Part 1Asking for a ban
OAIC: fraud and your credit report
The right sits in the consumer credit laws and turns on fraud: it applies if you have been or are likely to be the victim of fraud, and a credit reporting body holds credit reporting information about you. The National Debt Helpline frames the test as reasonable grounds for believing that fraud or identity theft has happened to you, or is likely to. Asking for a ban, or for an extension, is free.
The OAIC’s fraud page recommends making the request to all 3 credit reporting bodies in case each keeps a consumer credit report on you, though Moneysmart says there are two main credit reporting bodies in Australia. Each body asked then places a ban period on the report it holds, running for 21 days from your first request. Instead of applying to each body yourself, you can ask one of them to pass your request on to the others, and it must do so as soon as reasonably practicable.
In the Act, the ban period starts when you make the request and ends “21 days after the day on which the request is made”, or, if the period is extended, on the day after the extended period ends.
Part 2What the ban does
The OAIC: “During the ban period, a credit reporting body mustn’t use or disclose your consumer credit report (or the information in the credit report).” There are two exceptions. The body may do so if you have consented to the use or disclosure in writing, or if an Australian law or a court or tribunal order requires it.
The ban also sends a signal. If a credit provider asks the body for a copy of your report during the ban, the body will tell it about the ban, which alerts the credit provider to the potential fraud. Moneysmart describes the purpose in similar terms: a temporary ban is there to ensure no unauthorised loans or credit applications are made.
It works on your own applications too. The OAIC notes that while a ban is in place it may be harder for you to apply for credit; a provider might, for example, need to gather more of your personal information from you directly.
Part 3Before it ends, and after
At least 5 business days before the ban expires, the credit reporting body must notify you. The OAIC lists what that notice must tell you:
- “of the date the ban period is due to finish”
- “about your rights to extend the ban period”
- “what, if any, information it requires to support your allegation of fraud.”
With no further action from you, the ban is lifted after 21 days.
Towards the end of the ban, if you are still concerned about fraud, you can ask the body to extend it. The OAIC says a credit reporting body must extend the ban if it believes you have been or are likely to be the victim of fraud, and that if it decides to extend, it must tell you in writing and say how long the extension is. There is no limit on how many times a ban can be extended; the Act says the same in its own words, that a ban period “may be extended more than once”.
A ban can also be lifted at your own request: the OAIC says you can apply by filling out an online form on a credit reporting body’s website.
Part 4Alongside the ban
For anyone who has lost money or shared personal information in a scam, Moneysmart’s page on reporting a scam suggests getting a free copy of your credit report and checking it for unauthorised activity. If credit you never applied for is on it, you can ask any credit reporting body to correct it, and the OAIC’s page Correct your credit report sets out what the law requires of whoever you ask. The OAIC notes that a third party may make that request on your behalf if you are a victim of fraud or identity theft. The OAIC calls such a person an access seeker: someone who helps you deal with a credit provider or credit reporting body with your consent, acting on your written authority.
Scamwatch describes IDCARE as “Australia and New Zealand’s national identity and cyber support service”, one that can help you make a plan, for free, to limit the damage. Where money, personal information or accounts have been stolen, Moneysmart points to your local police, or a report online through ReportCyber.