Identity theft on your credit file is not a credit error. It is a different problem entirely and it needs a different response. When someone has used your personal information to apply for credit, open accounts, or incur debts without your knowledge, the damage shows up on your credit report in ways that can affect your borrowing for years. This is how to recognise the signs, what to do immediately, how to work with the bureaus and regulators specifically on fraud, and how to rebuild your file once the fraudulent activity has been addressed.
Key Takeaways
- Identity theft on your credit file means someone has used your personal details to obtain credit in your name. This is different from a general credit error and requires a specific response.
- The most common signs are enquiries you did not authorise, accounts you never opened, and defaults on debts you know nothing about.
- The immediate priority is to place a ban on your credit file to prevent further fraudulent applications, report to IDCARE, and report to police.
- If you believe an entry resulted from identity theft, clearly tell the credit reporting body that you are reporting fraud or identity theft rather than simply describing the entry as a general credit-reporting error. The process and evidence required are different.
- Both AFCA and the OAIC have specific roles in identity theft cases involving credit files.
- Prevention matters: monitoring your file regularly and knowing the early warning signs gives you the best chance of catching fraud before it compounds.
Most people discover identity theft on their credit file by accident. They apply for a home loan or a car and get declined. They pull their credit report and find accounts they have never heard of, enquiries from lenders they have never contacted, or defaults on debts they have never incurred. By that point the fraud has often been running for months.
The response to identity theft on a credit file is not the same as disputing a standard error. The steps are more urgent, the flagging process is different, and the documentation you need to provide goes beyond what a regular dispute requires. Acting quickly and in the right order matters significantly.
Signs of Identity Theft on Your Credit File
When you pull your credit reports from Equifax and Experian, these are the specific entries that should trigger immediate concern.
Credit enquiries you did not make
A hard enquiry is recorded every time a lender formally checks your credit file in response to a credit application. If you see enquiries from lenders you have never contacted, those applications were made by someone else using your identity. Multiple enquiries from different lenders within a short period are a particularly strong indicator of systematic fraud.
Accounts or credit products you never opened
Your consumer credit liability section lists every credit account in your name. An account you have no memory of opening, a phone plan you never signed up for, or a credit card you never applied for are all potential signs that someone has opened credit using your details.
Defaults on debts you know nothing about
A default from a lender you have never dealt with, or for an amount that does not correspond to any credit you have taken out, may indicate that a fraudulently opened account has been defaulted. These carry the full five-year credit file impact of any other default, even though you did not incur the debt.
Personal details that are wrong or unfamiliar
An address you have never lived at, a name variation you do not recognise, or an employer you have never worked for appearing in your personal details section can indicate that someone else has been using your identity in credit applications, or that your file has been partially mixed with another person’s data. Note that a mixed file, where another person’s data has been merged with yours due to a data matching error, is a different issue from identity theft and is addressed separately.
What to Do Immediately
If you believe your identity has been used to obtain credit without your knowledge, take these steps in order. Speed matters because each day without a ban on your file is a day another fraudulent application can be made.
Step 1: Place a ban on your credit file
A credit file ban prevents credit reporting bodies from disclosing your credit information to lenders, stopping further fraudulent credit applications from being processed in your name. Under the Privacy Act 1988, you can request a ban from a credit reporting body and ask that body to pass your request to the other relevant bureaus. A credit ban initially lasts for 21 days. If you still believe you are at risk of fraud at that point, you can request an extension. The OAIC also publishes guidance on bans at oaic.gov.au.
Step 2: Contact IDCARE
IDCARE is Australia’s national identity and cyber support service, funded by government and industry. They provide free specialist support for people dealing with identity theft and can help you navigate the reporting and recovery process. Contact them at idcare.org or on 1800 595 160.
Step 3: Report to the police
Lodge a report with your local police station or online through ReportCyber at cyber.gov.au/report. Keep your police report number as supporting evidence. You may need it when communicating with lenders, credit reporting bodies, and other organisations involved in the recovery process.
Step 4: Notify your bank and any affected financial institutions
Contact your bank and any lender whose accounts or credit products appear fraudulently on your file. Report the fraud, provide your police report number, and ask them to flag the accounts as fraudulent and cease any collection or reporting activity related to those accounts while the investigation is underway.
