What to do if your identity is stolen

A credit ban stops credit reporting bodies from disclosing your credit information, which in practice stops lenders approving new credit in your name. It is free and it is the single most effective immediate action.

You must do it with all three bodies separately — Equifax, Experian and illion — because different lenders use different bureaus and a ban with one leaves the others open. This is the most common mistake.

The initial ban lasts 21 days and can be extended. Where you have provided evidence that you have been or are likely to be a victim of fraud, extensions are routine.

At the same time, request your credit report from each bureau. You are entitled to a free copy, and it will show every credit enquiry and account in your name — which is how you find out what has already been opened.

IDCARE is a free, government-funded national identity and cyber support service. A case manager works through your specific situation and produces a written response plan setting out which documents to replace, which organisations to notify, and in which order.

This is genuinely more useful than a generic checklist, because response depends on exactly what was exposed. A leaked driver licence number requires a different sequence from a compromised myGov account, which requires a different sequence again from a stolen passport.

IDCARE also maintains current guidance on major Australian data breaches, including what was exposed in each and what the affected organisation is offering.

The service is free to individuals. If anyone charges you for identity recovery assistance, they are not IDCARE.

Report to ReportCyber at cyber.gov.au. The report is routed to state police, and it produces a reference number that banks, telcos, credit bodies and insurers frequently ask for before they will act. Getting it early removes a round of argument later.

Driver licence: most states will reissue with a new licence number where identity theft is established, and several have a specific process for it. Ask for a fraud reissue rather than a lost-card replacement, because a replacement keeps the compromised number.

Medicare card: Services Australia can issue a new card with a new number.

Passport: report it to the Australian Passport Office. A passport reported compromised is cancelled, which matters because a cancelled passport is worthless to a fraudster.

Tax file number: a TFN cannot be changed except in exceptional circumstances, which is precisely why it must be protected. Contact the ATO's Client Identity Support Centre, which can place additional protections on your record and monitor for misuse.

myGov and Digital ID: change credentials, review linked services, and check for changes you did not make — particularly bank account details for refunds and payments.

Change the password on your email account first, and enable two-factor authentication on it. Email is the recovery route for every other account, so it is the one an attacker most wants and the one to secure first.

Prefer an authenticator app over SMS for two-factor authentication. SIM-swap fraud — where an attacker ports your number to their own SIM — defeats SMS codes across every service at once. Ask your mobile provider to add a port-out lock or additional account security.

Check bank and card statements line by line for several months, including small transactions. Fraudsters commonly test a card with a very small purchase before a large one.

Watch for mail that stops arriving. Redirected mail is a classic identity fraud technique, and Australia Post has a process for reporting a redirection you did not request.

If a debt has been created in your name, dispute it in writing with the creditor and the credit reporting body, attaching your police report reference. Credit reporting bodies must investigate and correct information that is shown to be inaccurate, and if the creditor is a financial firm, AFCA can determine the dispute for free.