Pre-approvalsFile E of 7

File E · After fraud

A ban on your file after identity theft

If you believe on reasonable grounds that you have been, or are likely to be, a victim of fraud, you can ask a credit reporting body not to use or disclose your credit reporting information. The ban runs for 21 days from your request, can be extended more than once, and asking costs nothing.

Drawn for this guide. Requesting a ban, or an extension, is free.

E.1 · How it runs

One ban, from request to end

Example only · made-up dates

Someone asks a credit reporting body for a ban on Tuesday 10 November 2026.

  1. The same day. The body must immediately note the request on your information, and explain the ban’s effect and length, including that you may not be able to get credit during it.
  2. The same conversation. It must also tell you that you can ask other bodies for a ban, and that you can consent to it passing your request on to the bodies you name. If you do, it must pass the request on as soon as reasonably practicable, and each of those bodies treats it as if you had asked it directly.
  3. By Tuesday 24 November 2026. The body must tell you, no less than 5 business days before the end, the date the ban finishes, your right to extend it, and any information it needs to support your allegation of fraud. In this example that is 5 business days before the end date, with no public holiday in between.
  4. Tuesday 1 December 2026. The ban ends 21 days after the day of the request, unless it has been extended.

The OAIC suggests asking all three bodies, in case each holds a report about you.

E.2 · When a lender asks

When a lender asks during the ban

If a credit provider, mortgage insurer or trade insurer asks for your information while a ban is in place, the body must tell it about the ban and what the ban means. The OAIC’s reading: that alerts the lender to possible fraud.

The ban notification service

Since 1 October 2025, the code has required each credit reporting body to run a ban notification service for people with a ban in place. If you have asked for it, the body must let you know, using the contact details you gave it, when it has told a lender or insurer about your ban because that lender or insurer asked for your information. A body may first ask for your express written consent to use your credit reporting information to send those notifications.

Credit given anyway

The Act deals with a lender that goes ahead during a ban. If the body couldn’t disclose your information because of the ban, and the lender still provided the credit to you, or to someone claiming to be you, it must not report information about that credit to a credit reporting body unless it took reasonable steps to verify the borrower’s identity.

E.3 · Applying

Applying for credit while a ban is on

During the ban, the body must not use or disclose your credit reporting information. Only two things lift that for a particular check: your express written consent, or a requirement under an Australian law or an order of a court or tribunal.

The OAIC is direct about the trade-off: while a ban is in place, applying for credit may be harder, and a lender may have to ask you directly for more of your personal details. If you need to lift a ban, the OAIC says you can apply through an online form on the credit reporting body’s website.

Whether to consent to a check, or to lift a ban, before a pre-approval is a decision about your own circumstances. Moneysmart notes that IDCARE can help people make a plan, for free, to limit the damage of identity theft.

E.4 · Extending

Extending a ban, and what a body may ask

If you ask before the ban ends, and the body believes on reasonable grounds that you have been, or are likely to be, a victim of fraud, it must extend the ban for a period it considers reasonable and tell you in writing. There is no limit on how many times a ban can be extended.

The code keeps the questions in proportion. When deciding an extension, a body may ask why you believe you are a victim of fraud and why you want the extension. It may ask for more only if your answers, or the circumstances, point to reasonable grounds to believe you are not. You can also consent to the first body passing your extension request, with any supporting material, to the bodies it notified before.

E.5 · Help

Help beyond the credit file

A ban protects the credit file. Moneysmart’s steps for identity theft reach further: contact your bank and other financial institutions, change your passwords, report the fraud to police through ReportCyber, and report it to Scamwatch.

IDCARE describes itself as Australia’s national identity and cyber incident support service, offering free expert support. Its helpline for individuals is 1800 595 160, Monday to Friday, 7am to 7pm AEST.