Step 5: Pull your full credit reports from both bureaus
If you have not already done so, request your reports from Equifax at mycreditfile.com.au and Experian at experian.com.au/consumer/order-credit-report. Review both in full and list every entry you did not authorise: every enquiry, every account, every default. This becomes your fraud inventory for the disputes that follow.
Fraud Listings vs Credit Errors: Why the Process Is Different
A standard credit error dispute involves telling the bureau that information on your file is inaccurate and providing evidence to support a correction. An identity theft case is different in three important ways.
| Standard Error Dispute | Identity Theft Case | |
|---|---|---|
| Nature of the problem | Information about your credit activity is recorded incorrectly | Someone else’s credit activity is recorded as yours |
| How to flag it | Dispute as inaccurate | Flag specifically as fraud or identity theft |
| Key evidence | Bank statements, payment receipts, correspondence | Police report, statutory declaration, identity documents, IDCARE reference |
| Credit file ban | Not typically required | Essential immediate step |
| Expected outcome | Correction or removal of the inaccurate entry | Correction or removal of fraudulent information once the claim has been investigated and the information is found to be inaccurate or improperly reported |
When you contact a bureau about identity theft, make it explicit in writing that you are reporting fraud or identity theft, not just a data error. Use the words “identity theft” and “fraudulent listing” clearly. Providing your police report number in your first communication can help support your case. Bureaus have dedicated fraud investigation processes that are separate from their standard dispute pathways, and identifying your case correctly from the start gets it into the right queue.
How to Work With Each Bureau on a Fraud Case
Both Equifax and Experian have fraud and identity theft reporting processes that sit alongside their standard dispute procedures.
Equifax
Contact Equifax through mycreditfile.com.au. In your written communication, state clearly that you are reporting identity theft, not a standard dispute. Provide your police report number, a copy of your identification, and a statutory declaration if you have one. List each fraudulent entry specifically: the lender name, the type of listing, and the date. Request that each fraudulent entry be investigated under their fraud process, and request a credit file ban on your Equifax file. Under the Privacy Act 1988, as confirmed by the OAIC, you can also ask Equifax to pass your ban request to other relevant credit reporting bodies.
Experian
Contact Experian through experian.com.au. Provide the same documentation: police report number, identification, statutory declaration, and a specific list of fraudulent entries. Request fraud flagging for each entry and a ban on your Experian file. Experian’s current consumer report combines information previously held by Experian and illion following their 2026 integration. When reporting fraud, provide details of every affected entry and follow Experian’s current fraud-reporting process to ensure all relevant records are covered.
What happens after you report
Once a bureau receives a fraud report, they are required under the Privacy Act 1988 and the Privacy (Credit Reporting) Code 2025 to investigate the disputed entries, block the listings during the investigation where appropriate, and notify you of the outcome. Credit-reporting complaints and correction requests generally have a 30-day decision timeframe under the Code, as confirmed by the OAIC, although complex identity theft cases may take longer and extensions can apply.
The bureau will contact the lenders associated with the fraudulent listings to verify the fraud. If the lender confirms the account was opened fraudulently, the listing should be removed. Keep records of all correspondence, reference numbers, and outcomes from each bureau separately.
For the general dispute process that applies once fraud has been confirmed and you are working through the correction of each listing, see our guide on disputing credit errors and unfair listings.
The Role of OAIC and AFCA in Identity Theft Cases
If a bureau or lender does not act appropriately on your fraud report, two regulators have specific roles in identity theft cases involving credit files.
Office of the Australian Information Commissioner (OAIC)
The OAIC regulates how credit reporting bodies handle personal information under the Privacy Act 1988. If a bureau fails to investigate your fraud report properly, refuses to remove fraudulent listings after fraud has been confirmed, or handles your personal information in a way that worsens the fraud impact, you can lodge a complaint with the OAIC at oaic.gov.au.
The OAIC can investigate whether the bureau or credit provider has breached the Privacy Act or the CR Code in how they handled your fraud case. This is a free service. The OAIC also publishes guidance specifically on fraud and your credit report at OAIC.
