Identification of fraud and cybersecurity incidents
Protecting your information is a primary goal of myID. Constant monitoring for real or suspected fraud and cybersecurity incidents is done through:
- referrals from the Australian Government Digital ID System (AGDIS) Administrator
- reporting and tip-offs from the public
- fraud modelling tools
- cybersecurity monitoring tools.
Management and resolution of fraud and cybersecurity incidents
Once a suspected or real fraud or cybersecurity incident is identified:
- we will investigate the matter to determine whether fraud or a cybersecurity incident has occurred. If fraud or a cybersecurity incident is confirmed, the affected myID will be suspended to help protect the identity holder and prevent further misuse
- we notify the AGDIS Administrator so they can identify where the compromised myID might have been used and notify impacted parties #1
- if we can confirm we have your legitimate contact details, we will attempt to notify you of the incident and what steps you need to take to protect yourself
- your myID will remain suspended until we can confirm
- it was not compromised
- you have full control of your identity #2
- if your myID was compromised, or you don’t have full control of your identity, you will need to set up a new myID.
#1 The AGDIS is designed for your privacy, which means myID does not have visibility of any services you access. Only the AGDIS System Administrator can access this information and, by law, can only do so in limited circumstances. This includes where a suspected or real fraud or cybersecurity incident has occurred.
#2 We are required by law to only allow a myID to resume when we are assured you have full control of your identity. Full control means your identity documents have not been compromised. In some instances, this may require you to ask the document issuer to re-issue your identity documents.
Complaints related to fraud and cybersecurity incidents
If you suspect your myID has been compromised, or you want to make a complaint regarding how a fraud or cybersecurity incident is being handled, contact usExternal Link.
Your issue will be escalated, and we will:
- investigate the issue
- contact you to provide support and resolve the issue.
We aim to resolve complaints within 28 business days. If your complaint is complex, it may take longer. If we can’t resolve your complaint, we’ll explain why and let you know your other options.
Where a resolution cannot be reached due to a technical issue caused by a fraud or cybersecurity incident, we will refer the issue to the AGDIS Administrator.