What a stolen license number proves, and what banks treated it as proving

The week

In September 2022, millions of Australians learned that their driver’s license number, something most people read off a card when a form asks for it, was also something a criminal already had.

On September 22, 2022, Optus, Australia’s second-largest telecommunications company and a subsidiary of Singapore’s Singtel, disclosed a cyberattack that exposed personal information of millions of current and former customers. The information commissioner, Australia’s privacy regulator, later put the number of Australians affected at about 9.5 million. Early public estimates ran higher, close to 10 million, before the counts were refined. The data included names, dates of birth, phone numbers, email addresses and home addresses. For a large subset, it also included identity document numbers such as driver’s license, passport and Medicare numbers.

Optus put numbers on that subset in early October. About 2.1 million customers had at least one identity document number exposed. Roughly 1.2 million of them had a number from a current, valid document; for the rest, the documents had since expired. Everyone affected had lost some combination of contact details and date of birth. The intrusion, regulators later alleged, had run over several days before Optus noticed and disclosed it.

A phone company held those numbers for a reason. Australian rules require carriers to verify a customer’s identity before activating a mobile service, including prepaid services, and identity document numbers were a common way to do it. The result was a large store of government identifiers at a company whose main business had nothing to do with identity. Many of the records belonged to people who had not been customers for years.

That last category is what turned a serious breach into a problem for the whole economy. A name and phone number can be used to send scam messages. A name, date of birth, address and a valid license or passport number is close to the full set of details many organizations ask for when deciding whether someone is who they claim to be. Former customers were caught up as well, people who had left Optus but whose details had been kept.

The days after the disclosure added to the alarm. A person claiming to hold the data posted a sample on a criminal forum and demanded a ransom of about one million U.S. dollars. After publishing records for around 10,000 customers, the same account withdrew the demand and claimed to have deleted the data. Nobody could verify that claim, and banks had to assume the full set was in circulation. The Australian Federal Police opened an investigation, and Optus commissioned an external review of the incident.

Governments responded over the following weeks. Several states let affected people replace their licenses with new card numbers, so the stolen ones would stop being useful. The federal government pressed Optus to pay for replacement passports. Optus wrote to customers whose document numbers were exposed and told them what to do next.

On October 6, the Treasurer and the Communications Minister announced changes to telecommunications regulations so Optus could temporarily share affected customers’ government identifier information with banks, so they could watch for fraud. The amended regulations were registered on October 11. Banks receiving the data had to give assurances about secure storage and commit to destroying it once it was no longer needed. Ordinarily, privacy and telecommunications rules would have made that kind of sharing difficult. The government judged that, in this case, letting banks know which customers’ documents were exposed was the better protection.

Until those regulations took effect, banks were in an awkward position. They knew a large share of their customers were probably affected, but they had no list. Fraud teams could raise vigilance across the board or wait. Neither option was precise, and the gap lasted about three weeks.

The pressure did not let up. A breach at the health insurer Medibank followed weeks later, and parliament raised maximum privacy penalties before the year ended.

For banks in Australia and beyond, the week exposed an awkward fact. Much of their identity checking rested on the unstated assumption that these numbers were secret. For millions of people they no longer were. A breach at a phone company had, in effect, reset part of the security model of every bank whose customers used Optus.

Suppose the phone rings in a bank’s contact center. The caller gives a name, a date of birth, a home address and a driver’s license number. Every detail matches the file. The agent, following the script, confirms the caller’s identity and helps them update the mobile number on the account. Within the hour, a password reset code goes to that new number, and the account’s savings start moving.

Nothing in that call broke a rule. The agent did exactly what the process asked. The process simply rested on an assumption the Optus breach had just destroyed: that only the real customer would know those details.

This article follows that assumption through a bank. It starts with the distinction the breach exposed, between identifying a person and proving it is them. It then takes the three places the exposure showed up, each with its own owner: opening new accounts, servicing existing ones, and the bank’s own files. It follows one stolen identity through all three, sets out where the losses and blame land, and closes with what a bank that adjusted looks like and what to test.

Identifying someone versus proving it is them

There are two different jobs hiding in the word “identity,” and the difference is the heart of this story.

Identification answers the question “which person are we talking about?” A driver’s license number does this well. It points to one specific person, the way an address points to one house.

Authentication answers a different question: “is the person in front of us really that person?” That needs something only the genuine person has, knows or is: a phone they carry, a secret only they know, their face.