Australian Financial Complaints Authority (AFCA)
AFCA handles complaints between consumers and financial firms, including banks, lenders, and other credit providers. If a lender whose account was opened fraudulently in your name refuses to acknowledge the fraud, continues reporting the fraudulent account to bureaus, or pursues debt collection against you for the fraudulent debt, you can lodge a complaint with AFCA at afca.org.au.
AFCA can require lenders to cease collection activity on fraudulent accounts, correct fraudulent credit listings, and in some cases award compensation for financial loss or distress caused by their failure to respond appropriately. This service is also free for consumers.
Recovering Your Credit File After Identity Theft
Once fraudulent entries have been investigated and removed, your credit file will not automatically reflect its pre-fraud state overnight. Here is what the recovery process typically involves.
Obtain written confirmation from affected lenders
Contact each lender whose account appeared fraudulently on your file and request written confirmation that the account has been closed, that you are not held liable for the debt, and that they have instructed the relevant bureau to correct or remove the listing. This is separate from the bureau’s own correction process and important for your own records if the matter resurfaces.
Confirm removal in writing from each bureau
Once a bureau has investigated and confirmed the fraudulent listings, request written confirmation that each entry has been removed. Check your updated credit report from both Equifax and Experian to verify the removals have taken effect.
Review your file for any remaining fraudulent entries
Fraud cases sometimes involve more entries than are initially visible. Once the first round of removals is complete, review your file again carefully. Additional fraudulent enquiries or accounts may have been added during the period between the initial fraud and the ban being placed.
Decide whether to maintain the ban or lift it
A credit file ban can be renewed. If you are not yet ready to apply for credit and want continued protection, you can keep the ban in place. If you need to apply for credit, you can request the ban be lifted. Notify each bureau separately when you are ready to lift it.
Build positive repayment history going forward
If any genuine credit accounts were affected during the fraud period, consistent on-time payments from this point forward contribute positively to your repayment history information. Time and clean behaviour are the most reliable path to score recovery once fraudulent listings have been addressed.
Keep your fraud documentation permanently
Retain your police report, IDCARE case reference, all bureau correspondence, and confirmation of removals indefinitely. Identity theft cases can resurface if a fraudulent debt is sold or if records are not fully corrected across all systems. Your documentation is your evidence if the issue reappears.
Preventing Identity Theft on Your Credit File
Catching fraud early limits the damage significantly. The longer fraudulent activity runs on a credit file, the more entries accumulate and the longer the recovery process takes.
- Check your credit reports regularly. You are entitled to one free report from each bureau every three months. Reviewing both Equifax and Experian reports regularly is one of the most effective ways to spot unauthorised activity before it compounds. An enquiry you do not recognise is an early warning sign worth investigating immediately.
- Consider credit monitoring. Both Equifax and Experian offer paid monitoring services that alert you when new enquiries, accounts, or listings appear on your file. For people who have been victims of identity theft previously or who have reason to believe their personal details have been compromised, monitoring provides earlier notification than quarterly checks alone.
- Protect your personal information carefully. Most credit-related identity theft relies on access to key personal details: full name, date of birth, address history, and identification document numbers. Be cautious about where you provide these details, particularly online, and be alert to phishing attempts by email, phone, and SMS.
- Act immediately on suspected breaches. If you receive notification that your personal data was involved in a data breach by an organisation you deal with, treat that notification seriously. Contact IDCARE, review your credit file, and consider placing a precautionary ban. The window between a data breach and the first fraudulent credit application can be very short.
- Know what a ban does and does not cover. A credit file ban prevents bureaus from disclosing your credit information for new credit applications. It does not prevent all forms of identity theft and does not protect accounts that are already open. For the full detail on what a ban covers and how to place one, see our guide on how to place a ban on your credit file in Australia.
Useful Official Resources
- IDCARE: 1800 595 160 — Australia’s national identity and cyber support service, free specialist help for identity theft victims
- ReportCyber: Report a cybercrime — Australian Government online reporting for identity theft and cybercrime
- OAIC: Fraud and your credit report — official guidance on identity theft and credit reporting
- OAIC: Make a credit reporting complaint — for complaints about bureau handling of fraud cases
- AFCA: Make a complaint — for complaints about lenders involved in fraudulent accounts
- MoneySmart: Credit scores and credit reports — ASIC’s consumer guidance on credit reporting rights
Found Something on Your Credit File You Did Not Put There?
