Identity Theft: Locking Down Your Money
🛡️ What Identity Theft Is
Identity theft happens when someone gets enough of your personal information to pretend to be you. With a name, date of birth, address, an IRD number, or a copy of your passport or driver licence, a fraudster can open bank accounts and credit cards in your name, take out loans, redirect your mail, hijack your online logins, or drain accounts you already hold. In New Zealand the National Cyber Security Centre records thousands of cyber incidents every year, and identity crime sits behind many of them. The damage is not just money taken today; it is the weeks or months of work untangling accounts opened in your name and repairing your credit record. The reassuring part is that identity theft is largely preventable with a handful of habits, and that if it does happen, New Zealand has free, specialist help that most people never realise exists. This guide covers how identity theft happens here, how to protect yourself, and exactly who to contact and what to do if your identity is stolen.
Our bank account security guide covers keeping your everyday banking safe. This guide is narrower and deeper on one thing: protecting and recovering your whole identity across banks, government agencies and the credit reporting system. If your problem is a compromised bank login, start with the account security guide. If your name, documents or IRD number are in the wrong hands, you are in the right place.
How Identity Theft Happens in New Zealand
Fraudsters gather your details in several common ways:
- Phishing: fake emails, texts or calls that pretend to be your bank, IRD, NZ Post or a courier, designed to trick you into entering your login, card details or a verification code.
- Data breaches: a company you have dealt with is hacked and your details are leaked or sold. You may not even know until the information is used.
- Mail theft: letters stolen from an unsecured letterbox can contain enough personal detail to impersonate you, especially around a house move.
- SIM swapping: a fraudster convinces your mobile provider to move your number to their SIM, so the two-factor codes texted to you arrive on their phone instead.
- Lost or stolen documents: a wallet or bag with your driver licence, cards and other identification is a ready-made kit for impersonation.
Your IRD number, passport number and driver licence number are the building blocks of identity fraud because they help a criminal pass identity checks. Treat them like a bank PIN. Do not share them by email or text, and be suspicious of anyone who phones or messages asking you to confirm them. Legitimate agencies do not cold-call asking you to read out these numbers.
🔒 How to Protect Yourself
Protection is mostly about making yourself a harder target than the next person. A short list of habits does the heavy lifting.
Strong, Unique Passwords and a Password Manager
The biggest single weakness is reusing the same password across sites. When one site is breached, criminals try that email and password combination everywhere else, a trick called credential stuffing. The fix is a different, long password for every account. Nobody can remember dozens of them, so use a password manager: an app that generates and stores strong passwords behind one master password. You then only need to remember that one master password, and it should be long and unique.
Length beats complexity. A passphrase of four or five random words is both strong and easier to type than a short string of symbols. Never reuse your email password anywhere else: your email is the master key that can reset every other account, so it deserves your strongest password and two-factor authentication.
Turn On Two-Factor Authentication
Two-factor authentication, sometimes called 2FA or two-step verification, asks for a second proof of identity when you log in: a code from an authenticator app, a prompt on your phone, or a code by text. Even if a criminal has your password, they cannot get in without the second factor. Turn it on for your email, internet banking, IRD, RealMe and social media. Where you can choose, an authenticator app is safer than text messages, because texts can be intercepted through SIM swapping.
Guard Your Key Documents
- Keep your passport, birth certificate and citizenship certificate somewhere secure, not in your everyday bag.
- Do not carry documents you do not need that day.
- Shred or burn anything with personal details before you throw it out, rather than putting it in the bin whole.
- When you move house, redirect your mail with NZ Post so letters do not pile up at your old address for someone else to collect.
- Think before you post: your date of birth, address and answers to common security questions are often visible on social media.
Check Your Credit Report
Your credit report shows accounts and credit applications in your name. Checking it is the easiest way to spot an account a fraudster has opened. In New Zealand three credit reporters hold files on you: Centrix, Equifax and Experian (formerly illion). You are entitled to one free report a year from each of them, so you can space them out and check your file several times a year at no cost. Our guide to checking your credit report walks through how.
Freeze Your Credit File for Free
If you have been, or think you are likely to be, a victim of fraud, you can place a suppression, often called a freeze, on your credit file. While it is in place, the credit reporters will not release your credit information to new lenders, which stops a criminal opening credit in your name. This is a right under the Credit Reporting Privacy Code and it is free.
- An initial suppression lasts 10 working days.
- Since a recent change to the Code, one request to any one of the three reporters is treated as a request to all three, so a single application covers Centrix, Equifax and Experian.
- You can extend it if the fraud risk continues, for example by providing a police report number as evidence.
Protecting RealMe and Government Logins
RealMe is a single login that many government services share, including IRD, Work and Income and StudyLink, so protecting it protects all of them at once. Keep your RealMe login details private and never share them. Turn on two-factor authentication, either a code by text or an authenticator app. If you change your mobile number, update it in your RealMe account so your codes still reach you. If you suspect someone knows your password, change it and tell the relevant agency straight away.