A driver’s license number identifies a person. For years, many organizations also used it to authenticate one: if a caller or applicant could supply a name, a date of birth and a license number, they were treated as the person named. That works only while the numbers are hard to obtain. Optus made millions of them easy to obtain in a single week.

A street address tells a delivery driver which house is yours, but nobody would accept “I know the address” as proof that you own the house. Asking for a license number and treating a correct answer as proof was, in effect, exactly that.

How identifiers turned into passwords

The habit grew for understandable reasons. Anti-money-laundering rules require banks to collect identifying details at account opening. In the United States, the customer identification program rule requires a bank to collect at least a name, date of birth, address and an identification number before opening an account. Australia’s anti-money-laundering law imposes comparable know-your-customer duties. Once a bank holds those details, they are the cheapest thing to ask about later. No extra system, no device, no enrollment step.

The rules required banks to collect the details. They never said that knowing them proved anything. That leap was made inside call scripts, password reset flows and onboarding designs, usually years earlier and often by people who have since moved on.

A shared secret that every company holds

A password has one useful property: only you and the service that issued it know it. A license number has the opposite property. It is printed on a card you show to bars, car rental desks, real estate agents and phone companies. Each of them may write it down. Each copy is a possible leak.

That creates an awkward externality. The security of a bank’s phone verification depends on how well every other company holding the same details protects them. The bank has no contract with those companies, no audit rights and no warning when they are breached. When Optus lost its files, banks that had never dealt with Optus found their controls weakened overnight.

Security people call details like these static knowledge factors: facts about a person that do not change and cannot be reissued after a leak. A password can be reset. A date of birth cannot. A license number can be replaced only by a government agency, slowly, and only for people who ask.

Three doors with three owners

Banks were the institutions most exposed to that shift, because they rely on identity documents more than almost anyone and because fraud converts stolen identity data into money. The exposure showed up in three distinct places, each with its own owner:

• Opening new accounts, where know-your-customer checks verify identity. Know-your-customer, or KYC, is the set of checks banks are legally required to perform to confirm who their customers are, largely to stop criminals using the financial system. The owner is usually a digital or onboarding team, with the financial crime function setting minimum standards.
• Servicing existing accounts, where the contact center and recovery flows decide who may change details or move money. The owner is operations, with fraud and security teams advising.
• The bank’s own files, where copies of customers’ documents accumulate. The owner, if there is one, is records management, with privacy and vendor management close behind.

The same three places exist at banks everywhere. A breach on the other side of the world is a useful prompt to look at all three at home. The split matters because each door is fixed by different people with different budgets, and a fix in one does nothing for the others.

Opening accounts: proving the holder, not the number

Electronic identity checks typically confirm that a document is genuine and current with its issuer. They ask the government agency that issued a license or passport whether the number exists, whether it matches this name and date of birth, and whether it is still valid. Australia had a national document verification service that did exactly that. Many banks also matched applicants’ details against credit bureau files and other independent databases.

A valid number is not the same as a present holder. After the breach, a fraudster with a real customer’s details could pass a check designed to confirm that the details matched official records. The check was answering its question correctly. It was just the wrong question.

What a data-matching check can and cannot see

Walk through what a typical online application does. The applicant types a name, date of birth, address and license number. The bank’s onboarding platform sends those details to a verification service. The service returns a match or a mismatch. If the details match, and a credit bureau file confirms the name and address, the application passes. Nothing in that sequence touches the physical card, the person’s face or any device the genuine person controls.

Data-matching checks were built to catch made-up identities and typing errors. They are good at that. They were never designed to detect a real identity used by the wrong person. Once accurate data is in criminal hands, the check confirms the criminal’s claim with full confidence.

Binding the document to the person

Stronger onboarding binds the document to the person in front of the bank. Options include:

• Comparing a live image of the applicant with the document photo. The applicant takes a photo or short video of their face, and software checks that it matches the picture on the license and that a real, present person is in front of the camera.
• Reading the document itself as well as its number. Modern passports carry a chip signed by the issuing country. A phone can read the chip and confirm the data and photo have not been altered. Image checks on a license can look for signs of a fake card.
• Checking the device and network the application comes from. An application from a phone that has recently opened many accounts, or from a network linked to past fraud, deserves a closer look.
• Confirming contact details through a channel the genuine person controls. Sending a code to a phone number or email address that can be independently linked to the real person, rather than one the applicant has just typed in.