If you have identified entries on your credit report that you did not authorise, we can help you understand whether you are dealing with identity theft, a data error, or a mixed file, and what the right next steps are for your specific situation.
Kuldeep Singh founded Easy Credit Repair with over 17 years of experience in the Australian financial services landscape. His approach is grounded in Australian Credit Law, compliance, and genuine consumer advocacy. Easy Credit Repair operates as a transparent, expert-led service focused on long-term financial health and education, not shortcuts or unrealistic guarantees. Kuldeep supports clients across Sydney, Melbourne, Brisbane, Perth, Adelaide, and Tasmania.
Frequently Asked Questions
How do I know if someone has stolen my identity and used it for credit in Australia?
The most reliable way is to check your credit reports from both Equifax and Experian. Signs of identity theft include enquiries from lenders you have never contacted, credit accounts you did not open, defaults on debts you have no knowledge of, and addresses or employer details in your personal section that you do not recognise. You are entitled to a free report from each bureau every three months under the Privacy Act 1988.
What should I do first if I find identity theft on my credit report?
Place a ban on your credit file with both Equifax and Experian immediately. This prevents further fraudulent credit applications being processed in your name. Then contact IDCARE on 1800 595 160 for specialist support, and report the matter to police. Your police report number is essential documentation for every subsequent step, including disputing fraudulent listings with the bureaus and engaging with regulators.
What is IDCARE and can they help with credit file fraud?
IDCARE is Australia’s national identity and cyber support service, available free to the public. They provide specialist case management for identity theft victims, including guidance on reporting to police, notifying bureaus and lenders, and managing the recovery process. They are the most appropriate first contact for anyone dealing with identity theft in Australia and can be reached at idcare.org or on 1800 595 160.
Is disputing identity theft on a credit file different from disputing a regular error?
Yes, significantly. A regular error dispute involves correcting inaccurate information about your own credit activity. An identity theft case involves removing entries that belong to someone who used your identity without permission. The flagging language, the evidence required, and the investigation pathway are all different. You should explicitly use the words “identity theft” and “fraudulent listing” in all communications, and provide your police report number from the start.
Will a credit file ban stop identity theft?
A credit file ban prevents credit reporting bodies from releasing your credit information when a lender requests it for a new credit application. This makes it significantly harder for a fraudster to successfully obtain new credit in your name while the ban is active. It does not protect accounts that are already open, and it does not prevent all forms of identity theft. It is an important protective measure but not a complete solution on its own.
How long does it take to remove fraudulent listings from a credit file in Australia?
Credit-reporting complaints and correction requests generally have a 30-day decision timeframe, as confirmed by the OAIC, although identity theft cases can take longer because they require the bureau to verify the fraud with each lender involved. More complex cases involving multiple fraudulent entries across different lenders may take several months to fully resolve. Keeping detailed records of all correspondence and reference numbers helps you track progress and escalate promptly if timelines are not met.
Can I complain to the OAIC about how a bureau handled my identity theft case?
Yes. If a credit reporting body fails to investigate your fraud report properly, refuses to remove fraudulent listings after fraud has been confirmed, or handles your personal information in a way that does not comply with the Privacy Act 1988, you can lodge a complaint with the OAIC at oaic.gov.au. The OAIC has specific oversight of how credit reporting bodies handle personal information, including in fraud cases, and the complaint service is free.
What is the difference between identity theft and a mixed credit file?
Identity theft means someone has deliberately used your personal details to obtain credit without your knowledge. A mixed credit file occurs when a credit reporting body has accidentally merged another person’s data with yours due to a matching error, typically because of similar names, addresses, or identification details. Both result in unfamiliar entries on your credit report, but the cause, the response, and the resolution process are different. Our guide on what a mixed credit file is and how to fix it covers the mixed file scenario separately.
Can identity theft permanently damage my credit score in Australia?
Removing fraudulent information should allow your credit report and score to reflect your genuine credit history more accurately. The extent and timing of any score change will depend on the information remaining on your file and the scoring model used by each bureau. The damage is proportional to how long the fraud ran before it was detected and how many entries were created. Acting quickly when you first suspect fraud limits the number of entries that need to be resolved and shortens the overall recovery period.