Identity theft and your credit file

A credit report is a matching exercise. Names, dates of birth, addresses in Lalor and then in South Morang, old mobile numbers, a driver’s licence digit — the bureaus stitch those into a file. When the stitch is wrong, you inherit someone else’s default. When a stranger uses your details on purpose, you inherit a fraud. The PDF can look similar. The response is not.

The OAIC is the privacy regulator for credit-reporting information. IDCARE is the national identity-and-cyber support service. Equifax and Experian are the current consumer reporting bodies most households meet. Plenty Credit publishes this as general information, in the same spirit the old co-operative used for a lost card: act quickly, keep notes, do not pay a stranger to do a free process slowly.

This is not a substitute for IDCARE, the police, or a lawyer if the facts are ugly. It is a map of the credit-file part of the problem.

How does identity theft show up on an Australian credit file?

Common warning flags, when you pull the free reports:

• an account, card or loan you never opened
• an enquiry from a lender you did not apply to — see hard versus soft enquiries
• a default or repayment-history line on that unknown account
• addresses you have never lived at, especially clustered with new accounts
• a former name you have never used
• employment or driver-licence details that are not yours
• a refusal letter for credit you never requested, which is sometimes how people find out

One unfamiliar enquiry can be a broker you did authorise, a “quote” you clicked at 11 p.m., or a lender’s soft look that still printed oddly. A cluster of hard enquiries and a new personal loan in a week is a different shape. Do not talk yourself out of a fraud file because you are embarrassed you clicked something. Do not talk yourself into a fraud file because one address is an old share house you had forgotten.

After the Experian–illion consumer combination, you still need both current files. Fraudulent activity can sit on one body and not the other, depending on which door the lender opened. Equifax, Experian and illion compared is that plumbing.

A score that suddenly drops is a symptom. The listing is the disease. What a good credit score means will not help until the false lines are gone.

How do you tell a mixed file from genuine identity theft?

A mixed file is a bureau error. The matching engine has decided that you and another person — a similar name, a shared old address, a junior and a senior, a digit wrong in a date of birth — are the same consumer. You may see their telco default, their inquiry for a car in Townsville, their middle name. They may see yours. Nobody “stole” anything. The drawer was mislabelled.

Identity theft (or identity crime) is a person using your information to apply, collect, or impersonate. There is a stranger, or a former partner, or a leaked database, in the story. The accounts are real products someone obtained. The debt is not yours, but a lender may start from the opposite assumption.

Clues that lean mixed file:

• the other person’s history is long and ordinary, not a sudden burst
• you recognise nothing about the applications and there is no other sign of fraud (unchanged email, unchanged bank login, no unexpected myGov mail)
• the “wrong” address is next door, or a previous occupant of your rented place
• the other person’s date of birth is a digit off yours

Clues that lean theft:

• new accounts you were not alive to the existence of
• goods delivered somewhere you have never been
• bank, myGov, or email accounts showing reset attempts
• a lender describing an application with a signature, selfie or licence that was not yours
• your lost wallet, a phishing SMS, or a data-breach notice sitting in the same month

You can have both. A thief can also create a mess that the bureau then mixes further. Treat the first afternoon as containment. Classification can wait until the accounts are stopped. How to dispute errors is the correction engine for either story; the evidence bundle differs.

What should you do in the first 48 hours?

Write everything down. Then close doors.

1. Contact each credit provider named on a suspect listing. Say you did not open the account, ask that it be marked fraud, and ask that no further collections proceed against you while they investigate. Get a reference number. Follow up in writing the same day.
2. Ask the credit reporting bodies for a ban, freeze or alert on your credit files, using the mechanism they and the OAIC describe for suspected fraud or identity theft. The vocabulary differs by body and by year; the job is the same: make it harder for the next fraudulent application to sail through on a clean match.
3. Secure the channels a thief uses next: bank logins, email, myGov, mobile-number porting. A credit-file freeze does not stop someone who already has your internet-banking password.
4. Call IDCARE on 1800 595 160. It is the national support service for identity and cyber incidents. It will not pay the debt. It will help you sequence the notifications so you do not spend the week repeating a story into twelve voicemails.
5. Do not start paying the fraudulent account “to protect your score”. Payment can be read as an admission. If a collector is already ringing, say the account is disputed as fraud, give the reference, and put it in writing.
6. Keep a folder: reports, letters, call logs, IDCARE reference, lender references. The old May Road habit of printing the page still beats a vanished chat.

If you are also behind on genuine debts, keep those two piles separate. Hardship on your real card is still the hardship letter. Mixing it with a fraud dispute confuses both files.

What is IDCARE, and when do you need a police report?