Your bank, IRD and RealMe will never ask for your full password, PIN or a two-factor code by phone, email or text. Anyone who does is a fraudster. If a message pressures you to act immediately or threatens a penalty, that urgency is the warning sign. Stop, and contact the organisation on a number you look up yourself, not one in the message.
🚨 What to Do If Your Identity Is Stolen
If you think your identity or personal information has been stolen, act quickly and in order. Speed matters most for recovering money and closing off further fraud.
The First Hour
- Contact your bank immediately. The sooner the bank knows, the better the chance of stopping or recovering a payment. Ask them to freeze cards, block accounts and watch for suspicious activity.
- Change your passwords, starting with your email, then any account that shares that password. Turn on two-factor authentication as you go.
- If a device was involved, disconnect it from the internet, remove any malicious software, and change your passwords from a different, clean device.
Report It
| Who | Contact | For what |
|---|---|---|
| Your bank | The number on your card or statement | Stopping and recovering payments, freezing cards |
| IDCARE | 0800 121 068 | Free specialist help and a step-by-step recovery plan |
| Netsafe | 0508 638 723 | Reporting scams and online harm |
| NZ Police | 105 (111 if in immediate danger) | Reporting a crime and getting a report number |
| NCSC | 0800 114 115 or ncsc.govt.nz/report | Reporting a cyber incident |
IDCARE is a not-for-profit charity that supports people through identity theft and cybercrime across New Zealand and Australia. Its service is free to individuals. A case manager works with you to build a clear recovery plan and can help you deal with banks, government agencies and phone companies. If you only make one call, make it this one, on 0800 121 068, Monday to Friday.
Replace Compromised Documents
- Passport: contact the Department of Internal Affairs to cancel and replace it.
- Driver licence: report it to the Police and apply for a replacement licence.
- Bank cards: contact the card issuer to cancel and reissue.
- IRD number: contact Inland Revenue's identity security team if you think your IRD number has been misused.
- Citizenship certificate: contact the Citizenship Office.
Put a Suppression on Your Credit File
Place a free suppression with the credit reporters so no one can open credit in your name while you sort things out. One request now covers Centrix, Equifax and Experian. Then order your free credit report from each to check for accounts or applications you did not make, and dispute anything that is not yours.
If a Government Login Is Affected
If you think someone has your RealMe or IRD login, change the password immediately, turn on two-factor authentication, and notify the agency. Because RealMe unlocks several services, treat any compromise of it as urgent and check each connected service for changes you did not make, such as altered bank account details for refunds or payments.
Write down what happened and when, keep copies of scam messages and screenshots, and note every reference number you are given by your bank, the Police, Netsafe or the NCSC. A clear record speeds up investigations, supports a credit suppression extension, and helps if you need to prove you were a victim later.
🔢 Worked Examples
These four scenarios show the steps in practice, from the first frantic hour to a longer business recovery.
Situation: At 8:10am Aroha gets a text that looks like it is from her bank: a payment needs approving, tap the link. She taps, enters her internet banking login and a code the site asks for. Minutes later she sees a $1,200 transfer she did not make.
Her first 24 hours:
Situation: A retailer Wiremu bought from is hacked, and his name, date of birth and driver licence number are exposed. No money has been taken, but he wants to stop anyone opening credit in his name.
What he does:
Placing a suppression does not damage your credit rating and does not stop you using existing accounts. It only blocks new credit checks, which is exactly what you want when someone may be trying to borrow in your name. Lift it easily when you next need to apply for credit yourself.
Situation: Sione's bag is stolen at a cafe. Inside are his passport, his driver licence and a bank card. He is worried the documents will be used to impersonate him.
His recovery steps:
Replacing a document is not the same as cancelling the stolen one. Make sure the old passport and licence are formally reported and cancelled so they cannot be used, and keep the police report number, which agencies and credit reporters may ask for.
Situation: A small business, Kauri Joinery, is emailed an invoice that looks like it is from a regular supplier. A fraudster has been reading the email thread and has changed the bank account on the invoice. The bookkeeper pays $8,400 to the fraudster's account.
The response:
Related Guides
- Bank Account Security Guide
- Avoiding Scams Guide
- Checking Your Credit Report Guide
- Income Protection vs Mortgage Protection, a related guide in the same area.
- AI voice cloning and deepfake scams guide, for what an attacker does with your details and your voice.
Verified July 2026 against Consumer Protection (consumerprotection.govt.nz), the New Zealand Government identity theft pages (govt.nz), Netsafe (netsafe.org.nz, helpline 0508 638 723), IDCARE (idcare.org, 0800 121 068), the National Cyber Security Centre (ncsc.govt.nz, report line 0800 114 115), the Office of the Privacy Commissioner and the Credit Reporting Privacy Code (privacy.org.nz), and RealMe (realme.govt.nz). CERT NZ merged into the NCSC in 2024.
🎯 Test Your Knowledge
Complete this 10-question quiz to check what you have learned about identity theft protection
Related tools and guides
- Subscription cost calculator: audit your outgoings for charges you never authorised.
- Emergency fund months calculator: the runway you have while accounts are locked down.