On Sunday 31 August, the Attorney-General announced that Australians are getting a switch for their identity documents.
It's called IDLock. It will live in myGov. It will let you block your driver's licence or passport from being used to verify your identity, unblock it when you need it, and — this is the part that matters most — see every time somebody tried.
Attorney-General Michelle Rowland put it this way: "Whether their driver licence details have been exposed in a data breach or they are concerned about scams and identity theft, IDLock will give Australians an accessible and simple way to have greater visibility, control and confidence in how their identity documents are used."
It's a genuinely good idea, and it's the first piece of identity policy in years that hands the controls to the person whose identity it actually is.
It also isn't coming until 2027.
So this piece is about two things. What IDLock will do, and why it matters more than it sounds. And then the part almost nobody knows: depending on which state you live in, some version of this switch already exists, and you can flip it this afternoon.
If you're in Western Australia, it takes about two minutes, there's no fee, and you can turn it on and off as many times as you like.
What a stolen licence is actually for
Start here, because the whole thing makes more sense once you understand what criminals do with a licence number.
They don't print a fake card. That's the movie version.
What they do is far quieter. When you open a bank account, take out a phone plan, apply for credit, or sign up to a buy-now-pay-later service, that organisation runs your details through the Document Verification Service — a federal government system that checks, in about a second, whether the licence or passport you've quoted is real and matches the name you've given.
It's a good system. It's the reason you can open an account online at ten o'clock at night.
It's also the exact thing a criminal needs to pass in order to become you.
They don't need your card. They need the numbers on it. And once they've got them — from a breached retailer, a hacked medical clinic, a photo of your licence you emailed to a rental agent in 2019 — they can sit at a keyboard on the other side of the world and open things in your name.
The first you hear about it is a debt collector, a credit refusal, or a card you never applied for.
Two numbers, not one
Here's a detail worth knowing, because every state's advice depends on it and almost no one explains it.
Your licence has two numbers on it: your licence number, which generally stays with you for life, and a card number, which is a shorter string usually printed on the back. Victoria and Queensland describe it as being like the CVV on a credit card.
The Document Verification Service needs both to return a match.
That's why replacing your card actually does something. Your licence number doesn't change — but the card number does, and the moment it does, every copy of your old details floating around in a criminal database stops working for identity checks.
It's also why a breach notification saying "your licence number was exposed" is less alarming than one saying both numbers were. If a company only ever held one of the two, the exposure is real but the immediate fraud risk is much lower.
The system already protecting you, which you've never been told about
Since 2022 there has been a national safety net called the Credential Protection Register. When an identity document is known to be compromised, it goes on the register, and the Document Verification Service stops returning a match for it. The document keeps working for its actual purpose — you can still drive on that licence, still travel on that passport — it just can't be used to prove you are you.
By the government's own account, the register has now blocked more than 830,000 fraudulent identity verification attempts since late 2022. That's roughly 18,000 a month. Eighteen thousand times a month, somebody somewhere tries to be an Australian they aren't, and a database says no.
Now here's the catch, and it's the whole reason IDLock exists.
You don't control it. There's no way to apply. And you're not told.
The government's own guidance is explicit: your compromised credential is added to the register automatically, by the agency that issued it, based on a risk profile you never see. In its words — "You're not required to take any action."
Which sounds reassuring, and in one sense is. But read it again from where you're standing. Somebody else decides whether your licence is protected. There is no application form. You can't check whether it happened. And if 18,000 fraudulent attempts a month are being blocked nationally, you have no way of knowing whether any of them involved you.
That's the gap. IDLock closes it.
What IDLock actually changes
Three things, and the third is the sleeper.
1. You get the switch. Block your own licence or passport from identity verification, on your own initiative, without needing to be a confirmed victim of anything.
2. You get to unblock it. Because the obvious objection to blocking your ID is that one day you'll need to use it. IDLock is designed to be toggled — off while you're not applying for anything, on for the ten minutes you are.
3. You get to watch. The announcement says you'll be able to monitor the use of your documents. Think about what that means. Right now you can pull a credit report and see who's checked your credit file. There has never been an equivalent for your identity documents — no way at all to find out that somebody in another state tried to open a phone account with your licence number last Tuesday.