Each adds friction and cost, and some applicants without smartphones or stable addresses will struggle. That is no minor point. Older customers, people in remote areas, and people in difficult circumstances are often the ones least able to complete a slick digital check, and they are also customers a bank has obligations to serve.

Where the stronger checks go

A risk-based design applies the stronger checks where the stakes are highest, such as accounts that can receive large payments or open credit quickly. It also keeps an assisted route for those who cannot use the digital one, such as verification in a branch or by a trusted third party.

The assisted route needs its own controls. Fraudsters learn quickly which path asks the fewest questions. If a failed selfie check simply moves the applicant to a phone call where an agent reads the license number back to a records database, the bank has built a bypass. A branch visit with the physical card, or a letter sent to an address the bank can independently confirm, is slower but harder to fake at scale.

Banks differ in how much they can do alone. A large bank can build or buy its own onboarding stack and tune it. A credit union or small mutual usually runs onboarding on a vendor platform shared with many other institutions. Its main lever is the contract: which checks the vendor offers, which are switched on, what the pass and fail thresholds are, and what reporting the institution receives. A digital-only bank has no branch fallback at all and must design its assisted route from scratch. A broker or wealth platform that opens investment accounts faces the same problem, with the added risk that a fraudulent account can be used to transfer securities out of a real customer’s account elsewhere.

Measuring whether onboarding works

Onboarding teams tend to measure completion rates and time to open. Those numbers reward removing checks. A balanced scorecard adds fraud outcomes. It counts the accounts opened in a quarter that were later confirmed as fraudulent or used as mule accounts. It records how many were caught within the first weeks, and which checks they had passed. It also tracks who fails the stronger checks and why, so that a bank can see whether a new control is excluding particular groups of genuine customers.

Without the fraud outcome numbers, the team that owns onboarding never sees the cost of a weak check. The loss shows up months later, in a different department’s budget.

The mule account problem

The harm from weak onboarding does not stop with the person impersonated. Accounts opened in stolen names are a common way for scam networks to receive and move victims’ money. These are called mule accounts: accounts that carry stolen funds from one place to another so the trail is harder to follow. An account that passes a knowledge-based check today may be a mule account next month.

Monitoring new accounts for early patterns, such as rapid inbound transfers from many unrelated senders followed by quick withdrawals, catches some of what onboarding misses. It also shortens the time a stolen identity stays useful. That matters twice over: once because the bank may bear losses, and again because a bank whose accounts are used to launder scam proceeds attracts regulatory and reputational damage of its own.

Mule detection works best when it is tuned to account age. A new account that receives many small transfers from strangers in its first fortnight is far more suspicious than the same pattern on a ten-year-old business account. Many banks apply the same rules to both, and miss the signal in the noise.

Knowing which documents are compromised

Banks also needed to know which documents were compromised. The temporary sharing arrangement with Optus showed both the need and the awkwardness of solving it after the fact. It took a regulatory change, made in a hurry, to let one company tell others which customers were affected.

A standing mechanism for issuers to mark compromised or replaced documents, and for verification services to reject them, is the durable fix. Once a license number is known to be in criminals’ hands, any check against it should say so. Inside the bank, the same information should feed both onboarding and servicing, so that a compromised document raises the bar at every door, including the ones the fraud team was not watching.

Servicing accounts: the contact center as the weak door

Account takeover rarely starts with the online banking password. It often starts with a phone call in which a fraudster answers knowledge questions, asks to change the mobile number or email on file, and then resets everything else. Account takeover means exactly what it sounds like: a criminal gaining control of a real customer’s existing account.

Date of birth, address and identity document numbers were common knowledge questions. After Optus, they were public for millions of customers. A bank can build excellent digital security and still be undone if the side door, the phone line, accepts answers anyone can buy.

Why the phone line is the weak point

Digital channels have improved because they can check devices, locations and behavior silently in the background. A phone call carries almost none of that. The agent hears a voice and sees a screen of account data. The caller controls the pace and the story: a lost phone, a trip abroad, an urgent bill. Agents are measured on call time and customer satisfaction, and a confident caller with the right answers is hard to refuse.

The most dangerous request is the one that looks routine. Changing a mobile number or email address does not move money. It does move control. Once the contact details belong to the fraudster, every later security code, alert and confirmation goes to them, and the genuine customer stops hearing from the bank at all.

There is an irony in the Optus case. The breached company was itself a mobile carrier, and banks used mobile numbers as a security channel. Telecommunications regulators had already pushed carriers to add identity checks before a number could be moved to a new provider, because one-time codes sent by text are only as safe as the number behind them. A bank that relied on text codes depended on carriers’ checks as well as its own.

