Finding out your identity has been compromised can be upsetting and unsettling. You might notice a transaction you don’t recognise, be contacted about a loan you never applied for, or receive a call suggesting your personal details are being used somewhere else. However it comes to light, it’s completely understandable to feel stressed, confused or unsure about what to do next.
While the situation can feel overwhelming, taking the right steps early can help limit the impact. The first 48 hours are particularly important, and having a clear, simple plan can make it much easier to regain control. This guide walks you through what to do, step by step, so you can protect yourself and move forward with confidence.
Stay calm and act quickly
Identity compromise doesn’t always begin with obvious warning signs. In many cases, it starts with small changes that are easy to explain away or miss altogether. That might be an unfamiliar email, a payment being declined, a letter that never arrives, or a transaction that just doesn’t look right when you glance at your statement.
If something feels off, it’s worth paying attention to that feeling. You don’t need to have all the answers straight away, and you certainly don’t need to do everything at once. Focusing on a few practical steps, taken in order, can help reduce stress and make the situation feel more manageable.
If you’re helping a partner, parent or another family member, working through the steps together can also provide reassurance during what can be a worrying time.
Within the first few hours: secure your finances
1. Contact your bank as soon as possible
If you think your identity details or banking information may have been compromised, getting in touch with your bank should be your first priority. Letting them know early gives them the best chance to protect your accounts and reduce the risk of further loss. Depending on the situation, they may be able to:
- Place temporary blocks on accounts or cards
- Stop or investigate suspicious transactions
- Monitor your accounts more closely for unusual activity
- Cancel cards and issue replacements or update account details
Even if you’re not completely sure something is wrong, it’s still worth making the call. Banks deal with situations like this regularly and can talk you through what’s happening and what to do next.
If you’re an Auswide Bank customer, you can find contact details on the Contact Us page of our website or visit your nearest branch for support.
2. Change your passwords and PINs
Next, update the passwords for your online banking, email accounts, shopping websites and any other services that store personal or financial information. Your email account is especially important, as it’s often used to reset passwords for other services.
A strong password should:
- Be long (at least 12 characters)
- Avoid personal details like birthdays, names or pet names
- Be unique for each account
If keeping track of many passwords is difficult, consider using a reputable password manager to store all your passwords securely.
Within 24 hours: stop further damage
3. Report the incident to IDCARE
IDCARE is Australia and New Zealand’s national identity and cyber support service, offering free and confidential help to people affected by identity compromise. They can help you understand what information may have been exposed and what the potential risks are in your situation.
IDCARE can:
- Assess what’s happened
- Provide a personalised response plan
- Help you reduce the chance of further misuse of your identity
This step is particularly helpful if you’re feeling overwhelmed or unsure where the breach may have occurred.
4. Contact credit reporting agencies
If someone has access to your identity details, they may try to take out loans or credit cards in your name. To reduce this risk, you can request a temporary credit ban (also known as a credit freeze) on your credit report.
In Australia, this can be done for free through:
- Equifax
- Experian
- illion
A credit ban does not affect your credit score. It simply alerts lenders that extra checks are required before approving credit in your name and can be extended if you need it for peace of mind.
Within 48 hours: document and strengthen your response
5. Gather and keep your records
It’s a good idea to start a simple folder, either digital or paper, to keep track of everything related to the incident. Include details such as:
- Dates and times of suspicious activity
- Who you spoke to and what was discussed
- Any reference numbers or case IDs
- Copies of emails, letters or screenshots
Having everything in one place can make follow‑ups much easier and may be invaluable if any issues arise down the track.
6. Report the incident to the right places
If your identity has been misused online, or the incident involves hacking, scams or online fraud, lodge a report with ReportCyber, the Australian Government’s cybercrime reporting service.
If the issue began with a scam, such as a phishing email, phone call or text message, it’s also important to report it to Scamwatch. Scamwatch tracks scam activity and helps warn other Australians.
When identity compromise results from a scam, reporting to both services is recommended.
7. Watch out for follow‑up scams
Unfortunately, scammers often target people who’ve already been affected, hoping to take advantage of confusion or concern. In the weeks that follow, be cautious of:
- Calls offering to “fix” the problem for a fee
- Messages asking you to urgently confirm personal details
- Communications claiming to be from banks or government agencies
If you’re ever unsure, stop and check. Contact organisations using official phone numbers or websites you find yourself, rather than details provided in messages.
8. Understand how your identity was compromised
Once the immediate risks have been addressed, it’s worth spending some time understanding how your personal information was exposed. Knowing this can greatly reduce the chances of it happening again.
Ask yourself:
- Did you click on a link or open an attachment unexpectedly?
- Were you contacted by someone claiming to be from a trusted organisation?
- Do you reuse passwords across multiple accounts?
- Were your details part of a known data breach?
Common causes include phishing emails, fake phone calls (often called spoofing), weak or reused passwords, malware on devices, or large‑scale data breaches. If you’re unsure, IDCARE can help identify possible entry points. This step isn’t about blame, it’s about strengthening your protection going forward.
Ongoing vigilance
9. Monitor your accounts
Identity compromise isn’t always resolved in a few days, and misuse of stolen information doesn’t always happen straight away. In some cases, issues may not appear for weeks or even months.
Continue to keep an eye on:
- Bank and credit card statements, including small or unusual transactions
- Emails or letters relating to accounts or services you don’t recognise
- Your credit report for new enquiries or unfamiliar accounts
- Any changes in mail delivery or missing official correspondence
Even minor irregularities are worth following up early, as prompt action can help prevent longer‑term financial or legal issues.
10. Stay informed and protect yourself going forward
Scammers are constantly changing their tactics, which makes staying informed one of the most effective ways to protect yourself. Learning what to look out for and remaining cautious with unexpected contact can significantly reduce your risk.
Helpful habits include:
- Keeping up to date with scam alerts from trusted sources like Scamwatch
- Treating unsolicited calls, emails and messages with care
- Never sharing passwords, PINs or one‑time codes
- Keeping your devices and software up to date
If something feels rushed, unusual or uncomfortable, it’s always okay to pause and check. Taking a moment to verify can protect your identity, your finances and your peace of mind.
Having your identity compromised can feel personal and invasive, but it’s something many Australians experience. What matters most is how quickly and calmly you respond. If you’re ever unsure, ask questions, no concern is too small when it comes to protecting your identity and financial wellbeing.
Learn more about scams and tips for protecting yourself by visiting the Scam Support page on our website.
This information provides general advice only. We do not provide advice based on any consideration of your personal objectives, needs or circumstances.
