Identity Theft: Locking Down Your Money

🔒 How to Protect Yourself

Protection is mostly about making yourself a harder target than the next person. A short list of habits does the heavy lifting.

Strong, Unique Passwords and a Password Manager

The biggest single weakness is reusing the same password across sites. When one site is breached, criminals try that email and password combination everywhere else, a trick called credential stuffing. The fix is a different, long password for every account. Nobody can remember dozens of them, so use a password manager: an app that generates and stores strong passwords behind one master password. You then only need to remember that one master password, and it should be long and unique.

Turn On Two-Factor Authentication

Two-factor authentication, sometimes called 2FA or two-step verification, asks for a second proof of identity when you log in: a code from an authenticator app, a prompt on your phone, or a code by text. Even if a criminal has your password, they cannot get in without the second factor. Turn it on for your email, internet banking, IRD, RealMe and social media. Where you can choose, an authenticator app is safer than text messages, because texts can be intercepted through SIM swapping.

Guard Your Key Documents

• Keep your passport, birth certificate and citizenship certificate somewhere secure, not in your everyday bag.
• Do not carry documents you do not need that day.
• Shred or burn anything with personal details before you throw it out, rather than putting it in the bin whole.
• When you move house, redirect your mail with NZ Post so letters do not pile up at your old address for someone else to collect.
• Think before you post: your date of birth, address and answers to common security questions are often visible on social media.

Check Your Credit Report

Your credit report shows accounts and credit applications in your name. Checking it is the easiest way to spot an account a fraudster has opened. In New Zealand three credit reporters hold files on you: Centrix, Equifax and Experian (formerly illion). You are entitled to one free report a year from each of them, so you can space them out and check your file several times a year at no cost. Our guide to checking your credit report walks through how.

Freeze Your Credit File for Free

If you have been, or think you are likely to be, a victim of fraud, you can place a suppression, often called a freeze, on your credit file. While it is in place, the credit reporters will not release your credit information to new lenders, which stops a criminal opening credit in your name. This is a right under the Credit Reporting Privacy Code and it is free.

• An initial suppression lasts 10 working days.
• Since a recent change to the Code, one request to any one of the three reporters is treated as a request to all three, so a single application covers Centrix, Equifax and Experian.
• You can extend it if the fraud risk continues, for example by providing a police report number as evidence.

Protecting RealMe and Government Logins

RealMe is a single login that many government services share, including IRD, Work and Income and StudyLink, so protecting it protects all of them at once. Keep your RealMe login details private and never share them. Turn on two-factor authentication, either a code by text or an authenticator app. If you change your mobile number, update it in your RealMe account so your codes still reach you. If you suspect someone knows your password, change it and tell the relevant agency straight away.

🚨 What to Do If Your Identity Is Stolen

If you think your identity or personal information has been stolen, act quickly and in order. Speed matters most for recovering money and closing off further fraud.

The First Hour

1. Contact your bank immediately. The sooner the bank knows, the better the chance of stopping or recovering a payment. Ask them to freeze cards, block accounts and watch for suspicious activity.
2. Change your passwords, starting with your email, then any account that shares that password. Turn on two-factor authentication as you go.
3. If a device was involved, disconnect it from the internet, remove any malicious software, and change your passwords from a different, clean device.

Report It

Replace Compromised Documents

• Passport: contact the Department of Internal Affairs to cancel and replace it.
• Driver licence: report it to the Police and apply for a replacement licence.
• Bank cards: contact the card issuer to cancel and reissue.
• IRD number: contact Inland Revenue's identity security team if you think your IRD number has been misused.
• Citizenship certificate: contact the Citizenship Office.

Put a Suppression on Your Credit File

Place a free suppression with the credit reporters so no one can open credit in your name while you sort things out. One request now covers Centrix, Equifax and Experian. Then order your free credit report from each to check for accounts or applications you did not make, and dispute anything that is not yours.

If a Government Login Is Affected

If you think someone has your RealMe or IRD login, change the password immediately, turn on two-factor authentication, and notify the agency. Because RealMe unlocks several services, treat any compromise of it as urgent and check each connected service for changes you did not make, such as altered bank account details for refunds or payments.

🔢 Worked Examples

These four scenarios show the steps in practice, from the first frantic hour to a longer business recovery.

Related Guides

• Bank Account Security Guide
• Avoiding Scams Guide
• Checking Your Credit Report Guide