

Change passwords from a trusted device, beginning with email. Email access can allow a criminal to reset passwords for banking, shopping, social media and government services. Use a different long password for every important account, and activate multifactor authentication wherever it is available. Review account recovery email addresses, phone numbers, logged-in devices and forwarding rules for changes you did not make.

If your phone number may have been taken over, contact your mobile provider and ask about an unauthorised SIM replacement or number port. A temporary loss of mobile service can be a warning sign. Secure your myGov account, Medicare information, Australian Taxation Office access and superannuation accounts if those services may be affected.

Report the theft and preserve evidence

Report cyber-enabled identity crime through ReportCyber, the Australian Government’s reporting portal. You can also report scams to Scamwatch, especially when the incident involved a deceptive investment, impersonation call, fake online store or phishing message. Reporting may help identify broader criminal activity, even if stolen funds cannot immediately be recovered.

Contact your local police station when you have suffered financial loss, document theft, threats, extortion or in-person fraud. Ask for an event or incident number and keep it with your records. If a passport, driver licence or other identity document has been stolen, notify the issuing authority. For an Australian passport, contact the Australian Passport Office; for a licence, contact the relevant state or territory transport agency, such as Service NSW in Sydney or VicRoads in Melbourne.

Preserve emails with their original headers where possible, text messages, screenshots, transaction records, usernames, phone numbers, parcel information and dates. Do not edit or delete suspicious messages before saving copies. A simple chronology should record when you noticed the problem, whom you contacted, what was cancelled and any promised follow-up.

Protect your credit record

Identity criminals may apply for buy-now-pay-later accounts, personal loans, mobile contracts or rental services in another person’s name. Check your credit reports with Australia’s major credit reporting bodies, including Equifax, Experian and illion. Each report can contain different information, so checking more than one may reveal an application or default that another report does not show.

If an entry is unfamiliar, contact the credit provider and the reporting body in writing. Explain that the application or account resulted from identity fraud and attach supporting material, such as a police event number or identity theft declaration if requested. Ask for the information to be investigated and corrected. Keep copies of every letter, reference number and response.

You may be able to place a ban period on your credit report, which can make it harder for new credit applications to be approved while you investigate the incident. Check the current eligibility rules and duration directly with the credit reporting body. A ban does not replace password changes or bank contact, and it may affect legitimate applications you make during that period.

Be cautious of anyone promising instant credit repair for an upfront fee. Australians often encounter impersonation scams claiming to be from banks, the ATO or major lenders. Legitimate organisations will not ask you to transfer money to “protect” your funds or provide one-time security codes to a caller.

Check government and identity documents

Contact the ATO if you suspect someone has used your tax file number, lodged a false tax return or changed your bank details. The ATO may place additional security measures on your account and explain what evidence is needed. Monitor notices in myGov and review linked services for changes you did not authorise.

Services Australia should be contacted if your Medicare, Centrelink, Child Support or related information may have been accessed. Ask what steps are available to protect your record and whether suspicious claims or changes have been recorded. If your identity documents were exposed in a known data breach, follow the instructions issued by the organisation involved and replace documents where the issuing authority advises this.

People living in Brisbane, Perth, Adelaide or regional communities should use official state and territory channels rather than assuming that every office follows the same procedure. Driver licensing, birth certificates and proof-of-age cards are administered differently across Australia. Keep in mind that government agencies generally will not ask for passwords or full identity details through an unsolicited social media message.

Legal support can help where identity misuse affects a tenancy, employment matter, debt dispute or family law issue. Community organisations that provide accessible legal education, such as free legal resources, can also help people understand documentation, correspondence and referral pathways.

Watch for secondary scams

After a victim reports identity fraud, criminals may make follow-up contact pretending to be investigators, bank security staff, police officers or lawyers. They may already know your name, address or part of the original incident, which makes the approach sound convincing. Never provide a password, PIN, passcode or remote access to your computer because an incoming caller requests it.

Use independently verified contact details when returning a call. A bank employee can usually explain how to call through the official app or card number. Do not transfer money into a so-called safe account. Genuine banks and government agencies do not ask customers to move funds to protect them from fraud.

Review your mail, utility accounts, online shopping profiles and loyalty programs for unexpected changes. In Australia, criminals may use stolen details to redirect parcels, open telecommunications services or create accounts with online marketplaces. Consider changing security questions that reveal information available through public social media, such as a pet’s name or school.

If you shared intimate images, experienced stalking or fear that the perpetrator is someone known to you, seek specialist support. Identity abuse can overlap with coercive control and family violence. Your safety plan should come before recovering every account, and police or a support service can help you decide how to communicate safely.

Recover your records and reduce future risk

Follow up with every organisation in writing and keep a recovery folder containing reports, replacement-document receipts, bank correspondence and credit-report corrections. Set calendar reminders to check disputed accounts and reports again after several weeks. Some problems appear later, especially when a criminal has obtained a passport number, tax file number or a complete identity profile.

Tell your employer, school, landlord or professional association only what they need to know if the incident affects payroll, access cards, qualifications or tenancy checks. Ask whether they can add a security note to your record. When sending identity documents, use a secure portal and ask whether unnecessary fields can be masked or watermarked for the stated purpose.

Reduce future exposure by limiting public personal details, updating devices, installing security updates and reviewing app permissions. Shred sensitive paper records and redirect mail when moving house. Treat unexpected links, urgent payment requests and unusual account alerts with suspicion, even when the message uses familiar branding.

Where the situation crosses borders or involves civil documents, legal advice may be useful. Questions about identity records, consent and official paperwork arise in many areas of law, including family matters; accessible adoption legal guidance illustrates why careful document handling and reliable legal information matter. Recovery is usually a process rather than a single phone call, but prompt action can contain the damage and restore control over your personal information.