Identity Theft Victims' Certificate Australia: Commonwealth, NSW, WA, QLD and NT

A Commonwealth Victims' Certificate can be issued by a magistrate without a conviction; New South Wales and the Northern Territory have their own no-conviction certificate routes, Western Australia and Queensland tie theirs to a conviction, and Victoria, South Australia, Tasmania and the ACT have no certificate mechanism in the Acts checked.

What a Victims' Certificate Is For

A victims' certificate is a formal document a magistrate or court issues to someone whose identification information was used to commit or facilitate an offence. It exists to give the victim something concrete to hand to a bank, a government agency or a credit provider when disputing a fraudulent debt, account or record connected to their identity.

None of the certificate schemes on this page compel an organisation to do anything. The Attorney-General's Department is explicit that a Commonwealth Victims' Certificate "does not compel any organisation to take a particular action" and "will not automatically re-establish your credit rating or remove a fraudulent transaction." Treat a certificate as supporting evidence in a dispute, not as a court order the recipient must follow.

Which certificate is available, and how you get one, depends on whether the offence involved is a Commonwealth or a state or territory offence, and on which state or territory you are in. Five of Australia's nine jurisdictions have a certificate mechanism, and four have none.

For what identity theft is and how the underlying offences differ state by state, see Identity Theft Laws in Australia.

The Commonwealth Victims' Certificate

Division 375 of the Criminal Code Act 1995 (Cth) lets a magistrate issue a Commonwealth Victims' Certificate to the victim of identity crime, without requiring a conviction or even the offender's identity to be known.

Under section 375.1, a magistrate may issue a certificate if satisfied, on the balance of probabilities, that someone dealt in the victim's identification information intending it be used to pretend to be another person for the purpose of committing or facilitating a Commonwealth indictable offence, and that a certificate may help with problems the dealing has caused the victim's personal or business affairs. The magistrate does not need to determine that a specific person committed the offence, and there is no requirement that anyone be prosecuted or convicted first.

Section 375.2 sets out what the certificate must and must not contain. It must identify the victim and describe the dealing in identification information, and it must not identify the alleged offender. Under section 375.3, the certificate is not admissible in any court proceedings, and a magistrate must not issue one if doing so would prejudice a pending case. Section 375.4 makes clear the power belongs to the magistrate personally, not to the court as a body, and the magistrate is free to decline it.

How to apply. The Attorney-General's Department hosts the Application for a Commonwealth Victims' Certificate form and a Commonwealth statutory declaration. You complete both and submit them directly to a magistrate at a state or territory magistrates court, bringing proof of identity. This is a direct court application, not something routed through the Attorney-General's Department or the Director of Public Prosecutions. The magistrate may ask for further information before deciding, and can decline the application. According to the Attorney-General's Department's guidance, organisations as well as individuals can apply where a certificate would help address identity-crime impacts on the organisation's affairs, though this appears in AGD guidance rather than as a separate applicant category spelled out in the statute itself.

Certificates in New South Wales, Western Australia, Queensland and the Northern Territory

Four states and territories run their own certificate mechanisms, and they differ from the Commonwealth scheme and from each other.

New South Wales has a no-conviction route. Section 192M(4) of the Crimes Act 1900 (NSW) points to section 309A of the Criminal Procedure Act 1986 (NSW), under which the Local Court may issue a certificate that an identity offence under Part 4AB has been committed, to help the victim with problems the offence has caused in their personal or business affairs. The court decides on the balance of probabilities, on its own initiative or on the victim's application; it can issue the certificate whether or not the perpetrator is identifiable and whether or not any proceedings have been or can be taken. The certificate must not identify the perpetrator and is not admissible in criminal proceedings.

Western Australia ties its certificate to a conviction. Under section 494 of the Criminal Code (WA), once a person is convicted of an "identity offence", a term defined broadly to cover the whole of Division III (identity crime, forgery and uttering, and personation), the court may issue a certificate to the victim, stating the offence, the victim's name and any other matter the court considers relevant. The court can act on its own initiative or on application by the prosecutor or the victim. If the conviction did not follow a guilty plea, the certificate is withheld until the appeal period or any appeal concludes. The certificate then stands as evidence of its contents unless there is evidence to the contrary, and the court can cancel it for good reason.