IDCARE is a specialist support organisation, not a lender and not a bureau. It helps people in Australia and New Zealand respond to identity theft, scams and data-breach fallout. The MoneySmart identity-theft guidance and related pages point people toward practical steps; IDCARE is the organisation that sits with the sequence. Use it early. It is better at this than a credit-repair sales line.

A police report (or an online report through the Australian Cyber Security Centre’s ReportCyber pathway, depending on the facts) is often the document a bank, a bureau or a lender wants before it will treat the account as crime rather than a customer dispute. It is not required for every mixed file. It is often required, or at least very useful, when:

• a loan or card was obtained in your name
• money left an account
• a collector is treating you as the debtor
• you need a report number for a correction request or an insurance claim

Tell the truth on the report. Do not guess a suspect. Attach the credit-report pages that show the unknown accounts. Keep the event number.

If a former partner opened utilities in your name, say so. Domestic economic abuse is a recognised pattern. Community legal centres and the National Debt Helpline on 1800 007 007 can sit beside IDCARE when the stranger is not a stranger.

How do credit reporting body alerts and bans work?

The Privacy Act and the Privacy (Credit Reporting) Code give consumers ways to restrict the use of their credit-reporting information when fraud is suspected. In ordinary English, you ask Equifax and Experian to note the risk and to limit further disclosures for a period, so a new credit provider cannot quietly pull a “clean” file and approve a product for the thief.

The current product names — ban, freeze, suppress, alert — change with the bodies’ websites. The OAIC’s credit-reporting pages are the official description of your rights. The bureaus’ own fraud pages are the forms. Use both. Do the process on each body. A ban on Equifax does not travel to Experian.

What a ban or alert is not:

• a deletion of the fraudulent lines (you still need a correction)
• a freeze on your genuine bank accounts
• a guarantee that a lender who already has the account will stop collecting
• a score-boost
• a paid monthly subscription you must keep forever

Ask, in writing, when the restriction starts, when it expires, and how you renew it if the thief is still active. Diary the end date. People who do the first week well and then let a 21-day note lapse meet the next fraudulent enquiry in month two.

If a legitimate application of your own is coming — a home loan that cannot wait — tell that lender about the ban and provide the fraud references. They may need extra identity steps. That is inconvenient. It is not as inconvenient as a second fraudulent personal loan.

How do you get fraudulent accounts off Equifax and Experian?

The same 30-day correction machinery as any other error, with a different evidence bundle.

Write to the credit provider and the reporting body. State that the account or enquiry is not yours and is suspected fraud or a mixed file (pick the one you mean). Attach:

• the relevant pages of both reports
• a statutory declaration if you can stand behind it
• the police or ReportCyber number, if you have one
• the IDCARE reference
• identity documents that are actually yours
• a list of addresses that are yours and a list that are not

Ask them to remove the listing, not to add a polite note while the default continues to score. Ask them to notify parties they disclosed the information to. Ask for the outcome in writing.

The OAIC’s “no wrong door” rule still applies: the provider and the bureau are expected to consult. Do not let them bounce you for six weeks. Silence at day 31 is a reason to escalate to internal complaints, then AFCA (the reporting bodies and most lenders are members) and, for privacy interference, the OAIC.

Credit-repair companies will offer to do this for a fee. ASIC and MoneySmart have warned about that market. Paying a vendor does not shorten the statutory clock. It can add a second party who has your identity documents. If the paperwork has defeated you, a financial counsellor or community legal centre is the cheaper extra pair of eyes.

True defaults on your genuine accounts remain true. Do not bundle them into the fraud letter. It weakens the fraud letter.

What should you watch for after the file is corrected?

Order fresh reports. Confirm the fraudulent lines have gone from both bodies if they appeared on both. Keep the outcome letters with the old PDFs. Check again at the next free-report window — every three months is the ordinary access rhythm — and after any unexpected refusal.

Watch, for a while:

• new enquiries you did not authorise
• mail, SMS or email from lenders you do not use
• myGov and bank login alerts
• the expiry of any bureau ban
• a collector who did not get the memo (send them the outcome letter; do not argue from memory)

Then return to ordinary file hygiene: on-time payments on the accounts that are yours, fewer curiosity applications, a household budget that does not need a new card every shock. Improving a score after fraud is mostly waiting for the correction to propagate and then being boring.

The Yarra at dusk is a Melbourne picture of a city that keeps moving after the office lights go out. A credit file should be as dull as that river on a quiet evening: no stranger’s loan, no mixed default, no paid “deletion” package. Related guides live under consumer rights and credit scores. If you are in the first hour of this, start with the lender, the bureaus, and IDCARE — not with a search ad.