Closing the side door

The servicing fix has several parts:

1. Remove leaked data types from the list of acceptable verification answers. If it was in the breach, it no longer proves anything.
2. Require a stronger factor before changing contact details. For example, an in-app confirmation on a registered device: the customer approves the change in the bank’s app on the phone the bank already knows is theirs.
3. Add a cooling-off period and an alert to the old contact details whenever they change. If a fraudster changes the mobile number, the genuine customer still gets a warning at the old one, and the delay gives them time to react.
4. Flag affected customers for extra scrutiny on high-risk requests.

Each step makes some genuine customers’ calls longer. A clear script that explains why helps agents absorb the complaints. Front-line staff are far more effective when they can say, “Because of the Optus breach, we are taking extra care with your account,” than when they simply have to refuse.

Verification for customers without the app

Not every customer has the app or a registered device. Some lost the phone, which is exactly why they are calling. The bank needs a fallback that does not collapse back into knowledge questions. Options include a one-time code sent by post to the address already on file, or an identity check in a branch with the physical card. Another is a short delay, with notice to every existing contact channel, before the change takes effect.

The postal route sounds old-fashioned, but it has a useful property. A fraudster can know the address without being able to collect mail from it. The trade-off is time: a genuine customer locked out of their account may wait days. Banks that offer it tend to pair it with a temporary arrangement, such as a hold on outbound payments, so the delay protects the customer instead of merely inconveniencing them.

Supporting the agent

Agents need information as well as rules. A screen that shows recent risk signals, such as a contact change in the past month, a new device, or membership of a breach-affected group, lets the agent apply judgment. A clear escalation path to a fraud specialist removes the pressure to decide alone while a caller insists. And the agent should never be penalized on call-time metrics for a call that ended in a correct refusal.

Agents also need protection from persuasion. Fraudsters rehearse. They know the script, sound distressed, and ask for supervisors. A rule that no agent, however senior, may override the device approval step for a contact change removes the weak point that social engineering targets.

Watching for organized use

Monitoring belongs here as well. A spike in contact detail changes, new payees or card replacement requests among a breached population is an early signal of organized use of the data. Fraud teams that can segment activity by exposure to a named breach can act on that signal quickly.

Suppose a regional bank marks every customer whose documents appeared in an external breach. Each morning, its fraud team compares that group with everyone else. If customers in the breached group suddenly request far more phone number changes than usual, the team knows the stolen data is being used against it. It can tighten controls for that group before losses mount, rather than discovering the pattern weeks later in the complaints.

The data to do this is usually already in the bank. What is often missing is the ability to tag customers by an outside event and to slice servicing activity by that tag. Building that capability once, before it is needed, turns the next external breach from a scramble into a routine.

The bank’s own files: copies as liabilities

Optus held identity data on former customers years after they had left. Banks are prone to the same pattern.

Anti-money-laundering rules require records of identity verification to be kept for set periods, and copies of passports and licenses pile up in onboarding systems, document stores, email and branch scanners. Many are kept long after any obligation ends because no one decides to delete them. Storage is cheap, deletion feels risky, and no single person owns the problem.

The result is a growing pile of the most sensitive documents a customer can hand over, spread across systems with very different levels of protection. Every copy is a liability: something that must be guarded, and something that must be disclosed if it is lost.

What the rules actually require

Retention rules are often longer than staff expect, and less specific than they assume. In Australia, AUSTRAC guidance says customer identification records must be kept for seven years after the bank stops providing services to the customer. In the United States, the customer identification program rule requires banks to keep the identifying information for five years after an account closes. It requires a description of the document relied on, including its number and dates, for five years after the record is made.

The U.S. rule asks for a description of the document, not an image of it. Many banks keep full scans anyway, because the onboarding vendor captures them by default or because a past examiner liked seeing them. Organizations should check with counsel whether a scan is needed for each product and jurisdiction. Where it is not, a record of what was checked and what the result was meets the obligation with far less exposure.

Australia’s privacy principles add a duty in the other direction: personal information that is no longer needed must be destroyed or de-identified, unless a law requires it to be kept. A bank can therefore breach a rule by keeping too much as easily as by keeping too little.

