Recovering your identity
Identity Protection
Credential Protection Register
The Credential Protection Register (CPR) helps protect Australians from identity crime. It prevents identity documents that have been compromised in a data breach from being used to verify someone's identity through the Document Verification Service (DVS).
The Australian Government established the CPR in 2022 after several major data breaches. It is part of Australia's national identity verification system. Since it launched, the CPR has blocked hundreds of thousands of fraudulent identity verification attempts.
Once a document is added to the CPR, it cannot be verified through the DVS. This helps stop compromised documents from being used in identity verification processes that rely on the DVS.
Adding a document to the CPR does not affect its main purpose. For example, an Australian passport that is on the CPR can still be used for international travel.
If your identity document is known to have been compromised in a data breach, it may be added to the CPR by the organisation that issued the document. In this scenario, no action is required from you.
IDLock
IDLock is coming soon.
This new online service will give Australians more control over how their eligible identity documents are protected through the Credential Protection Register (CPR).
With IDLock, you will be able to:
- block eligible identity documents from being verified through the Document Verification Service (DVS)
- unblock eligible identity documents when needed
- receive notifications about DVS verification checks involving your enrolled documents
- view the protection status of your enrolled documents.
IDLock will first be available through an early access program. We plan to make it available more broadly as part of a national rollout in 2027.
Identity recovery
There are often signs if your identity is being misused. You might be a victim of identity crime if:
Items appear on your credit card statements that you don’t recognise.
Someone steals or obtains a government benefit, payment or refund in your name.
You receive bills or invoices for goods or services you haven't asked for.
Mail expected from your bank doesn’t arrive or you receive no post at all.
You are refused a credit card or a loan, despite having a good credit history.
A mobile phone contract is set up in your name without your knowledge.
You receive letters from solicitors or debt collectors for debts that aren't yours.
If you have been a victim of identity crime or suspect your identity has been stolen, it is important to act quickly to minimise any financial loss or other damage.
Contact your financial institution and tell them what happened.
Report the matter to your local police and ask for a police report or reference number. You can present this to an organisation (such as a government agency, financial institution or credit agency), to support the claim that you are the victim of identity crime. This may help you fix your business or personal affairs with the organisation.
Report any identity theft or cybercrime matter at Report | Cyber.gov.au. These crimes might be relating to online accounts, services or applications.
Apply for a Commonwealth Victims’ Certificate. This can also be used to support your claim that you have been the victim of Commonwealth identity crime.
Change your account passwords and close any unauthorised accounts.
If you know that one or more of your identity documents has been compromised, contact the issuing organisation and let them know.
Visit Scamwatch for assistance with recognizing, avoiding, and reporting identity scams (even if you are not a victim).
If you’ve clicked on a suspicious link or given your identity information to a scammer impersonating myGov or Services Australia (including Centrelink, Medicare or Child Support), contact Services Australia’s Scams and Identity Theft Helpdesk. The helpdesk will support you with advice about how to protect yourself and your identity information.
IDCARE
IDCARE is a national support centre for victims of identity crime. IDCARE offers a free service to assist victims with repairing the damage to their reputation, credit history and identity information. For more information, visit the IDCARE website or call 1800 595 160.
Victims of Commonwealth identity crime
If you have been a victim of identity theft, you may be eligible for a Commonwealth Victims’ Certificate. A Commonwealth Victims' Certificate may be helpful if the theft is causing problems with your business or personal affairs.
Commonwealth identity crime
Commonwealth identity crime occurs where:
a person makes, supplies or uses identification information (yours or a third party's)
they do this so that they or someone else can pretend to be you or another person (whether that person is real, fictitious, living or dead)
the act of pretending would be done to commit or help commit a Commonwealth indictable offence.
A Commonwealth indictable offence is an offence against a Commonwealth law that is punishable by more than 12 months' imprisonment. For Commonwealth identity crime to be committed, someone only needs to intend to pass themselves off as another person, regardless of whether the Commonwealth indictable offence actually happened.
Examples of victims of Commonwealth identity crime are:
- your birth certificate was used by someone else to falsely claim a Centrelink payment in your name
- a person pretended to be you by using your identification details to have your Medicare rebates redirected to their bank account
- a person used your credit card without your permission to purchase and import illegal substances
- a person established a false business in your name to fraudulently claim GST
- a person used your passport or citizenship details to pass themselves off as you and travel overseas.
Commonwealth Victims' Certificates
A Commonwealth Victims' Certificate is provided by a state or territory magistrate to a victim of Commonwealth identity crime. The certificate:
- records the name of the victim.
- describes the circumstances in which the person has been a victim of Commonwealth identity crime.
The perpetrator or alleged perpetrator of the Commonwealth identity crime offence will not be identified in the certificate. The certificate helps support your claim that you have been the victim of Commonwealth identity crime.
You can present the certificate to an organisation such as a government agency or a business (for example, a financial institution or credit agency). This may help you to re-establish your credentials or remove a fraudulent transaction from their records.
A certificate does not require any organisation to take a particular action. It will not automatically re-establish your credit rating or remove a fraudulent transaction from your record. It is also not admissible in any legal proceedings.
Applying for a certificate
You can apply for a certificate if:
- you have been the victim of Commonwealth identity crime.
- a certificate would help to correct problems with your personal or business affairs caused by the Commonwealth identity crime.
You will need to complete an application for a Commonwealth Victims' Certificate and a Commonwealth statutory declaration:
Submit the completed application form and statutory declaration to a magistrate of a state or territory magistrate’s court.
You will need to present proof of your identity to the magistrate (for example, a driver licence or passport). The magistrate may seek further information from you to help them decide whether to issue a certificate. Details of state and territory magistrates are listed at the bottom of this page.
The magistrate will only issue a certificate if they are satisfied on the balance of probabilities that:
- another person used identification information intending that it would be used by someone to pretend to be another person (real or fictitious), and that this would be done to commit or help commit a Commonwealth indictable offence
- a certificate may help you to address problems with personal or business affairs resulting from these events.
The magistrate does not need to determine whether a Commonwealth identity crime has been committed by a particular person or business before a certificate is granted.
Identification information
Under the Criminal Code Act 1995 (Cth), your identity information is any personal information or data that can help to confirm who you are or how to find you. It may be information on its own or in context with other information.
Examples of identification information includes your (or a third party's):
- driver licence
- passport
- citizenship details
- bank account details
- credit card details
- personal information such as a name, address or date of birth.
Certificates for organisations
An organisation can also be affected by Commonwealth identity crime. An organisation can apply for a Commonwealth Victims' Certificate if a certificate might help that organisation to rectify the impacts of identity crime on their business.
Unsuccessful applications
A magistrate may decide not to issue you with a Commonwealth Victims' Certificate. If this happens, you can still seek help from the relevant government agency or organisation. You should provide information and evidence that may demonstrate that you have been a victim of identity crime.