How to set up myID and fix it when it breaks

myID is an app that proves who you are online. It is not an account with services inside it. myID itself tells you that you do not open services from within the app — you start at the service's own sign-in page, choose myID as the sign-in method, consent to the details being shared, and then confirm a four-digit code in the app. Bookmarking the myID login page and starting there is one of the most common reasons a code never arrives, because myID has no way of knowing which service you were trying to reach.

myGov is a different thing again, and conflating the two causes real confusion. myGov is the front door to Centrelink, Medicare, the ATO and the rest; myID is one of several ways to open that door. myGov publishes the split plainly: a Standard identity strength lets you sign in to myGov, create an account or make a digital statutory declaration, while a Strong identity strength is what you need to link Centrelink or to recover access when you have lost your other sign-in methods.

Behind both sits the Australian Government Digital ID System, regulated under the Digital ID Act 2024. The Australian Competition and Consumer Commission is the Digital ID Regulator: it accredits entities that provide digital identity services, approves participation in the government system, and runs compliance and enforcement. The ACCC is explicit that it cannot help you set up or use the app and holds no information about myID itself, so calling the regulator about a broken face scan wastes a morning.

Privacy is regulated separately. The Office of the Australian Information Commissioner oversees the privacy safeguards that apply to accredited Digital ID providers, handles complaints and investigations, administers the notifiable data breach scheme for the system, and conducts compliance assessments. The categories it names as complainable are specific — collecting restricted attributes, sharing personal information without express consent, disclosing biometric information beyond permitted uses, keeping data longer than allowed, and using biometric information in a discriminatory way.

The Act itself carries the safeguards that most people worry about. Section 48 restricts the collection and use of biometric information, section 49 sets out when it may be collected for verification, and section 51 requires biometric information to be destroyed. myID's own security guidance says the same thing in plainer language: your identity documents are not stored in the app, only core details such as your name, date of birth and email address, and the face verification check is a one-off that is deleted afterwards.

Section 74 of the Act establishes that creating and using a Digital ID is voluntary. That matters practically, not just philosophically. If you cannot get to Strong strength because you have no Australian passport, or you will not do a face scan, the agency you are dealing with is still obliged to have another way through — a linking code, a phone identity check, a service centre visit. myID is a shortcut, and shortcuts are optional.

Check you meet the entry conditions before you start. myID requires you to be 15 years or older and to have a compatible smart device, a personal email address that is not shared and is not a work address, and access to your Australian identity documents. Have the physical documents in front of you rather than working from photographs of them, because several checks depend on numbers printed in awkward places.

Download the app only from the Apple App Store or Google Play. myID names those two stores specifically. Digital ID apps are heavily impersonated, and a download from a link in a text message or an email is the single most efficient way to hand your identity to somebody else.

Open the app and enter your details: your personal email address, a password, and your full name and date of birth. The password rule is ten or more characters including at least one upper case character, one lower case character, and one number or special character. Choose the email with more care than the password. The password is changeable from inside the app; the email is the thing the whole credential hangs off, and it is the field that locks people out years later.

Verify your first document. You begin at Basic strength — personal details only, which myID says gives access to limited participating government online services — and you climb by verifying documents. Enter the details exactly as they appear on the document, including any punctuation and spacing in names, because the app is checking your entry against the issuing agency's own record rather than reading the card.

Verify a second document to reach Standard. Standard strength needs any two of the accepted Australian documents and unlocks most participating government online services. For most people this is the practical stopping point unless they specifically need Centrelink linking, myGov recovery or a business authorisation.

Turn on the security features while you are still in the app. Enable your device's biometric unlock — fingerprint or face recognition — for faster and safer sign-in, and switch on push notifications. Notifications are not cosmetic: they are what tells you that your myID has been used, or activated on another device, at the moment it happens rather than a fortnight later.

Identity strength is myID's measure of how confident it is that you are who you say you are, and it maps directly onto what you can do. Basic is your details with no documents verified, or only one; myID describes the result as access to limited participating government online services. It is a starting position rather than a destination.

