Identity theft and identity fraud in NSW: what the law covers and what to do if police contact you
Identity crime costs Australians billions of dollars every year. The Australian Institute of Criminology estimates that identity crime affects hundreds of thousands of Australians annually, and ACCC Scamwatch data shows that personal information theft and misuse features in an increasing proportion of scam reports. NSW Police Cybercrime Squad and the Australian Federal Police both maintain dedicated investigation capabilities focused on identity offences, and prosecutions have become more sophisticated and more frequent as digital life has expanded the opportunities for identity misuse and the evidence trail it leaves.
Identity theft charges can arise from a remarkably broad range of conduct. Using another person’s driver’s licence or passport to misrepresent identity or age, applying for credit products or loans in another person’s name, accessing another person’s bank accounts using stolen credentials, using someone else’s Medicare number or tax file number to obtain financial advantage, creating or possessing false identity documents, and using another person’s personal information as the foundation for committing further criminal offences can all give rise to charges under both NSW and Commonwealth law. Understanding exactly what offence applies to the conduct alleged, what the prosecution must prove, and what the available defences are is essential from the earliest point of any investigation.
The NSW legislative framework
Part 4AB of the Crimes Act 1900 (NSW) contains the primary identity crime offences at state level. Section 192J creates the offence of dealing in identification information: a person deals in identification information where they obtain, possess, supply, or use it, and they do so with intent to commit, or to facilitate, a serious indictable offence. The maximum penalty is 10 years’ imprisonment. Section 192K creates the offence of possessing identification information: possession alone, without evidence of an intent to use it, carries a maximum of seven years. Section 192L covers possession of equipment used to make identification documents, with a maximum of five years.
“Identification information” is defined in section 192H with considerable breadth. It includes: a person’s name, address, date of birth, and signature; driver’s licence or passport number; Medicare number, tax file number, and Centrelink reference number; bank account or credit card numbers; digital identifiers including usernames and passwords; biometric data including fingerprints and facial recognition templates; and any other information that is capable of being used alone or in combination to identify or authenticate a person. The breadth of this definition means that conduct involving almost any personal information that another person could use to represent themselves as the victim, or to access services or accounts in the victim’s name, falls within the relevant provisions.
The Commonwealth framework
At Commonwealth level, Part 9.5 of the Criminal Code Act 1995 (Cth) provides complementary identity crime offences that can be charged alongside or instead of the NSW provisions. Section 372.1 makes it an offence to deal in identification information: to make, supply, or use identification information with the intention of committing, or facilitating the commission of, an indictable offence against a law of the Commonwealth or of any state or territory. The maximum penalty is five years’ imprisonment, rising to 10 years where the offending involves three or more persons’ identification information, and to 15 years in cases of serious aggravation.
The interaction between state and Commonwealth frameworks means that a single instance of identity fraud – using a stolen credit card number to make a purchase online, for example – can in principle give rise to charges under both systems simultaneously. In practice, prosecutors choose the most appropriate charges having regard to the evidence and the jurisdiction, but in serious syndicate cases both state and federal charges are commonly pressed.
How police build identity theft cases
Identity theft investigations typically begin with a complaint from the victim: a person who discovers that a credit application has been made in their name, that their bank accounts have been accessed, that a tax return has been filed using their information, or that services have been obtained using their identity. Investigators obtain from the victim a detailed account of what they have discovered and when, and then begin gathering the documentary record of the fraudulent activity.
The evidence in these cases is primarily digital and financial. Investigators obtain from financial institutions the records of fraudulent applications and transactions: the details entered, the device used to make the application, IP addresses, and timing records. They obtain from government agencies records of changes made to accounts or payments redirected. They obtain from online platforms account records and activity logs. Subscriber information from telecommunications providers may identify the phone number or device associated with accounts used in the fraud.
Device extraction from the accused’s phone or computer is sought in virtually all identity theft investigations. Forensic examination of devices looks for: copies of the victim’s personal information stored in notes, documents, images, or contacts; photos of identity documents belonging to the victim; browser history showing research into the victim’s details; access to accounts or platforms in the victim’s name from the device; messaging records showing acquisition or supply of personal information; and financial records showing the benefit obtained through the identity misuse. The digital record in identity crime cases is often very detailed, and by the time police make contact with a suspect they typically have an extensive evidentiary foundation.
The unknowing participant problem
A significant and consistently recurring problem in identity theft prosecutions is the person who participated in the criminal scheme without fully understanding what they were involved in. A person who opened a bank account at another person’s request and handed over the debit card, who received a package in their name and forwarded it, who rented a vehicle or property using their own identity for the benefit of a third party, or who forwarded documents containing another person’s personal information at the direction of an employer or online contact may find themselves charged with offences they did not realise they were committing.
The legal question in these cases is intent: the prosecution must prove that the accused dealt in the identification information with the intention of committing or facilitating a serious indictable offence. Where the accused genuinely did not know that their conduct was part of a criminal scheme, that lack of intention may constitute a complete defence. However, the objective circumstances matter: courts ask whether a reasonable person in the accused’s position would have suspected that the conduct was criminal. The same objective circumstances analysis applied in money mule cases applies here – where there were clear red flags that any reasonable person would have questioned, a claimed absence of knowledge faces significant scrutiny.
What to do if police contact you
If NSW Police Cybercrime Squad, the AFP, or any other law enforcement body contacts you about a suspected identity crime, do not answer questions, do not produce documents, and do not agree to any voluntary interview without first obtaining legal advice. In identity crime investigations, what you say at the first point of contact can significantly shape the investigation that follows. The right to silence applies from that first moment and should be exercised until you have spoken to a lawyer.
At National Criminal Lawyers, we advise on identity crime matters at both NSW and Commonwealth level. We also advise on urgent responses when devices are seized, when production orders are made directed at your accounts or service providers, and on the right approach to any police interview request. Call us at 1800 CRIM LAW for a free consultation. Help us help you understand your situation and get you the best outcome possible.