An audit log for your ID is the thing that turns identity fraud from something you discover eighteen months later into something you see the week it happens. Of the three, it's the one worth waiting for.
The timeline: early access testing with a limited group later this year, broader rollout through myGov in 2027.
What you can do today, state by state
You don't have to wait for all of it. Here's where each state and territory has actually landed. Check yours — the differences are bigger than you'd expect.
Western Australia — the good one.
WA lets you place a licence block through your DoTDirect account. It's instant, it does not affect your ability to drive, and there is no limit on how many times you can add and remove it. It sits under Driver's Licence → Protect your identity → Add licence block.
On cost: Transport WA lists a fee for replacing your licence card, and lists none for adding a block — it's a self-service toggle in your own account rather than a transaction. As far as we can find, WA is currently the only state or territory offering this at all; everywhere else, the remedy is a replacement card.
This is IDLock, more or less, available now. The Department of Transport's own recommendation is to keep the block on permanently and lift it only when you need to verify your identity — which is exactly the right way to use it.
If you're in WA and you read nothing else here: go and turn it on.
Queensland — free replacement if you were breached.
A replacement licence gives you a new card number. The replacement fee is waived where confidential information on your licence was compromised in a data breach. A new Customer Reference Number is available too, but only where your details have actually been used fraudulently.
South Australia — cheap, and you can go further.
$22 for a replacement card through mySAGOV, which changes your card number. Or $22 to change your licence number itself, which requires a form and a visit to a Service SA centre with evidence.
Tasmania — you can change the number.
Service Tasmania will issue a new driver licence number where your details have been compromised by identity theft, fraud or a cyberattack. It's assessed case by case, and a card fee applies. That's a stronger remedy than most states offer.
New South Wales — replace the card, keep the receipt.
$29 for a replacement (select 'stolen' as the reason). Your licence number stays, your card number changes. Service NSW's advice is to pay it and then take it up with the organisation that lost your data if you want reimbursing. ID Support NSW is on 1800 001 040 and is genuinely useful.
Victoria — report first, then replace.
VicRoads asks you to report to police first, then apply for a replacement through myVicRoads. The security card number changes with each replacement.
ACT — replace if both numbers went.
Access Canberra's guidance is to replace if your licence number *and* card number were both exposed. New card number, same licence number. Online at rego.act.gov.au or 13 22 81.
Northern Territory has its own driver licence data breach page — start there.
The other three switches
While you're in the mood, there are three more, and between them they cover most of what a stolen identity is actually used for.
1. A credit ban. Free, and almost nobody uses it.
This stops new credit being opened in your name. It runs 21 days, it's free, and it's extendable as many times as you need — a credit reporting body has to extend it if they're satisfied you've been the victim of fraud.
The trick most people miss: you don't have to contact all three bureaus yourself. You can ask one credit reporting body to pass the request on to the other two, and it must do so. One request, all three covered.
Australia's three credit reporting bodies are Equifax, Experian and illion. Experian acquired illion in 2024, but illion is still a separate registered body — so all three need to be covered, which is exactly why the pass-it-on rule is worth knowing.
If your licence or passport has turned up in a breach, this is the highest-value fifteen minutes available to you.
2. Tell your telco you're at risk.
Under the ACMA's Customer Identity Authentication Rules, telcos must run multi-factor authentication before high-risk transactions like a SIM swap or a port. What far fewer people know is that you can ask to be flagged as high-risk, ask for additional fraud mitigation protections on your account, and ask to be notified whenever changes to your account are requested.
Ring your provider and ask for all three. It costs nothing. It matters because your mobile number is the recovery route for everything else you own — if someone ports it, the codes come to them.
3. Two-factor on your email, using an app.
Last on the list and first in importance. Your email is the master key: whoever holds it can reset everything else. Use an authenticator app or a passkey rather than SMS, for the reason directly above.
The bigger shift happening quietly
IDLock wasn't the only thing announced on 31 August.
The same day, the government released the exposure draft of the next tranche of privacy reform — the Privacy Amendment (Personal Data Protection) Bill 2026. Two pieces of it are worth knowing about as an ordinary person.
