Identity Theft Laws in Australia: Criminal Penalties by State

Identity theft is not one Australian offence: the Commonwealth Criminal Code creates its own identity-fraud offences, six of the eight states and territories have added their own with different penalties, and two rely on general fraud law instead.

This article sets out the Commonwealth Criminal Code's identity-fraud offences, then compares how each state and territory's own identity-crime law differs, including the two that have none. It covers the Commonwealth victims' certificate only briefly; the fuller comparison of certificate mechanisms across every jurisdiction that has one is on Identity Theft Victims' Certificates in Australia. Whether a bank has to refund money moved using stolen identification information is a separate question, covered on Bank Liability for Identity Theft in Australia.

What Counts as Identity Theft Under Australian Law

Under the Commonwealth Criminal Code, "identification information" is information or a document relating to a person, living, dead, real or fictitious, that is capable of being used, alone or with other information, to identify or purportedly identify that person. Section 370.1 lists examples without limiting the definition: a name or address; date or place of birth; a driver licence or passport number; biometric data or a voice print; a credit or debit card number; a financial account number, username or password; a digital signature; and an Australian Business Number. "Identification documentation" means any document or thing that contains identification information and is capable of being used to pass someone off as another person.

Each state and territory that has its own identity-crime offence defines identification information in broadly similar terms within its own Act, though the exact wording, and what conduct is captured, is not identical across jurisdictions. Treat the Commonwealth definition above as illustrative of the general concept, not as the operative definition for a state charge.

Commonwealth Identity Crime Offences: Criminal Code Part 9.5

The Commonwealth Criminal Code's Part 9.5, Division 372, "Identity fraud offences," creates three distinct offences.

None of these four offences applies to a person dealing in or possessing their own identification information, and consent of the person the information relates to is not a defence. Section 372.6 makes clear that it is not a separate offence to attempt to commit an offence against Division 372, since the possession offences already capture much of what an attempt charge would otherwise cover. Where a person is prosecuted for dealing under section 372.1 or 372.1A but the evidence only proves possession, section 372.5 lets the court convict on the lesser possession charge instead.

Division 375 of the Criminal Code sets out a separate Commonwealth victims' certificate mechanism. A magistrate can issue a certificate to a victim, on the balance of probabilities that someone dealt in the victim's identification information intending it be used to commit or facilitate a Commonwealth indictable offence, without needing a conviction, an identified suspect, or ongoing proceedings. The certificate does not name the alleged offender and is not admissible in any proceedings; it exists to help a victim show an agency, bank or credit provider that they were a genuine identity-crime victim, though it does not compel any of them to act. The application process, what the certificate can and cannot do, and how it compares with the certificate mechanisms in New South Wales, Western Australia, Queensland and the Northern Territory, are covered in full on Identity Theft Victims' Certificates in Australia.

Computer Offences Often Charged Alongside Identity Fraud

Identity-fraud charges under Division 372 are often laid alongside separate Commonwealth computer offences under Part 10.7 of the Criminal Code, when identification information was obtained or dealt in through a computer system. Unauthorised access to, or modification of, restricted data under section 478.1 carries up to 2 years, and possessing or supplying data with intent to commit a computer offence under sections 478.3 and 478.4 each carry up to 3 years. The more serious offences under Division 477, unauthorised modification of data to cause impairment and unauthorised impairment of electronic communication, each carry up to 10 years. This reflects how the two Parts of the Code fit together when identification information is obtained online, rather than a specific charging statistic; whether a given case is also charged under Part 10.7 depends on how the information was obtained, not on the identity-fraud offence itself.

How Identity Theft Penalties Differ by State and Territory

Outside the Commonwealth, six states and territories have enacted their own identity-crime offences, each with its own section numbers, elements and maximum penalties. Two, Tasmania and the Australian Capital Territory, have not, and rely on general fraud, forgery and personation law instead.

Tasmania's Criminal Code Act 1924 has no chapter, part or offence using the words "identity crime" or "identity theft." A person who misuses someone else's identity in Tasmania would instead be charged under a general provision such as fraud (section 253A), computer-related fraud (section 257B), forgery (section 278) or personation (section 288), none of which state their own penalty; each defaults to the Code's general 21-year maximum under section 389(3) in the absence of a specific figure. That 21-year figure is a statutory ceiling set by the Code's default sentencing provision, not a penalty calibrated to identity-related conduct specifically, and it does not describe what a court would typically impose in practice.

