Truyu, the identity protection app built by CommBank, is urging Australians to be vigilant about a tactic it calls “Stolen Identity Validation”, where criminals test stolen personal information through small-scale acts of identity fraud before exploiting those same details further.
Personal information is highly sought-after by criminals because it allows them to pass identity checks required to open bank accounts, apply for credit cards and take out personal loans – leaving victims to deal with the consequences.
Truyu alerts customers when their identity details are checked by a majority1 of Australian merchants, prompting them to confirm whether they recognise the activity. Analysis of those customer responses found that nearly a third (32%) of unauthorised identity checks had been preceded by an earlier telco-related identity check.
“Criminals are constantly looking for ways to test and exploit stolen identity information before using it for wider fraud. Activating prepaid SIM cards is one method we’re seeing used,” said James Roberts, CommBank Scam Prevention Officer.
While the pattern identified by Truyu suggests criminals are taking a considered – even cautious – approach to validating stolen identity details, they waste little time exploiting those details once confirmed. In almost half of those cases (47%), a second unauthorised identity check occurred within a week of the first.
“This ‘Stolen Identity Validation’ technique is about what comes next,” continued Roberts. “Once criminals confirm your details are accurate, they can reuse them across services to open accounts, apply for credit, or impersonate you.”
“Unexplained account openings, credit enquiries, or identity verification notifications can be early signs your details are being tested – even if no money has been stolen at that point,” said Melanie Hayden, Truyu Managing Director.
“Don’t ignore the warning signs,” continued Hayden. “If you notice unexpected activity involving your personal information, take it seriously. Act quickly to secure your accounts and report it to your bank, telco or relevant provider.”
Alongside Identity Check Alerts, Truyu’s app includes a range of other features to help protect Australians from fraud, including:
- Credit Activity Alerts: Alerts when your credit file is accessed or updated – for example, if a new bank account, loan or credit card is opened in your name.
- Email Leak Alerts: Notifies you if your email address appears in known data breaches, so you can secure affected accounts.
- Card Leak Alerts: Check if your debit or credit card details have been exposed, including on the dark web.
- Password Leaks: Scans dark web sources for exposed passwords linked to your email address and prompts you to act if they’re found.
- Scam Checker: A free, AI-powered tool that analyses screenshots of text messages to help identify potential scams and provide guidance on next steps.
Developed by CommBank’s venture scaling arm, x15ventures, and launched in May 2024, Truyu has since helped prevent an estimated $51 million in potential fraud losses, by:
- Issuing more than 105,000 Email Leak Alerts
- Detecting and alerting customers in the moment to nearly 25,000 identity checks
- Identifying more than 10,000 leaked passwords
The Truyu app can be downloaded from the Apple App Store and Google Play. Truyu is also available to organisations as a breach response and cyber remediation service to help protect customers affected by a data breach.
Truyu features are not available on desktop or web.
For more, visit: truyu.com.au
1 Truyu covers 63% of identity checks in Australia.
