How to keep Australian ID documents safe on your phone, and what to do after a breach

Keep one locked copy of each document on your phone, use the official digital versions (your state’s licence app, the myGov wallet, myID) wherever they are accepted, and hand out as few copies as you can. If a data breach notice names your licence, Medicare card or passport, contact the agency that issued it.

Specimen Australian passport with made-up details. Keeping a copy safe starts with keeping fewer of them.

The copies you hand out are the ones that leak

The Australian Passport Office puts it simply: once you share identity information, you lose control of where it is stored, how it is managed and how long it is kept. Keeping documents safe is as much about handing out fewer copies as about locking your own.

Use the official digital versions first

Licence: the NSW, Victorian and Queensland digital licences can be checked by scanning a QR code on your screen, without you handing over the phone.
Medicare and Centrelink cards: the myGov app’s wallet holds them, each with a QR code a provider can scan.
Online identity checks: a Digital ID such as myID confirms who you are without sending documents, so fewer organisations need to keep your personal information.
Rental applications: NSW Fair Trading guidance calls it best practice for an agent to sight your ID and note what it needs, without storing it.

Keep the copies you need in one locked place

One copy of each document, in an app that asks for Face ID, Touch ID or a passcode. The iPhone locking guide compares the built-in options.
Front and back together, named, so you never resend the wrong one.
Nothing in shared albums, group chats, email drafts or a Downloads folder.
Copies that open offline when you travel, with the passport itself in your bag.
No photo of your tax file number: the ATO lists only a few organisations that need it, and you can find it in your ATO online account through myGov.

When a breach notice names your documents

For a government-issued document, the OAIC’s advice is to contact the agency that issued it; for your tax file number, the ATO. Change your email and banking passwords and turn on multi-factor authentication.

NSW driver licence: replace the card only if you are told both the licence number and the card number were compromised. A replacement costs $29, and your licence number stays the same.
Passport: you can keep using it, apply to replace or renew it, or ask the Passport Office to cancel it straight away.
Any compromised document: the issuer may add it to the Credential Protection Register, set up in 2022 after several major breaches, so it can no longer be verified through the Document Verification Service. IDLock, a coming service to block and unblock your own documents, is planned for a national rollout in 2027.

IDCARE, the national identity support service, helps for free on 1800 595 160, and the guide to sending ID copies lists where to report misuse.

A wallet built for documents

Dokus keeps each document encrypted on your iPhone, front and back together, behind Face ID or Touch ID, and opens offline. Sync through your own iCloud is optional, there is no Dokus account or document server, and screenshots of a document come out blank. Every sharing tool is free; Dokus Plus adds expiry reminders and lifts the free document limit.

Common questions

Is the myGov wallet safer than a photo of my Medicare card?

It does something a photo cannot: the wallet card carries a QR code that a provider can scan to check the card is genuine and valid. myGov still suggests carrying the physical card while providers get ready to accept digital ones.

My licence was in a data breach. Do I need a new card?

In NSW, only if you are told both the licence number and the card number were exposed; Service NSW says the licence number alone cannot pass a Document Verification Service check. Other states set their own rules, so ask the authority that issued your licence.

Can someone get a passport with my leaked passport number?

The Australian Passport Office says a passport number cannot be used by someone else to get a new passport, and that travelling under your identity needs the physical passport. The leaked details can still be used for other identity fraud.