The Australian Capital Territory's Criminal Code 2002 and its separate Crimes Act 1900 (ACT) also contain no identity-crime offence, and neither contains a general offence of impersonating a private individual. The ACT's only personation offences cover impersonating a territory public official or a police officer. A person who assumes someone else's identity in the ACT for another purpose would instead be prosecuted under general dishonesty offences such as obtaining property or a financial advantage by deception, or forgery, each carrying up to 10 years imprisonment, a fine, or both.

What to Do If You Are a Victim of Identity Theft in Australia

If someone has used your identification information, your first practical steps are the same regardless of which offence eventually applies to the conduct. Under section 20K of the Privacy Act 1988 (Cth), you can ask any of Australia's three credit reporting bodies, Equifax, Experian and illion, for a free ban on the use or disclosure of your credit reporting information; the ban lasts 21 days, can be extended for free, repeatedly, if the body believes on reasonable grounds you have been or are likely to be a fraud victim, and the OAIC advises that the credit reporting body must give you at least 5 business days' notice before it expires. IDCARE, Australia and New Zealand's national identity and cyber support service, is an independent registered charity rather than a government agency, though both the OAIC and the Australian Cyber Security Centre direct victims to it (1800 595 160). Report the incident through ReportCyber, run by the Australian Signals Directorate's Australian Cyber Security Centre, and consider a police report, since a reference number can support later steps, including a national police check if you ever need to show one was affected by the incident. For the full free-first response sequence, including securing your accounts and obtaining a free credit report, see What to Do If Your Information Is Affected by a Data Breach in Australia.

Related Reading

This page focuses on identity-crime offences and penalties. For how to actually obtain a Commonwealth, New South Wales, Western Australian, Queensland or Northern Territory victims' certificate, and which jurisdictions have none, see Identity Theft Victims' Certificates in Australia. For whether a bank has to refund a payment made using your stolen identity, see Bank Liability for Identity Theft in Australia. Related Commonwealth Criminal Code offences are covered on Doxxing Laws in Australia and Deepfake and Intimate Image Laws in Australia, and the broader privacy framework is covered on the Australia data privacy laws hub.

Frequently Asked Questions

Is identity theft a crime in Australia?

Yes. The Commonwealth Criminal Code creates identity-fraud offences at Division 372 of Part 9.5, and most states and territories have added their own. Only Tasmania and the Australian Capital Territory rely on general fraud and forgery law instead of a dedicated identity-crime offence.

What is the maximum penalty for identity theft in Australia?

It depends on the jurisdiction and the specific offence. The Commonwealth's dealing offences carry up to 5 years, and state and territory maximums range from 2 to 3 years for possession offences up to New South Wales' 10-year dealing offence, the highest maximum in the country.

Which Australian states have no dedicated identity theft offence?

Tasmania and the Australian Capital Territory. Tasmania relies on general fraud, forgery and personation provisions that default to a 21-year statutory maximum, and the ACT relies on general dishonesty and forgery offences, since it also has no general offence of impersonating a private individual.

What is a Commonwealth victims' certificate?

A certificate a magistrate can issue under Division 375 of the Criminal Code to a victim of Commonwealth identity fraud, without requiring a conviction or an identified offender, to help the victim show a bank, agency or credit provider they were affected. It does not compel any organisation to take a particular action.

Do all Australian states have a victims' certificate mechanism?

No. New South Wales (Criminal Procedure Act 1986 s309A), Western Australia, Queensland and the Northern Territory each have their own certificate mechanism. No certificate provision was found in Victoria, Tasmania or the ACT, or in South Australia's Criminal Law Consolidation Act, though the South Australia finding is limited to that Act.

How long does a credit reporting ban last after identity theft?

21 days from your request, under section 20K of the Privacy Act 1988 (Cth), free of charge. It can be extended repeatedly at no cost if the credit reporting body believes on reasonable grounds you have been, or are likely to be, a fraud victim.

Is IDCARE a government agency?

No. IDCARE is an independent registered charity, not a government agency or government-funded program, although the OAIC and the Australian Cyber Security Centre both direct identity-theft victims to it as Australia and New Zealand's national identity and cyber support service.

What should I do first if my identity has been stolen in Australia?

Request a free credit reporting ban from Equifax, Experian or illion, report the incident through ReportCyber, and consider a police report. The full free-first response sequence is covered on this site's data breach response guide.