How do I put a ban on my credit report after identity theft?
Short answer
Ask a credit reporting body for a ban, or ask one to pass the request to the others. It is free, and the OAIC says an initial ban runs 21 days. During a ban the body must not disclose your credit report to lenders. Ask for an extension before it expires — commonly 12 months, with a police or ReportCyber reference.
Verified · 6 cited sources
A credit ban is a Privacy Act right, not a product a credit bureau sells you. Part IIIA of the Privacy Act 1988 contains the ban provisions, including section 20K — headed 'No use or disclosure of credit reporting information during a ban period'. The trigger is low: you need to believe on reasonable grounds that you have been, or are likely to be, a victim of fraud. You do not need to prove the fraud first, and you do not need to have lost money yet. This is the step to take in the hour after a wallet, a passport scan or a set of identity documents goes missing.
The OAIC explains what the ban actually does. During the ban period a credit reporting body must not use or disclose your consumer credit report except with your written consent or where the law requires it. When a lender runs a check it is told a ban is in place, which flags the application as possible fraud. The trade-off is that it becomes harder for you to apply for credit as well, because lenders will want to deal with you directly — so think about a pending home loan or car finance before you lodge.
Ask all the credit reporting bodies, because any of them may hold a file on you and lenders do not all use the same one. Australia's bodies are Equifax, Experian and illion; IDCARE and Experian both note that illion is now part of Experian, with illion enquiries redirected to the Experian platform. The OAIC says you do not have to lodge three separate requests: you can ask one credit reporting body to pass your request on to the others. Doing it yourself with each one is still the safer option if you want written confirmation from each.
The initial ban is short by design. Equifax and Experian both publish a 21-day initial period, free of charge, extendable for up to 12 months, and Experian states there is no limit to how many times a ban can be extended. The OAIC goes further: a credit reporting body must extend the ban if it believes you have been or are likely to be defrauded, and you must be given at least five business days' notice before a ban expires, including information about extending it. Do not rely on that notice — Equifax asks for extension requests at least five days before expiry and Experian asks for 10 days.
Extending usually needs evidence. Equifax asks for a police or cyber report reference number, or any other information showing you have been or are likely to be a victim of fraud, and IDCARE describes the same requirement — so lodge a ReportCyber report and keep the reference. Identification is required to lodge and to lift a ban; Experian lists a current Australian driver licence, a current Australian passport, a Medicare card and a Centrelink card among the documents it accepts. Both bodies run online forms. If a genuine credit application falls due mid-ban, Equifax's route is to lift the ban for the application and then lodge a fresh ban request once it has been finalised.
A ban is protection going forward — it does not clean up what has already happened. Fraudulent enquiries or defaults already on the file are removed through the separate correction process the OAIC sets out, and a ban has no effect on accounts you already hold. It is also not the same as your free credit report, which you are entitled to request and should read while the ban is in place. Alongside it, call IDCARE on 1800 595 160 for a free response plan, and tell your bank so a fraud marker sits on your accounts too.
- Free under the Privacy Act; you need only reasonable grounds to believe you may be defrauded
- Initial ban of 21 days, extendable — commonly for 12 months, with no limit on extensions
- Lodge with Equifax and Experian (which now covers illion), or ask one to pass the request on
- During the ban a credit reporting body must not disclose your report to lenders
- Extensions generally need a police or ReportCyber reference — get one early
- A ban stops new fraud; correcting existing false listings is a separate process
Go deeper
People also ask
Sources & provenance
Facts verified
- 1.Fraud and your credit report RegulatorOffice of the Australian Information CommissionerUsed for: The 21-day ban period, that it is free, the ban on use or disclosure during the period, the obligation to extend where fraud is believed, the option to ask one body to notify the others, and at least five business days' notice before expiry
- 2.Credit reporting RegulatorOffice of the Australian Information CommissionerUsed for: The free credit report entitlement, the separate correction process for inaccurate listings, and the privacy complaints route
- 3.Privacy Act 1988 — Part IIIA credit reporting LegislationFederal Register of LegislationUsed for: The statutory basis for a ban, including section 20K, 'No use or disclosure of credit reporting information during a ban period'
- 4.Credit report ban IndustryEquifax AustraliaUsed for: The 21-day initial ban, extension for up to 12 months or such other period as is reasonable, the police or cyber report reference sought in support, the advice to request an extension at least five days before expiry, and the lift-then-reapply route for a genuine credit application
- 5.Request a ban on your credit report IndustryExperian AustraliaUsed for: That bans and extensions are free with no limit on extensions, the 12-month extension period, the request to extend at least 10 days before the ban ends, the identification documents accepted, and that illion is now part of Experian
- 6.Credit bans in Australia OfficialIDCAREUsed for: That a ban does not affect existing credit lines, the option to apply through one body and have it notify the others, the evidence usually needed to extend, and the IDCARE support line on 1800 595 160
Not a source — AI-assisted analysis on this page
- AI-assisted analysis — the order to do this in — The sequence we recommend — ban first, ReportCyber reference next, correction of existing false listings afterwards — is our reasoning across the OAIC, Equifax, Experian and IDCARE pages. None of them sets out that order, and none of them warns you to check a pending home loan or car finance application before lodging a ban; that trade-off is our inference from the OAIC's statement that a body must not disclose your report during the ban. We also treat lodging directly with each body as safer than the single-request route the OAIC permits, on the reasoning that it produces written confirmation from each; the OAIC expresses no preference.
The ban period, the free-of-charge rule, the duty to extend and the notice before expiry come from the OAIC's fraud and credit reporting pages, with the statutory basis in Part IIIA of the Privacy Act 1988 as registered. The lodgement mechanics, identification requirements, extension evidence and the merger of illion into Experian are taken from the Equifax, Experian and IDCARE pages cited. Our own contribution is the sequencing advice — ban first, ReportCyber reference next, correction of existing false listings afterwards — the warning to check a pending loan application before lodging, and the preference for lodging separately with each body; no cited source presents that order, and all of it is disclosed in the sources list. Bureau processes, forms, identification requirements and extension periods are set commercially and change, so confirm the current requirement with each body before you rely on a timeframe.
Facts on this page are taken from the sources listed above — Australian government departments, regulators, statutory bodies and official statistical releases. Comparisons, judgements and "which option suits whom" conclusions are AI-assisted analysis written over those sources; they are marked in the text and listed as an AI-analysis entry in the sources, not attributed to any authority. Rates, thresholds, fees and processing times change, often at the start of a financial year; figures are current as at the review date shown and should be confirmed with the responsible agency before you rely on them for money or legal decisions.