Where the copies hide

Most banks can name their main onboarding system. Fewer can list everywhere else document images live. Common places include:

• the onboarding vendor’s own storage, which may keep images on its side under its own retention settings;
• customer relationship systems where staff attach scans to a case;
• email inboxes and shared drives, where documents arrive from customers or brokers;
• loan origination files, especially mortgages, where brokers and introducers forward identity documents;
• branch scanners and multifunction printers that store recent scans on internal disks;
• legacy systems inherited through acquisitions and never decommissioned.

The acquisition case deserves its own mention. A bank that bought a smaller lender years ago may still run that lender’s archive on an old server, with nobody on staff who knows what it holds.

The retention fix

The retention fix is a records exercise:

• Identify every place document images and numbers are stored, including vendor systems.
• Keep what the law requires, in the form it requires, and no more: often a record that verification occurred and its result, rather than a full image.
• Delete the rest on a schedule.
• Restrict access to what remains.

Each copy removed is one fewer to notify customers about after a breach. Which record-keeping obligations apply in each jurisdiction is a question for the bank’s lawyers, because the rules differ and the penalties for getting them wrong in either direction are real.

The arguments for keeping everything

Fraud investigators often resist deletion. A scan of the document used to open an account can help prove a fraud claim, or support a police report. Some teams worry that deleting images will force expensive re-verification when customers update their details.

Both concerns have answers. Images tied to an open investigation or a legal hold can be kept under that hold, with a documented reason and an end date. Records of what was checked, when, and with what result usually serve investigators as well as the image does. And re-verification after several years is often wise anyway, since documents expire and circumstances change. The remaining cost of deletion is small next to the cost of notifying millions of people that their passport scans were stolen.

Vendors and evidence

Vendor contracts need the same discipline. They should state how long the vendor keeps images, require deletion when the bank deletes, and give the bank a way to confirm it happened, such as a deletion report or certificate. A bank that has cleaned its own systems but left years of images with an onboarding vendor has moved the risk, not reduced it.

An auditor or examiner reviewing the program will usually ask for three things: the inventory of storage locations, the retention schedule with its legal basis, and evidence that deletions actually ran. The third is the one most programs cannot produce.

Following one stolen identity through a bank

Follow a single stolen identity through all three places at once, because that is how criminals see a bank: as one set of doors to try rather than a set of separate departments.

Take a customer whose details were in the breached files: her name, date of birth, address, phone number and driver’s license number. A fraud group buys them along with thousands of others.

First door: a new account. The group applies online for an account in her name at a regional bank she has never used. The bank checks the license number with the issuer, and it is genuine and current. If that is the only check, the account opens. The group now has an account in a real person’s name, ready to receive money from scam victims. If the bank also asks for a live photo matched to the license, the attempt stalls, because the person holding the phone is not the customer.

If the bank fails the applicant on the photo check and offers a phone fallback that asks only for the license number again, the attempt resumes. The weak point has moved, not closed.

Second door: her existing account. She does bank somewhere, and the group calls that bank’s contact center. The agent asks for her date of birth, address and license number. All correct. The caller asks to change the mobile number. If the bank requires approval in its app on her registered phone, the request fails and she gets an alert. If it does not, the group now controls the channel the bank uses to send security codes.

From there the sequence is quick. A password reset code goes to the new number. The group logs in, adds a payee, and moves money in amounts chosen to stay under transaction alerts. The customer may not notice until a statement arrives or a payment bounces, because her phone has stopped receiving the bank’s messages.

Third door: the bank’s own files. Months later, a different attacker breaks into a vendor system that one of her banks uses to store scanned identity documents. Among them is a full image of her license, kept long after any rule required it. Her details are now exposed a second time, and the bank is the one notifying her.

The second exposure is worse than the first. A full image includes the photo and the card layout, which makes forged cards and fake selfie attempts easier. The bank’s retention habit has upgraded the criminal’s toolkit.

Each door had a different owner inside the bank: the onboarding team, the contact center, the records and vendor management functions. Each could close its own door without the others. But the criminal only needs one to be open, which is why leaders need to look at all three together.

The customer, meanwhile, experiences all of it as one bank failing her. She does not care which department owned which control. Complaint handling and remediation teams see the whole sequence long before the separate owners do, which makes complaint data a useful early indicator for all three doors.

Where the losses and the blame land

The Optus episode translates into familiar categories:

• Money. Fraud converts stolen identity data into losses, through accounts opened in stolen names and existing accounts taken over.
• Customers. Victims of account takeover rarely blame the company that was breached elsewhere. They blame the bank that let someone else in.
• Regulators. Banks are expected both to know their customers and to protect their data. Weak checks fail the first test; over-retained documents fail the second.
• Reputation. Being the bank whose accounts were used to move scam proceeds is a story no one wants told.

