Victims of cybercrime

What to do after a data breach

If your information is exposed in a data breach you should:

• Strengthen your online security by changing and protecting your passwords. For information on how to maintain a strong password, see Passwords on the ID Support NSW website.
• Watch out for any suspicious activity and delete any emails containing personal or sensitive information.
• If your identification documents like birth certificates, passports, or your driver's license, have been exposed you may need to have them reissued. For more information, see Recover your ID  on the ID Support NSW website.
• If your personal information with Medicare, Centrelink or child support is exposed, speak to Services Australia for advice and protecting your government accounts. For more information see, How you can protect your personal information after a data breach on the Services Australia website.
• Protect your bank or credit card details by monitoring your accounts for unusual activity. Check for unfamiliar transactions. Inform your bank immediately of any suspicious activity.
• Be alert for scams. Watch out for scam phone calls or SMS and avoid giving out personal details over the phone.
• Check your credit report and consider a temporary credit ban. For more information see, Fraud and your credit report on the Office of the Australian Information Commissioner website.

If you have been affected by a data breach and are not sure about what steps to take, ID Support NSW may be able to help. For more information, see Get support on the ID Support NSW website. 

What to do if your identity has been stolen

If you believe that someone is using your personal details without your permission, it’s important to act quickly to minimise the damage. You should:

• Contact your bank right away if your financial information is taken. Let them know about the theft and take steps to keep your accounts safe. 
• Change your bank account details or passwords or speak to the institution to see what is best to do in your circumstances.​
• Report the matter to your local police and get a police event number so you have evidence that you reported the issue.  It may be helpful to give the police any documentation that supports why you think your identity is being used. For example, if you get a letter from a bank and someone has used your details to take out a loan, you should show this to the police.
• Report any compromised identification documents, like your driver's license or passport to the government organisation that issued them. For help with getting documents re-issued, see ID Support NSW on the NSW Government website.
• Notify any organisations where your details may have been used, including shops, banks or government agencies. For specific services like Centrelink, Medicare or Child Support, see Scams and Identity Theft Helpdesk on Services Australia website. 
• Get a copy of your credit report and review your credit history. This would show recent checks by credit organisations, so you can tell them not to authorise a new account in your name. For more information, see Fraud and your credit report on the Office of the Australian Information Commissioner website.
• Put an alert on your Credit Report, this will help you to identify whether any credit cards or loans are taken out in your name without you knowing. For more information see, Credit scores and credit reports on the Moneysmart website.
• Report cybercrime or cyber security incidents to ReportCyber the Australian Cyber Security Centre website.

If your identity has been stolen and are not sure about what steps to take, ID Support NSW may be able to help. For more information, see Get support on the ID Support NSW website. 

Get a Victims’ Certificate

If you have been the victim of an identity offence, you can apply to the Local Court to issue you with a victim’s certificate.

The certificate can be issued irrespective of whether any proceedings have been or can be commenced for such an offence, or whether the perpetrator can be identified. You can make this type of application regardless of whether the offender has been caught. The certificate records:

• the name of the victim
• the circumstances which have led to the person being a victim. 

You can use this certificate to give to organisations to:

• prove that you have been the victim of identity crime
• get your identification information re-issued, or remove fraudulent transactions from your records
• get help in fixing any problems caused by the crime.

If you apply for a certificate you will need to show the Court that:

• an identity offence has been committed and how your identification information was used, and
• the certificate may assist with problems the offence has caused in relation your personal or business affairs. 

Depending on the type of identity offence committed you may apply for either:

• a Section 309A Victims Certificate, for New South Wales identity offences, or
• a Commonwealth Victims Certificate, if you've been a victim of a Commonwealth identity crime.

For more information about state identity offences see Safeguard your identity on the NSW Government website.

For more information and examples of commonwealth identity offences, see Identity protection and recovery on the Australian Government Attorney General’s Department website.  

If you are unsure whether you should apply for a Section 309A Victims Certificate or a Commonwealth Victims Certificate, you should get legal advice. 

Applying for a Section 309A Certificate

You may apply for a section 309A Certificate if you are a victim of an identity offence against Part 4AB of the Crimes Act 1900. If you are unsure, you should get legal advice.

If you want to apply for a section 309A certificate, you will need to fill out an Application Notice to the Local Court-General, available on the Local Court website. You will need to attach:

• a copy of any report to the police about the crime (mention the event number, the police station's name, and the officer's name)
• explain how the offender used your identification information to commit the crime, copies of any supporting documentation (evidence of the offence)
• copies of court documents (if there was a court case).

Once you have got your documents, you will need to file them in person at your nearest Local Court registry. There is an application fee of $114.00 (as at July 2024) payable when you lodge the form.  If you can’t afford this fee, you can apply to have it waived or postponed. 

For information see Application to waive or postpone a fee on the Local Court website.

Applying for a Commonwealth Victims’ Certificate

To apply for a Commonwealth Victims’ Certificate, you will need to fill out an Application Notice to the Local Court-General available on the Local Court website. You will need to attach:

• a completed application Application for a Commonwealth Victims' Certificate form
•  an original Commonwealth statutory declaration 
• copies of any supporting documentation (evidence of the offence)
• copies of any police reports (if a complaint was made)
• copies of court documents (if there was a court case).

Once you have got your documents, you will need to file them in person at your nearest Local Court registry. There is an application fee of $114.00 (as at July 2024) payable when you lodge the form. If you can’t afford this fee, you can apply to have it waived or postponed.

For information see Application to waive or postpone a fee on the Local Court website.

You will also need to provide proof of your identity to the Court. 

The Court will issue a certificate if it is satisfied on the balance of probabilities that:

• another person used your identity to commit or help commit a Commonwealth indictable offence, and
• a certificate will help you fix any problems caused by this offence. 

For more information and a copy of the application form and the Commonwealth statutory declaration, see Identity protection and recovery on the Attorney-General's Department website.