Standard requires any two Australian identity documents from myID's accepted list — Australian passport, driver licence, birth certificate, citizenship certificate, visa, ImmiCard, or Medicare card. The Medicare card carries a condition: myID treats it as a document you verify after another one, not as a first document. Standard is the level myGov requires to sign in, create an account or make a digital statutory declaration.

Strong adds a one-off face verification check — a selfie taken with the device's front-facing camera — on top of verified documents. myID says the check is confirming three things at once: that you are a real person, that you are the right person, and that you are verifying in real time. There are exactly two routes to Strong. The passport route means verifying an Australian passport with a photo plus one other document. The driver licence route is available only to Western Australian licence holders, who verify a WA driver licence with a photo, a Medicare card, and one further document.

That second route is worth stating plainly because it is a genuine federal quirk: a driver licence gets a Western Australian to Strong strength, and the identical licence issued in any other state or territory does not. Everyone in New South Wales, Victoria, Queensland, South Australia, Tasmania, the Australian Capital Territory and the Northern Territory needs a current or recently expired Australian passport to reach Strong, and there is no third path published on the myID site.

Strong is required for two things most people meet eventually. myGov requires it to link Centrelink and to recover your account when you cannot sign in. The Relationship Authorisation Manager requires it for a principal authority to link a business online — with Standard as the minimum for the alternative, non-online linking methods, and Standard also the minimum for authorisation administrators, authorised users and machine credential administrators acting on a business's behalf.

One consequence of strength being device-specific deserves repeating here rather than in the device section. If you hold Strong on an old handset and Standard on a new one, some of the app's own management functions will refuse to run until the strengths match. myID states that to delete another device from your account, your current identity strength must match the highest level you have achieved. That is a sensible anti-hijack rule, and it is also the reason a half-finished phone migration leaves you unable to tidy up after yourself.

Do this before you dispose of the old handset if you possibly can. Nothing about the process technically requires the old phone, but having it lets you check the exact email address recorded against your myID and delete the old device from your account afterwards, and both of those steps get harder once the phone is wiped and traded in.

Confirm the email address first. On the old device, go to My identity and then myID email. That string — not the one you assume you used, not your current work address — is what you must type on the new phone. myID's guidance on updating the email adds a condition that matters if you have several devices: make the change from the device with the highest identity strength.

On the new phone, download myID from the App Store or Google Play and select 'I am an existing user'. This is the step people miss. Setting up as a new user with the same details produces the error myID codes as 45056, an 'unable to verify' message caused by details that do not match the myID record already held against you.

Enter your latest myID email address. Enter a different one and you will lock your myID and be unable to use it — myID states this without qualification in its top enquiries. If you no longer have access to the email address you originally used, stop here and phone the support line on 1300 287 539 rather than improvising with a new address.

Re-verify your identity documents on the new device to match the highest strength you previously held. myID recommends using the same documents you used the first time, which is sound: those are the ones already known to match the issuing agency's record. If you held Strong, that means the passport and the face verification check again, not merely the two documents that got you to Standard.

Expect a security notification. myID sends an email and, where they are enabled, a push notification telling you that your myID is now active on another device. If that message arrives and you did not trigger it, treat it as a compromise and phone 1300 287 539, selecting option 2 twice for compromised myID enquiries.

Finally, remove the old handset. In the app, go to More, then My devices, select the device and choose Delete device. This is where the strength-matching rule bites — your current identity strength must match the highest you have achieved before myID will let you delete a device, so finish the re-verification before you try to tidy up.

If the app misbehaves after a transfer — errors when you try to reach an online service, particularly after an operating system migration copied the app across — myID's own fix is to select More from the app dashboard, then Reset app, and follow the prompts. A reset is not a deletion: it clears the local credential so the app can be set up cleanly again as an existing user.

Start with the boring causes, because myID names them first. If the app is behaving oddly, quit it and try again, then check that your device's time and date are set to automatic and the language is set to English (Australia). Verification calls are time-sensitive and locale-sensitive, and a device clock that has drifted produces failures that look like document problems.

The most common document error is 45048, a '422 could not verify details' message, which means what you typed could not be matched with the document's issuing agency — the classic example being Medicare card details that do not match the record Medicare holds. Check the entry character by character before retrying. After five unsuccessful attempts you will get 'Max attempts reached' and must wait 24 hours before trying again, which converts a typo into a lost day.