Queensland builds its certificate directly into its identity-crime offence, section 408D of the Criminal Code (Qld), rather than as a separate provision. Under section 408D(3), when a court sentences someone for the dealing or obtaining offence at section 408D(1), it may order that a certificate be issued to the victim, stating the offence, the victim's name and anything else the court considers relevant for the victim's benefit. The order can be made on the court's own initiative or on application by the victim or the prosecutor. If the person pleaded guilty, the certificate can be given to the victim immediately; otherwise it is withheld until any appeal period or appeal concludes. On the provision's plain wording, this certificate is available for the dealing or obtaining offence under section 408D(1) only, not for the equipment-possession offence at section 408D(1A) standing alone.

The Northern Territory takes a third approach. Its Criminal Code does not create its own certificate provision inside the identity-crime division, but carries an explicit note directing victims to two other Acts. A certificate for an offence against section 228C, 228D or 228E may be issued under section 28C of the Local Court (Civil Procedure) Act 1989 (NT), or under Part 5, Division 1AA of the Sentencing Act 1995 (NT). Under section 28C, the Local Court may, on the victim's application, issue a certificate if satisfied on the balance of probabilities that an offence against section 228C, 228D or 228E has been committed, whether or not the offender is identifiable and whether or not any criminal proceedings have been or can be taken; the certificate is not admissible in criminal proceedings. That places the primary NT route alongside the Commonwealth and NSW no-conviction models rather than WA's or Queensland's conviction-gated schemes. The Sentencing Act route, section 97AB, is a fallback: the sentencing court may issue a certificate after a conviction for one of those offences, but only if the victim has not already obtained a section 28C certificate. Confirm the current application form and any fee with the Local Court before applying.

Where No Certificate Mechanism Was Found

Victoria, South Australia, Tasmania and the ACT have no identity-crime victims' certificate provision in the Acts examined for this page. For Victoria, the current Crimes Act 1958 was searched in full and contains no certificate or correction provision anywhere near its identity-crime division. For Tasmania and the ACT, neither jurisdiction has a dedicated identity-crime offence at all, and neither of their general criminal statutes contains a certificate mechanism. For South Australia, no certificate provision appears in the Criminal Law Consolidation Act 1935; whether a separate certificate-style remedy exists outside that Act, for example under the Victims of Crime Act 2001 (SA), was not checked, so treat "South Australia has no certificate" as limited to the Criminal Law Consolidation Act specifically.

If you are in one of these four jurisdictions and the offence involved is a Commonwealth indictable offence, for example identity information dealt with using a carriage service, the Commonwealth Victims' Certificate above may still be available even though your state has no equivalent of its own.

Using a Certificate

Once issued, a certificate is something you present to whichever organisation you are disputing a fraudulent record with, most commonly a bank, a telecommunications provider, a government agency or a credit reporting body. It backs up your account of what happened. It does not carry the force of a court order compelling that organisation to act, and it will not by itself erase a fraudulent transaction, correct a credit file entry or restore an account.

For unauthorised bank transactions specifically, and how liability and complaints to the Australian Financial Complaints Authority work, see Bank Liability for Identity Theft in Australia. For the free first steps to take alongside a certificate, including securing your accounts and reporting the incident, see What to Do If Your Information Is Affected by a Data Breach.

The 21-Day Credit Ban

Separately from any certificate, section 20K of the Privacy Act 1988 (Cth) gives you a direct right to stop the harm spreading through your credit file. If you believe on reasonable grounds that you have been, or are likely to be, a victim of fraud, including identity fraud, you can ask a credit reporting body not to use or disclose your credit reporting information. The ban runs for 21 days from the date you make the request, and if you ask for an extension before it ends, and the credit reporting body believes on reasonable grounds you have been or are likely to be a fraud victim, it must extend the ban for whatever period it considers reasonable. The ban can be extended more than once, and there is no charge for requesting it or having it applied. Australia's three credit reporting bodies, Equifax, Experian and illion, each accept ban requests, and asking one to pass the request to the other two is generally accepted practice.

According to the Office of the Australian Information Commissioner, a credit reporting body must also notify you at least 5 business days before a ban is due to expire, though this notice requirement sits in the Privacy (Credit Reporting) Code rather than in section 20K itself.

For identity theft generally, IDCARE, an independent charity endorsed by both the OAIC and the Australian Cyber Security Centre, provides free specialist support on 1800 595 160. If your identity was misused in a way that also invades your privacy more broadly, for example through the publication or exposure of personal information, the statutory tort for serious invasions of privacy is a separate civil option worth reading about. For the full list of Australian privacy protections, start at the Australia Data Privacy Laws hub.