Identity Theft Laws in Australia: Offences, Penalties, and Reporting

Identity theft laws in Australia operate on two levels: the Commonwealth Criminal Code Act 1995 covers offences that touch federal agencies, cross state borders, or run through phone and internet networks, while each state and territory has its own criminal legislation for everything else. Maximum prison terms reach five years under federal law and up to ten years in New South Wales. Separately, the Privacy Act 1988 puts obligations on organisations that hold your personal information, with civil penalties for serious breaches now reaching tens of millions of dollars.¹

Federal Offences Under the Criminal Code

Part 9.5 of the Criminal Code Act 1995 (Cth) is dedicated to identity crime. Division 370 defines the key terms, including what counts as “identification information” and “identity crime,” and Division 372 creates the actual offences.¹

Three offences do most of the work:

Section 372.1 makes it a crime to deal in another person’s identification information with the intent that it be used to commit or facilitate a Commonwealth offence. “Dealing” covers selling, transferring, or handing over details such as names, dates of birth, passport numbers, or tax file numbers.
Section 372.1A creates a parallel offence for dealing in identification information through a carriage service, meaning the internet or a phone network.
Section 372.2 targets possession of someone else’s identification information with intent to commit or help commit an offence, catching conduct earlier than a sale or transfer.
Section 372.3 criminalises possessing equipment designed to make or alter identification documents, such as card skimmers, blank card stock, hologram overlays, or forgery software. You do not need to have actually produced a fake document.

Commonwealth jurisdiction kicks in when the offending involves a federal entity such as the Australian Taxation Office or Medicare, when the conduct crosses state lines, or when it uses postal or telecommunications services. Because most modern identity fraud runs through the internet, that reach is wide. In those cases the Australian Federal Police and the Commonwealth Director of Public Prosecutions take carriage.

Identity crime charges are also commonly stacked with computer offences under Part 10.7 of the Criminal Code. Section 477.1 covers unauthorised access to or modification of data with intent to commit a serious offence, and section 478.1 covers unauthorised access to restricted data more generally.¹ A hack that leads to identity fraud will usually attract charges under both parts.

State and Territory Offences

State laws handle identity crimes that do not trigger federal jurisdiction, typically where the victim is a private business, another individual, or a state government service. Maximums vary.

New South Wales imposes the heaviest sentence. Section 192J of the Crimes Act 1900 (NSW) makes it an offence to deal in identification information with intent to commit or help commit an indictable offence, with a maximum of ten years’ imprisonment.²

Victoria caps the equivalent offence at five years. Section 192B of the Crimes Act 1958 (Vic) covers making, using, or supplying identification information to commit or facilitate an indictable offence.³

Queensland sits at the same level. Section 408D of the Criminal Code Act 1899 (Qld) prohibits obtaining or dealing with another person’s identification information for the purpose of committing an indictable offence, with a five-year maximum, and the same maximum applies to possessing equipment for that purpose.⁴

Penalties at a Glance

The headline maximums for identity-specific offences are:

Dealing in identification information, Commonwealth (s 372.1): five years.
Dealing via a carriage service, Commonwealth (s 372.1A): five years.
Possession of identification information, Commonwealth (s 372.2): three years.
Dealing in identification information, NSW (s 192J): ten years.
Making, using, or supplying identification information, Victoria (s 192B): five years.
Obtaining or dealing in identification information, Queensland (s 408D): five years.

Where a sentence lands within the maximum depends on the total financial loss, the number of identities compromised, the level of planning, whether the offender was part of an organised network, and prior convictions. Courts can also order restitution to compensate victims for direct financial losses on top of any prison term or fine.

What Prosecutors Have to Prove

Across both the federal and state offences, intent is the pivot. It is not enough to show that someone held another person’s details or forgery equipment. The prosecution has to establish that the accused intended the information or equipment to be used to commit or facilitate an offence, usually one classed as indictable or (federally) a Commonwealth offence. That intent requirement is why possessing a copy of someone’s details for a legitimate reason is not criminal, while holding the same details with a plan to open fraudulent accounts is.