Error 45056 is the identity-collision error and it has three usual causes: a shared email address, an email address that is no longer current, or a name change that has not been verified. It appears most often when someone sets up as a new user on a new phone instead of an existing one. The fix is to use a personal email address only you can access, confirm which email is actually recorded against your myID, and set up again using your original details.

Each document type has its own disqualifiers, and they are stricter than people expect. An Australian passport cannot be verified if it has been cancelled — which includes being replaced or reported lost or stolen — or if it has been expired for more than three years. A driver licence cannot be verified if it has been cancelled or refused; a Tasmanian licence cannot be verified once expired; and a Western Australian licence cannot be verified if it is more than six months expired or has been blocked. A citizenship certificate that does not show your full date of birth cannot be verified online at all. A visa cannot be verified if it was issued before 1 July 1990, if it has expired, or if you have recently become an Australian citizen. Birth certificate rules vary by registry, but generally require the registration number and the names exactly as shown on the certificate. If you hold both an Australian and a foreign passport, use the Australian one.

Face verification errors arrive with codes in the LIV000001 to LIV000010 range. The causes myID lists are practical rather than mysterious: camera access not granted, poor lighting, something obscuring your face such as glasses, closed eyes, an unsteady device, or holding the phone too far away. The published remedy is equally practical — improve the lighting, remove the obstruction, look at the camera, hold the device still, try a different internet connection, and if it still fails quit the app, wait five minutes and try again.

Two other codes are worth recognising. NWK000003, 'something went wrong', is a connection problem: switch between Wi-Fi and mobile data, log out, wait five minutes and retry. CR1002, 'account unavailable', means myID cannot authenticate your account at all, and the only published action is to contact the support line — there is no self-service path out of it.

If the blocker is that you have no Australian passport and no Western Australian licence, accept Standard and work around it. Standard opens most participating services and is enough to sign in to myGov. Where a service genuinely requires Strong, fall back on that agency's non-digital identity check — a linking code, a phone verification, or an in-person visit — which section 74 of the Digital ID Act preserves by making Digital ID voluntary in the first place.

This is the reason a Strong myID is worth the trouble. When you cannot receive an SMS code, cannot open the myGov app, and cannot answer your secret question, Digital ID is the recovery route myGov publishes — and it works without a phone call, provided the pieces line up in advance.

Check the three preconditions first. myGov requires a myID at Strong identity strength; your name, date of birth and email address must match between your myGov account and your myID; and your myID must not already be connected to that myGov account. That last condition catches people out, because a myID already used as a sign-in method cannot double as the recovery mechanism.

Go to the myGov sign-in page and enter your username and password. Then select the option covering the failure you are actually having — the one worded around not getting your code, not being able to access your app, or not being able to answer your question. From there, choose 'Continue with Digital ID'.

Authenticate in the myID app using your password, fingerprint or face recognition, confirm the four-digit code shown in the browser, and review and consent to the details being shared. myGov describes the whole sequence as nine steps from the sign-in page; in practice it takes a couple of minutes once the strength and the matching details are in place.

If your myGov password has been disabled rather than merely forgotten, this route stalls. myGov's guidance is to contact the helpdesk to have the password reactivated before you can connect myID to the account. The helpdesk number is 132 307, option 1 for myGov, open 7am to 10pm Monday to Friday and 10am to 5pm at weekends in Australian local time, and closed on national public holidays. From overseas the number is +61 1300 169 468.

If you cannot use myID at all, myGov's stated fallback is to create a new account — and there is an important administrative detail attached. myGov will not let the same email address register twice, so the helpdesk can release your email address from the old account for use on the new one. Do that rather than inventing a second address, because a second address quietly creates a second identity trail across every agency you later link.

One limit to keep in view: the myGov helpdesk can help with signing in to and using your myGov account, but not with the services linked behind it. A Centrelink, Medicare or ATO problem has to go to that agency. And if you are calling on behalf of someone else — even as their nominee or representative — myGov requires the other person to be with you on the call.

