Identity theft is when someone steals another person's identifying details — name, date of birth, tax file number, driver's licence number, or business identifiers like ABN and ACN — and uses them as if they were their own. For individuals the damage is fraudulent loans, accounts and phone plans; for businesses the same crime arrives as a compromised employee identity used to breach payroll, superannuation and HR records, or as a stolen business identity used to order goods and open accounts in your name. In Australia the fastest-growing vectors in 2026 are myGov and Medicare impersonation scams, fake HR portals harvesting new-starter details, and phishing pages that collect enough personal data to pass a bank's ID checks.
TL;DR
- Identity theft is the misuse of someone's identifying details to impersonate them — for individuals and businesses alike.
- Common routes: myGov and Medicare scams, fake HR portals, phishing pages, and breaches of companies that hold the data.
- For businesses, the employee data HR holds (TFNs, licences, super details) is the identity-theft goldmine, not the CEO's inbox.
- Prevention: protect the data you hold, limit what is collected, and train staff so phishing cannot harvest their details in the first place.
- Report fast: Scamwatch, ReportCyber, IDCARE — every hour of delay widens the damage.
What is identity theft?
Someone else using your identifying details as their own. The criminal needs only a few fragments: date of birth, address, a licence number, a TFN. With those they can pass phone-carrier ID checks, open buy-now-pay-later accounts, redirect mail, or take over a bank account. For a business, identity theft has two faces:
- Employee identity theft. The data your HR holds — TFNs, licence scans, superannuation details, addresses — is exactly what identity thieves want, and exactly what phishing and fake HR portals harvest.
- Business identity theft. Your ABN, ACN and company details are used to order goods on credit, register fake domains or open accounts. The business itself is the impersonated party.
How identity theft happens
- Phishing and fake portals. A page that looks like myGov, Medicare or your HR system collects logins and personal details. Scamwatch consistently ranks phishing among the most-reported scam types, and myGov impersonation is a persistent Australian staple.
- Fake HR onboarding portals. New starters get an authentic-looking portal asking for TFN, bank and licence details before real onboarding begins.
- Data breaches. Companies holding customer or staff data lose fragments that combine into a full identity.
- Malware. Spyware on a device collects browsing and saved form data, building the identity profile quietly.
- Physical theft. Mail theft, stolen wallets and dumped documents still feed the trade.
- Social engineering by phone. “This is the ATO/Telco/HR, I just need to confirm your details.”
What identity theft costs — and who pays
The scale is not hypothetical. The Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with the average self-reported cost for small business at $56,600 per report (ASD Annual Cyber Threat Report 2024-25). A large share of those incidents are exactly this crime: personal details harvested by deception and used for fraud. Beyond money, identity theft costs time — months of disputes with banks, telcos and government agencies — and for a business it can trigger notifiable data breach obligations under the Privacy Act.
How to protect against identity theft
As an individual:
- Never enter personal details on a page reached from an email or SMS link; navigate to the site directly.
- Keep device software patched and use multi-factor authentication on email, banking and government portals.
- Shred documents; check credit reports periodically.
- Treat every “we need to verify your details” call as an impostor until proven otherwise.
As a business:
- Minimise what you collect. You cannot lose what you never stored. Audit which staff and customer identifiers you hold and drop what no process needs.
- Protect the HR data store. Access limits, encryption and audit logging on anything holding TFNs, licences or bank details.
- Lock down onboarding. Verify your own onboarding portal's URL, and tell new starters exactly which domain to expect so a fake portal gets reported, not filled in.
- Train the reflex. Cyber Aware's security awareness training runs monthly story-driven modules, and phishing simulations rehearse the myGov, HR and ATO lures Australian staff actually receive — anyone who clicks gets same-day coaching, not blame.
- Know your breach duties. If identity data is exposed, the Privacy Act's Notifiable Data Breaches scheme may require notification; a cyber security gap assessment maps how ready that process is.
What to do if identity theft happens
- Report to ReportCyber (cyber.gov.au) and Scamwatch immediately.
- Contact IDCARE — Australia and New Zealand's national identity and cyber support service — for a free response plan.
- Tell your bank and any affected provider; freeze or flag affected accounts.
- Change compromised credentials from a clean device, and revoke sessions.
- Check for further misuse: credit reports, unusual mail, unexpected verification emails.
- For businesses, assess the breach notification duty — the clock on the Privacy Act's 30-day assessment window starts when you become aware.
FAQ
What is identity theft in simple terms? Someone using another person's identifying details — name, date of birth, TFN, licence number — as if they were their own, to open accounts, take loans or commit fraud.
How do identity thieves get your information? Mostly by deception: phishing pages and fake portals you fill in yourself, scams that impersonate myGov, Medicare or HR, malware that harvests saved data, and breaches of companies that hold your details.
Can identity theft affect a business? Yes, twice over: employee identity data (TFNs, licence scans, bank details) stolen from HR systems, and the business's own ABN and company details used to order goods or open accounts fraudulently.
Is identity theft the same as identity fraud? Identity theft is the stealing; identity fraud is the crime committed with the stolen identity. The theft is the vulnerability; the fraud is the damage.
Where do I report identity theft in Australia? ReportCyber (cyber.gov.au) and Scamwatch first, then IDCARE for a free recovery plan, then your bank and any affected organisation. If a business data breach is involved, the Privacy Act's 30-day notifiable breach assessment applies.
One last thing
Ask HR one question this week: exactly how many places in the business hold employee TFNs and licence scans, and who can access them? Identity theft starts with data that is collected but not protected — and most small businesses cannot answer that question without checking.