Organisations would have a hard 72-hour deadline to notify the Information Commissioner of an eligible data breach, replacing today's "as soon as practicable". Anyone who lived through a recent breach — where the full scope arrived in dribs and drabs over weeks — will understand why a fixed clock matters.
And there's a right to have your data deleted, though a narrow one: it applies only to large digital platforms, defined as those above $500 million in revenue or 2.5 million average monthly Australian users, and it comes with a long list of exceptions.
It's a draft, and drafts change — submissions on this one close on 18 September, so if you have a view, there's a fortnight to put it in. But the direction is consistent with IDLock, and it's a direction worth noticing: after four years of being told to be more careful, Australians are slowly being handed actual controls.
The government's own consultation notes that nearly four in five Australians feel they have little control over how their personal information is collected and used. That number is the reason all of this is happening.
Why the switch beats the advice
Here's the argument for doing this at all, and it's the same argument we keep landing on.
Most cyber advice asks you to be vigilant. Spot the fake email. Notice the wrong domain. Sense that the caller isn't who they say. All of it puts the work on you, forever, at the exact moment you're busiest, and all of it fails eventually — because being right a thousand times and wrong once still costs you everything.
A switch is different. A switch doesn't require you to be alert. It doesn't degrade when you're tired or distracted or in the middle of moving house. You flip it once and it holds.
Australia's identity crime numbers explain why that's worth something. The Australian Institute of Criminology's most recent national survey found 31% of Australians had experienced identity crime in their lifetime, and 20% in the past twelve months. Of those hit in the past year, 29% suffered a financial loss. And across all victims, just 19% had any money reimbursed.
One in five of us, in a single year. And fewer than one in five victims saw a cent come back.
You can't be careful enough to beat that. You can, however, turn a switch off.
If it's already happened
Speed matters, and so does not sitting with it alone.
-Call IDCARE on 1800 595 160. Free, Australian, and they will build you a written response plan specific to which documents were involved. They are the single best call you can make.
-Contact your licence issuer and ask about a replacement or a block, using the state-by-state list above.
-Put a credit ban in place — one call, passed to all three bureaus.
-Report it to ReportCyber at cyber.gov.au. Your bank and insurer will ask for the reference number.
-Report it to Scamwatch at scamwatch.gov.au.
-Ask about a Commonwealth Victims' Certificate. If your identity has been misused in a Commonwealth offence, you can apply to a magistrate in your state or territory for a certificate that helps you prove to banks, telcos and credit providers that the debts and accounts aren't yours. Very few people know it exists. The Attorney-General's Department has the application form.
-Write the timeline down while it's fresh. Every notification, every call, every date.
And say the quiet part: this is not a failure of judgement. You did not choose the vendor that lost your licence details. You handed your ID to a rental agency, a gym, a hotel, a hospital, because they asked and you had no realistic option to refuse.
Being careful was never the variable here. That's precisely why a switch is worth more than a warning.
The thing to actually do
If you're in WA: log into DoTDirect, go to Protect your identity, add the licence block. Two minutes.
Everywhere else: look up your state's page above, find out whether your card number can be changed, and put a credit ban on while you're at it.
Then tell one other person. Preferably the one in your family who hands over their licence most often and thinks about it least.
The national switch arrives in 2027. Most of us don't have to wait that long.
---
SelfCybr helps Australian individuals and families see what's exposed, fix it, and learn how to stay ahead of it. No jargon, no shame, no data sold — ever. Australian-owned, Australian-hosted.
