The legal framework
There is no standalone identity theft offence: prosecutions proceed under obtaining by deception, forgery and computer misuse provisions of the Crimes Act 1961. CERT NZ receives reports of cyber incidents and works with IDCARE, which provides free case management to New Zealanders, and credit bureaus offer suppression of your file.
New Zealand prosecutes identity misuse through the Crimes Act offences of forgery, using a forged document and obtaining by deception. Support is well organised: CERT NZ receives reports of cyber incidents and routes them, and IDCARE provides free case management for individuals, working through the practical steps with each organisation involved. The combination of a reporting body and a case-management service is the country's strength here.
Key points
| Offences | Obtaining by deception, forgery, accessing a computer system for dishonest purpose |
|---|---|
| Reporting | CERT NZ for cyber incidents; Police for the fraud itself |
| Support | IDCARE provides free response plans in New Zealand |
| Credit suppression | Centrix, Equifax and Illion can suppress or flag your file |
| Documents | Report stolen passports to the Department of Internal Affairs |
| Privacy | Report the underlying breach to the Privacy Commissioner |
| RealMe | Check and secure the government login service |
| Passport cancellation | Report a stolen passport to Internal Affairs immediately |
| Bureau suppression | Must be requested at each bureau separately |
In practice
- Call your bank, then report to Police and CERT NZ.
- Contact IDCARE for a free response plan.
- Ask each credit bureau to suppress your file so new credit cannot be granted.
- Cancel and replace compromised identity documents.
- Secure your RealMe login: it gives access to a wide range of government services.
Where to go
- CERT NZ.
- IDCARE New Zealand.
- Netsafe.
Worth knowing
Credit file suppression has to be requested at each bureau separately: doing only one leaves the others open. File suppression is not shared between bureaus. Doing only one leaves the others open to a new application.
Frequently asked questions
What does IDCARE do?
It provides free, individual case management for people whose identity has been misused: a case manager works out which organisations are affected, what evidence each needs and in what order to approach them. It operates in New Zealand and Australia and is the single most useful call after your bank.
What should you do in the first hour?
Call your bank and freeze the affected accounts and cards, change the passwords on your email first and then on everything linked to it, and turn on two-factor authentication. Take screenshots of everything before anything is deleted. Then report to the police and keep the reference number: banks, lenders and telecom operators will ask for it before they reverse anything.
Official sources and links
- govt.nz — official government information
- New Zealand Legislation — acts and regulations