This is a bit of a worry and shows how identify theft can wreak havoc.
After some of those earlier significant business hacks I put a credit services access ban on myself for a year so this could not happen to me. That means nobody, no matter how well they pretend to be me, can apply for credit in my name.
My year ban expires soon and then I will add another year. A year at a time is the max they offer.
In late January, Victorian man Robert Cox got an unexpected knock at the door.
A man with a clipboard, sent by Sydney-based lender Branded Financial Services, had to come to find a grey luxury Audi SUV purchased for more than $111,000 in Robert’s name two weeks earlier.
Cox knew nothing of the car – or the loan taken out in his name. The man showed him a photo of a convincing-looking Victorian driver licence that was used during the loan process for the car.
It showed Cox’s correct name, address, date of birth and even the correct licence number in the topright corner. But the photo on the card looked nothing like him. The young man in the licence photo had black hair and a thick black beard and moustache.
‘‘I’ve thought, ‘Oh f---, this is weird’,’’ said Cox, a 41-year-old with light-brown hair. ‘‘I then showed him my real licence and said, ‘Nah man, this is the real me. I’ve been here forever’.’’
This bizarre interaction four weeks ago was the culmination of an increasingly common type of identity fraud following large-scale data breaches like Optus and Medibank hacks.
It also started Cox on his own path of investigation, which revealed an apparent loophole between state and federal systems that means some Victorian licences are not being properly validated during loan applications.
Cox immediately notified police and took advice from Australia’s national identity and cyber support service, IDcare, which recommended imposing a ‘credit ban’ to freeze access to his credit file via one of three credit reporting agencies in Australia – Equifax, Illion or Experion.
In doing so, Cox accessed his credit report for the first time. It revealed a previously undetected history of activity by fraudsters. ‘‘Turns out this started back in 2020,’’ he said.
Cox’s credit history – seen and verified by this masthead – revealed someone had attempted unsuccessfully to apply for a loan and a credit card in Robert’s name in 2020.
Nothing happened again until December last year, when two credit score check accounts were successfully opened with lenders WISR and Canstar to assess Cox’s credit rating. Then in January 2024, a fraudster attempted to take out loans with at least four different lenders for between $100,000 and $120,000.
They had success on January 15 when Branded Financial Services issued a loan of $111,651. The very same day, a 2023 model Audi RS Q3 was purchased with the fraudulent loan from Sydney car dealership The Auto Gallery from an online listing.
As of Friday, when police confirmed they were investigating Cox’s case, the whereabouts of the car remained unknown. Requests for comment from the dealership went unanswered.
Cox has no idea how fraudsters accessed his personal details in the first place. But once they had them, they were able to make a convincing fake Victorian licence, which can be purchased online for around $300.
Branded Financial Services chief executive Liesl Knox said that once her company detected the fraud – after the car had been transported from the dealership – it began investigating, including sending the field officer to Cox’s home to confirm their suspicion that the ID was not real.
‘‘We’ve been in contact with Mr Cox to support him through this stressful situation,’’ she said in a statement. ‘‘We will always absorb the cost of an incident such as that of Mr Cox’s identity thief and take steps to rectify the impact on the individual’s financial records which might otherwise prevent them from obtaining finance in the future.’’
Knox said Branded Financial Services had an ‘‘industrystandard identity validation system’’ and that the company worked ‘‘with authorities and external partner organisations to detect fraud, as was the case here’’.
She did not respond to questions about whether there were similar instances of fraud using Branded Financial Services or how much money the company had lost to such scams. But Cox remains perplexed as to how the criminal was able to get as far as they did.
An email from Branded Financial Services to Cox confirmed that the person purporting to be Cox used the ‘‘licence’’ with a fake card number on the back, a forged rate notice with the insignia of Cox’s local council, his Australian business number and a fraudulent ING bank account in Cox’s name as evidence to secure the $112,000 loan.
ING could not explain how the fraudster was able to open a bank account in Cox’s name, but a spokeswoman said the bank’s staff ‘‘apply, and continuously review, stringent and legislated identity validation measures to ensure we’re doing all we can to help safeguard customers from identify fraud’’.
The other lenders that allowed the criminal to access Cox’s credit file and hoover up more information – Wisr and Canstar – said they used both the licence number and card number provided by the fraudster in Cox’s case and to validate them against details stored in the federal government’s Document Verification Service (DVS), which stores all Australian licence details.
Cox last week tested that theory and tried to open a new Wisr account using a correct licence number but an intentionally fake card number as the fraudster had done with his identity. ‘‘And lo and behold, I got in,’’ he said.
Asked how this was allowed, Wisr admitted: ‘‘In the case of some Victorian driver’s licence holders, the Australian Government DVS system will return a driver’s licence as ‘verified’ to our credit bureau based on verification of the driver’s licence number only.’’
Paul Warren-Tape, general manager of risk and compliance at IDVerse – which provides biometric identity verification to major lenders – said this was a known limitation to the DVS method of validation.
He said before the Optus breach in 2022, the DVS only stored licence numbers – not card numbers. Since that time, VicRoads has uploaded card numbers for customers caught up in the Optus and Latitude Finance hack, but not everyone else.
‘‘[VicRoads] are still going through everyone else slowly as their licences expire,’’ Warren-Tape said. ‘‘So what that means is for all those remaining Victorian licence holders, that card number will be ignored for the purposes of validation against the DVS currently even if you supply it.
‘‘This is a common style kind of fraud attack where someone’s got someone else’s real information and then processes a licence with someone else’s face on it.’’
The DVS also does not check facial images. A forthcoming face verification service will.
A spokeswoman for Victoria’s Transport Department said VicRoads was ‘‘in the process of ensuring all Victorian licence holders have their unique card numbers loaded into DVS’’. She did not say how many licence card numbers were yet to be uploaded, or how long that would take.
The federal Attorney-General’s Department, which oversees the DVS, confirmed that only some Victorian card numbers were in its system and being included in its validations for lenders.
A spokeswoman for the department said ‘‘a decision as to whether, and if so when, to make Victorian drivers licence card numbers available to the DVS is a matter for VicRoads and the Victorian government’’.
‘‘I know that it’s easy for everyone to point their finger in this situation ... but the simple reality is it’s the responsibility of the lender to identify that the person that they’ve got is actually who they say they are,’’ he said.
Warren-Tape said lenders should use additional tools, including AI that can detect fake or tampered IDs, and require selfie videos of a person showing they match the ID they submitted.
‘‘The DVS does have a place, but it’s not the be-all and end-all,’’ he said. ‘‘It isn’t going to stop an identity take-away.’’