Obligations on Organisations That Hold Your Data

Identity theft usually starts with a data breach somewhere upstream. The Privacy Act 1988 and the Australian Privacy Principles set the baseline for how businesses and government agencies must collect, store, and secure personal information.

The Notifiable Data Breaches Scheme

Under the Notifiable Data Breaches scheme, any organisation covered by the Privacy Act must notify both the affected individuals and the Office of the Australian Information Commissioner when a data breach is likely to result in serious harm. A breach can be a stolen device, a hacked database, or an email sent to the wrong recipient.⁵

Once an organisation suspects a breach, it has 30 calendar days to assess whether serious harm is likely. If the answer is yes, it must notify the OAIC through the online form and tell affected individuals what steps to take.⁶

Corporate Penalties

For a body corporate that commits a serious or repeated interference with privacy, the maximum civil penalty is the greater of $50 million, three times the value of any benefit obtained from the breach, or 30 per cent of the entity’s adjusted turnover during the relevant period. For an individual such as a sole trader, the maximum is $2.5 million.⁷ These figures replaced an earlier cap of roughly $2.2 million after several large breaches showed the previous ceiling was not a serious deterrent.

If your details have been exposed in a breach, you can complain directly to the organisation first. The OAIC treats 30 days as a reasonable response window. If you do not get an adequate response in that time, you can lodge a written complaint with the OAIC.⁸

If You’re a Victim: Reporting and Recovery

Report the crime through ReportCyber, the national cybercrime portal operated by the Australian Signals Directorate. If the identity theft was part of a scam, also report it to Scamwatch at the National Anti-Scam Centre. Check your bank accounts and superannuation for unauthorised transactions and contact your bank immediately to freeze any affected accounts. Fraud involving superannuation or cryptocurrency goes to the Australian Securities and Investments Commission.⁹

Change passwords on compromised accounts, turn on multi-factor authentication, and request a free credit report to look for accounts or loans you did not open. A credit ban prevents anyone from opening new lines of credit in your name while you work through the problem. The Australian Cyber Security Hotline is 1300 292 371.⁹

IDCARE is Australia and New Zealand’s national identity and cyber support service and provides free case management to help repair damage to your credit history, reputation, and identity records. The number is 1800 595 160.¹⁰

Victims of a Commonwealth identity crime can also apply for a Commonwealth Victims’ Certificate, a formal document issued by a state or territory magistrate that records your name and the circumstances of the crime. You can present it to banks, credit agencies, and government departments when asking them to remove fraudulent transactions or restore your records. The certificate does not compel any organisation to act and is not admissible as evidence in court, but in practice it makes the clean-up considerably easier.¹¹ To apply, you complete the application form and a Commonwealth statutory declaration and present both, with proof of identity, to a magistrate in your local court.

Who Investigates Identity Crime

The Australian Federal Police leads investigations under Commonwealth legislation, cases with an international dimension, and large-scale fraud that crosses state borders. State and territory police handle localised incidents, including fraud targeting local retailers or state government services. The Australian Criminal Intelligence Commission sits above individual investigations, collecting intelligence on serious and organised crime groups and feeding it to the AFP and state police. Identity crime syndicates rarely stay within one jurisdiction, so coordination between these agencies does a lot of the practical work.

1
Federal Register of Legislation. Criminal Code Act 1995
2
NSW Legislation. Crimes Act 1900 No 40
3
Legislation Victoria. Crimes Act 1958
4
Queensland Legislation. Criminal Code Act 1899
5
Office of the Australian Information Commissioner. About the Notifiable Data Breaches Scheme
6
Office of the Australian Information Commissioner. Part 4 – Notifiable Data Breach (NDB) Scheme
7
Australian Parliament House. Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022
8
Office of the Australian Information Commissioner. Make a Data Breach Complaint
9
Australian Signals Directorate. Report and Recover From Identity Theft
10
Attorney-General’s Department. Identity Protection and Recovery
11
Attorney-General’s Department. Application for a Commonwealth Victims Certificate