Sources and further reading
IDLock and the announcement
- Attorney-General's Department — New identity protection service 'IDLock' to give Australians greater control over identity documents (https://ministers.ag.gov.au/media-centre/new-identity-protection-service-idlock-give-australians-greater-control-over-identity-documents-31-08-2026), 31 August 2026
- Cyber Daily — Australians to gain greater control over compromised identity documents with new IDLock scheme (https://www.cyberdaily.au/government/14118-australians-to-gain-greater-control-over-compromised-identity-documents-with-new-idlock-scheme)
- ID Tech Wire — Australia Will Let People Switch Off Their Own Identity Documents (https://idtechwire.com/australia-will-let-people-switch-off-their-own-identity-documents/)
The Credential Protection Register and the DVS
- IDMatch / Document Verification Service — Data breach — information for individuals (https://www.idmatch.gov.au/individuals/data-breach)
- Attorney-General's Department — Identity protection and recovery (https://www.ag.gov.au/national-security/identity-security/identity-protection-and-recovery)
- Commonwealth Fraud Prevention Centre — Credential Protection Register: a lifeline to victims of identity crime (https://www.counterfraud.gov.au/news/general-news/credential-protection-register-lifeline-victims-identity-crime)
- Attorney-General's Department — More than 750,000 fraudulent identity verification requests blocked (https://ministers.ag.gov.au/media-centre/more-750000-fraudulent-identity-verification-requests-blocked-04-05-2026), 4 May 2026
State and territory licence protections
- Transport WA — Identity security (https://www.transport.wa.gov.au/licensing/identity/identity-security) and How to add or remove a driver's licence block (https://www.transport.wa.gov.au/about-us/help-centre/how-to-add-remove-drivers-licence-block)
- WA Consumer Protection — Commissioner's Blog: Block your driver's licence to lock-out identity thieves (https://www.wa.gov.au/government/announcements/commissioners-blog-block-your-drivers-licence-lock-out-identity-thieves-0)
- Queensland Government — Protecting your identity (https://www.qld.gov.au/transport/licensing/driver-licensing/protecting-your-identity)
- SA.GOV.AU — Replace your driver's licence after a data breach (https://www.sa.gov.au/topics/driving-and-transport/licences/licence-data-breach)
- Service Tasmania — Personal details compromised in a cyberattack, identity theft or fraud (https://www.service.tas.gov.au/services/me-and-my-identity/personal-information-card/personal-details-compromised-in-a-cyberattack-identity-theft-or-fraud/)
- Service NSW — Data breaches — NSW driver licence (https://www.service.nsw.gov.au/guide/data-breaches)
- VicRoads — Protecting your identity: cards and card numbers (https://www.vicroads.vic.gov.au/licences/cards-and-card-numbers)
- Access Canberra — Protect your identity after a data breach or cyber attack (https://www.accesscanberra.act.gov.au/identity/protect-your-identity-after-a-data-breach-or-cyber-attack)
- NT Government — Driver licence cards affected by data breach (https://nt.gov.au/driving/licence/existing-nt-licence/data-breach)
- myGov — Replace stolen identity documents (https://my.gov.au/en/services/living-arrangements/experiencing-crime-and-other-risks-online/what-to-do-if-things-go-wrong-online/recover-from-identity-theft-or-a-data-breach/replace-stolen-identity-documents)
Credit bans and telco protections
- OAIC — Fraud and your credit report (https://www.oaic.gov.au/privacy/your-privacy-rights/credit-reporting/fraud-and-your-credit-report)
- Experian Australia — Request a ban on your credit report (https://www.experian.com.au/consumer/request-a-ban)
- Equifax Australia — Credit report ban (https://www.equifax.com.au/personal/help-centre/credit-report-ban)
- ACMA — Customer identity authentication rules (https://www.acma.gov.au/customer-identity-authentication-rules)
Privacy reform
- Attorney-General's Department — Privacy reform consultation (https://consultations.ag.gov.au/rights-and-protections/privacy-reform/) (Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft)
- iTnews — Privacy Act overhaul to tighten 72-hour breach reporting deadline (https://www.itnews.com.au/news/privacy-act-overhaul-to-tighten-72-hour-breach-reporting-deadline-628568), 2 September 2026
Scale
- Australian Institute of Criminology — Identity crime and misuse in Australia 2023 (https://www.aic.gov.au/publications/sb/sb42) (Statistical Bulletin 42)
Where to get help
- IDCARE — [idcare.org](https://www.idcare.org/), or 1800 595 160
- ReportCyber / Australian Cyber Security Centre — [cyber.gov.au](https://www.cyber.gov.au/)
- Scamwatch — [report a scam](https://www.scamwatch.gov.au/report-a-scam)
- Attorney-General's Department — [*Application for a Commonwealth Victims' Certificate*](https://www.ag.gov.au/national-security/publications/application-commonwealth-victims-certificate)
