Resource ● Last updated 18 May 2026 ● 7 min read
How to identify and respond to online identity theft
In this article
Print & save
Share
Is this resource for me?
This resource is for anyone concerned about misuse of their personal information or those seeking guidance on what to do in the event of online identity theft.
What will I learn?
By the end of this resource, you’ll know how to:
- Spot the warning signs that someone may have stolen or assumed your identity.
- Understand what type of theft it is (which affects your legal options).
- Know what to do immediately to protect yourself.
- Understand your legal rights and the remedies that may be available.
PART 1: Test your knowledge
PART 2: What is identity theft?
Identity theft occurs when someone uses your personal information without your permission to impersonate you, usually to obtain a benefit, commit fraud, or to cause you harm.
Common ways identity theft happens include:
- Opening accounts: Opening a bank account, credit card, loan, or utility account in your name
- Fraudulent contracts: Using your details to obtain a mobile phone or internet contract
- Committing offences: Committing criminal or traffic offences while using your identity
- Fake profiles: Creating fake social media or online marketplace profiles in your name
- Medical fraud: Obtaining medical treatment or prescription drugs using your Medicare details
- Documents: Applying for a passport or travel document in your name
Red flags to look out for
The following are red flags to be aware of when it comes to online identity theft.
PART 3: Types of identity theft
Examples:
- Credit card or loan opened in your name
- Unauthorised purchases
- Phone contract
What you can do:
- Contact your bank to freeze your account
- Obtain a free credit report
- Place ban on your credit file
- Report to ReportCyber
What this may achieve:
- Fraudulent account may be cancelled
- Losses may be reimbursed
- Credit file may be protected
Examples:
- Debt collector contacting you about a loan you did not incur
- Being pursued for credit card debt you did not create
What you can do:
- Dispute debt in writing with credit provider and credit-reporting bodies
- Lodge a complaint with AFCA
What this may achieve:
- Incorrect debts may be removed from your credit file
- Debt collectors may be required to stop pursuing you
Examples:
- Someone who isn’t allowed to see your personal or sensitive information accesses, shares, or steals it
- You receive a notice from an organisation about a data breach involving your personal or financial information
- This may be followed by suspicious activity in your name
What you can do:
- Follow breached organisation instructions
- Place a ban on your credit file
- Seek advice from IDCARE
What this may achieve:
- Accounts protected
- OAIC may investigate the organisation’s data handling
Examples:
- Locked out of your email, social media, or banking accounts
- Someone impersonates you online
What you can do:
- Report to platform and ReportCyber
- Use account recovery options if you have them enabled
- Enable multi-factor authentication
What this may achieve:
- You may regain account control
- You may prevent further harm to your contacts or accounts
Examples:
- Someone claims Centrelink, Medicare, or tax benefits in your name
- You receive a letter from the ATO about claims you did not make
What you can do:
- Contact the relevant Government agency
- Change your MyGov passwords
- Report to ReportCyber
What this may achieve:
- Fraudulent claims may be cancelled
- Government records may be corrected
- Liability may be avoided
PART 4: Template letter for disputing a debt
If debts have been incurred as a result of identity theft, you can use this letter to send to your financial institution.
Adapt this template to your specific situation.
Fill in the highlighted fields with your own information.
[Date]
Dear [ORGANISATION NAME] / To whom it may concern,
I am writing to notify you that I have recently become aware that I am the victim of identity theft.
[Describe: when you learned of the theft; any known details about the person who stole or may have misused your identity; description of debts or accounts opened without authorisation; confirmation from your bank/credit provider that your identity has been compromised (if applicable)]
[Delete this paragraph or any bullet points if they do not apply:] This matter has been reported to:
- the police – reference number: [insert report number];
- [Insert regulatory body, e.g. ACCC / OAIC / AFCA] – reference number: [insert report number].
I dispute the debts or transactions listed above. These were incurred without my knowledge or consent. I request that you investigate this matter and suspend any collection action while the investigation is underway.
Yours sincerely,
[Your full name]
[Your contact details]
You can download this letter as a Word document below.
Template letter to dispute a debt
PART 5: What to do immediately if you think you’ve been affected
If you believe your identity has been stolen, take these steps as quickly as possible, ideally within the first 24 to 48 hours.
1. Contact your bank or financial institution
Use the official number on the back of your card. Never click a link from a suspicious email or SMS. Tell them you suspect identity theft. Ask them to freeze affected accounts, request written confirmation, and obtain a reference number.
- Request your free credit report from the major credit reporting bodies: Equifax and Experian.
- Review your report for unfamiliar accounts, loans, or credit enquiries.
- Ask each credit reporting body to place a free, initial 21-day ban on your credit file (extend if needed while investigations continue).
- Dispute any incorrect or fraudulent listings immediately.
2. Secure your online accounts
- Change passwords for all important accounts (email, banking, social media, government portals), especially if there is a common password. Use strong, unique passwords (12+ characters). Enable multi-factor authentication. Review recent login history for unknown locations or devices. Log out of all devices and sessions if your account allows.
3. Contact IDCARE for specialist support
- Call 1800 595 160 or visit idcare.org for a free, confidential response plan tailored to your situation. IDCARE is Australia’s national identity and cyber support service.
4. Document everything
- Record dates, times, reference numbers, and contact names for every call or email. Save copies of statements, emails, letters, and screenshots. Keep a running timeline of events (names, dates, times). This will help with police, banks, credit reporting bodies, and any future legal claims.
5. Report to ReportCyber and/or police
- Lodge a report at cyber.gov.au/report. If required, also report to your local police station. Keep all reference numbers, as banks and insurers often require them before investigating.
WARNING
Before responding to a debt collector, always visit their official website and confirm their contact details to ensure they are legitimate. If you have any concerns about whether a debt collector is genuine, contact the organisation they claim to represent directly, or seek assistance from Justice Connect or a legal advisor.
Key takeaways
Act quickly
It’s better to act quickly if you suspect identity theft. Delays can make it harder to stop losses and restore your identity.
Regularly check your bank accounts
Check credit reports, and online accounts for unusual activity or warning signs.
Keep detailed records
Keep records of all suspicious activity, steps you take, and your communication with organisations and government agencies.
Use your legal rights
There are legal remedies available. Banks, credit reporting bodies, and government agencies have duties to help you recover and protect your identity.
Seek help
Services like IDCARE, community legal centres, and government agencies can provide free support and guidance.
Reminder
Identity theft is a crime. It is not your fault, and help is available.
Key contacts
- Esafety Commissioner: esafety.gov.au — Online safety complaints and image-based abuse removal
- OAIC: 1300 363 992 | oaic.gov.au — Privacy complaints and investigations
- ReportCyber: cyber.gov.au — Report cybercrime online
- Equifax: 13 8332 | mycreditfile.com.au — Credit report and ban
- Experian: 1300 783 684 | experian.com.au — Credit report and ban
- Australian Financial Complaints Authority: 1800 931 678 | afca.org.au — Financial complaints if your bank doesn’t resolve the issue
- ACCC Scamwatch: scamwatch.gov.au
- Justice Connect: justiceconnect.org.au — Free legal advice for eligible Australians
Justice Connect is grateful to Telstra for their generous support to create this resource. Learn more about Telstra’s work building Australians’ digital skills and confidence so they can take part in the online world.
This resource was last updated on 18 May 2026. This is legal information only and does not constitute legal advice. You should always contact a lawyer for advice specific to your situation. Please view our disclaimer for more information.
More self-help resources
Do you need legal help?
You might be eligible for free legal help from our lawyers. Making an online application is the quickest and best way to apply for free legal help.