Treat My devices as a security page you visit deliberately, not a screen you stumble into. myID's own protection guidance asks you to regularly review My devices and remove anything you do not recognise, and to check your sign-in history for activity you did not initiate. Both are in the app under More, and both are the earliest warning you will get that somebody else has a credential in your name.

Removing a device you no longer physically hold works the same way as removing one you do: More, then My devices, select it, then Delete device — subject to the rule that your current identity strength matches the highest you have achieved. If a phone was stolen rather than upgraded, do the deletion and then phone the support line, choosing option 2 twice for compromised myID enquiries, so the incident is recorded at the provider end rather than only on your handset.

Uninstalling the app does not close anything. myID states that removing the app from your device does not delete your Digital ID record, and that fully deactivating a myID requires contacting the support line. This matters when a phone is sold, lost or handed on: wiping the handset removes the app but leaves the identity record standing.

Changing your email address is done from My identity, then myID email — and if you have myID on more than one device, make the change from the device carrying the highest identity strength. If you attempt to set up with an address already attached to another myID you will get a 'this email is taken' error, and myID's published options are to use a different personal address or contact support.

Some details cannot be edited at all. myID says plainly that you cannot update your address or phone number in the app. Names and dates of birth are changed indirectly: under My identity, Identity details lets you switch between names you have verified from documents, and to correct a date of birth you verify a document carrying the right information and let the app update from it. There is no free-text field, by design.

The document you may need first is a change-of-name or marriage certificate, and here the app is narrower than the country. myID can verify change-of-name and marriage certificates issued by only some registries — the Australian Capital Territory, the Northern Territory, South Australia and Tasmania. Anyone whose name change was registered in New South Wales, Victoria, Queensland or Western Australia has to reach the same result by verifying other documents already issued in the new name, such as a reissued passport or licence.

If you believe your myID has been used by someone else, the sequence is: call 1300 287 539 and select option 2 twice; delete any device you do not recognise; change the password; and check the email account behind the myID, because an attacker with your inbox has the reset path for everything else. If personal or biometric information has been mishandled by an accredited provider rather than merely misused by a criminal, that is an OAIC matter — complain to the organisation first, then to the OAIC on 1300 363 992.

For business, myID alone does nothing. It proves who you are; it does not prove you are entitled to act for a business. That second question is answered by the Relationship Authorisation Manager, which lets businesses manage authorisations and confirm access to business online services, and which sits between your myID and anything you want to lodge, claim or update on the entity's behalf.

The sequence RAM publishes is three steps: get a Digital ID, link the business — online in RAM or by one of the alternative methods where online linking is not possible — and then create authorisations for the people who will represent it. Every one of those steps depends on the first, and the first depends on your phone, which is why a handset change breaks business lodgement as reliably as it breaks personal sign-in.

Identity strength is where sole traders and directors get stuck. RAM requires Strong identity strength for a principal authority to link a business online. If you cannot reach Strong, Standard is the minimum for the alternative linking methods — meaning the link is still possible, but not self-service. Standard is also the minimum for authorisation administrators, authorised users and machine credential administrators acting on behalf of a business.

Basic strength has a narrow role. RAM allows Basic for a basic user where Standard cannot be achieved, but adds the condition that decides it in practice: the service being accessed must itself support Basic-level access. Strength is negotiated twice — once by RAM, once by the individual service — and the lower of the two governs.

A sole trader is treated as both an individual and a business, which is why the setup feels duplicated. You verify yourself in myID, then link your own Australian Business Number in RAM as the principal authority, and only then does the business side of government open up. Being a sole trader does not exempt you from the linking step; it just means you are authorising yourself.

When something goes wrong with the authorisation rather than the identity, the phone number is the same but the menu path is not. RAM enquiries are 1300 287 539 option 3 then option 1, against option 2 then option 1 for myID. Both lines run 8am to 6pm Australian local time, Monday to Friday, closed on public holidays. From overseas, phone +61 2 6216 1111 and ask to be transferred to the line you need.

Plan the migration around your lodgement calendar. Because identity strength is per device and RAM will not accept a weaker credential than the role requires, changing phone in the week a business activity statement is due means re-verifying documents under time pressure — and if a document check fails five times you are waiting 24 hours before you can try again. Change the phone in a quiet fortnight, not a busy one.