Identity Theft – Laws, Penalties & Defences in Australia

Identity theft is a rapidly growing offence in Australia, driven by the rise of digital transactions, online scams, and data breaches. It involves the unauthorised use of another person’s personal information—such as name, date of birth, driver licence, Medicare number, or financial details—to steal money, open accounts, or commit other frauds.

Identity theft is a serious criminal offence under both state laws and Commonwealth legislation, and can carry penalties of up to 10 years’ imprisonment, along with hefty fines and a permanent criminal record.

This guide explains what constitutes identity theft, how charges are laid, what happens in court, possible legal defences, and the laws and penalties in each Australian state and territory.

What Is Identity Theft?

Identity theft involves using someone else’s personal information without consent to gain a benefit, cause a loss, or commit a secondary offence.

Examples include:

• Opening bank or credit card accounts using stolen IDs

• Using someone else’s Medicare, tax file, or licence number

• Phishing for usernames and passwords to access accounts

• Creating fake identity documents or digital profiles

• Using false identities to avoid arrest or fines

The prosecution must prove:

1. The information was used without lawful authority

2. The conduct was dishonest

3. There was intent to gain benefit or cause detriment

How Are Identity Theft Charges Laid?

Identity theft is often discovered through:

• Banking alerts or flagged transactions

• Complaints from identity theft victims

• Data breach investigations

• Police cybercrime operations

• Cross-matching government databases (e.g. ATO, Centrelink, passports)

Evidence can include:

• Electronic logs or IP addresses

• Digital communications (emails, messages)

• Forged documents or fake IDs

• Confessions or surveillance footage

Court Process for Identity Theft Offences

Depending on the seriousness, identity theft is prosecuted in:

• Magistrates’/Local Court – for summary or first-time offences

• District/County/Supreme Court – for aggravated or high-value identity fraud

The court process includes:

1. First appearance – Plea entered

2. Disclosure of evidence – Provided by prosecution

3. Hearing or trial – To determine guilt

4. Sentencing – Based on the impact, intent, and whether the identity was used to commit further offences

Defences to Identity Theft

Possible legal defences include:

• Mistaken identity – You were not the person involved

• Lack of intent – You didn’t know the information was stolen or falsely obtained

• Authorisation – You had the individual’s permission

• Mental illness or cognitive impairment – Affecting your capacity to form intent

• No gain or detriment – Identity was not used to benefit or cause loss