Who pays for an account takeover

Liability for unauthorized transactions usually lands on the bank. In the United States, Regulation E limits a consumer’s liability for unauthorized electronic transfers when they report them promptly, so most losses from a taken-over account fall on the institution. In Australia, the ePayments Code sets similar expectations for unauthorized transactions among the institutions that subscribe to it. The details differ by country and product, and counsel should confirm them, but the direction is consistent: when a bank lets an impostor in, the bank usually pays.

Scams in which the genuine customer is tricked into sending money are treated differently in many places, and that line has been contested. Account takeover through a weak phone check falls on the bank’s side of it. That makes contact center verification a direct financial control, not a customer service preference.

What supervisors expect

Prudential and conduct regulators had already set expectations that cover this ground. Australia’s prudential regulator requires banks to maintain information security proportionate to their threats, under its information security standard. In the United States, the FFIEC agencies issued authentication guidance in 2021 that warned about the limits of knowledge-based questions and expected institutions to assess the risk of every access path, including the contact center. A breach elsewhere that weakens those questions is the sort of change in the threat environment such guidance expects a bank to respond to.

Credit unions, community banks and large banks all fall under versions of these expectations through their respective supervisors. Broker-dealers face their own identity theft and customer protection rules. Which rules apply to which entity is something each institution should confirm, but none of these regimes treats a stolen-data account takeover as someone else’s problem.

The case against tightening

There is a serious counter-argument. Stronger checks cost money and lose customers. Every added step at onboarding reduces completion. Every device approval at the contact center frustrates the customer whose phone just broke. Some banks argue that fraud losses from data breaches are modest relative to those costs, and that blanket tightening punishes millions of genuine customers to stop a few thousand criminals.

The argument has force against blanket controls, which is why the fixes above are targeted. It fails against the specific change Optus forced. Continuing to accept known-leaked data as proof costs nothing to stop and protects every customer at once. Targeting stronger checks at high-risk requests and breach-affected customers keeps the friction where the risk is. And the costs of the alternative go beyond fraud losses: they include remediation, regulatory attention and the complaints of customers who learn their bank took the cheaper path.

Telling customers what is happening

Customer communication ties the three fixes together. Customers affected by a breach elsewhere want to know whether their bank account is at risk and what to do. A short, accurate message, with a way to add extra protection to the account, builds trust at low cost.

The message should say what the bank is doing, what the customer can do, and how the bank will contact them, so that fraudsters impersonating the bank are easier to spot. Scam messages exploiting a breach typically arrive within days, often claiming to come from the breached company or from banks. A bank that has told customers it will never ask for codes or passwords by text gives them a simple rule to apply.

Banks that absorbed the lesson

A bank that has absorbed the Optus lessons tends to look like this:

• Onboarding checks that confirm the person as well as the document, scaled to the risk of the account, with an assisted route for those who need it.
• A contact center that never accepts widely available personal details as proof, and requires a registered device before contact details change.
• Fraud monitoring that can group customers by exposure to a named breach.
• A known, short list of places where identity documents are stored, with deletion on a schedule.
• A ready-to-send customer message for the next external breach.

Banks that had not tended to slip in the same ways:

• Fixing the app and forgetting the phone line. Fraudsters go wherever the checks are weakest.
• Treating a verified document as a verified person.
• Adding friction everywhere. Applying the toughest checks to every customer drives away good customers and excludes vulnerable ones without targeting the risk that matters.
• Keeping everything “just in case.” Old copies feel harmless until they are stolen.
• Waiting for the breach to be your own. The data that undermines your checks is usually stolen from someone else.

Sequencing the work

The fixes do not cost the same or take the same time, so order matters. The cheapest and fastest is the contact center script: removing leaked data types from verification takes days and needs only a policy decision and agent briefing. Adding device approval for contact changes depends on the bank’s app and can take months. Onboarding changes depend on vendors and testing, and often land in the next budget cycle. The records cleanup is slowest, because finding every copy takes longer than deleting it.

A sensible sequence starts with the script and the breach-tagging capability, then the contact change controls, then onboarding, with the records inventory running alongside throughout. Each step should have a named owner and a date, reported to the same senior committee, so the doors are closed as one program rather than four unrelated projects.

Evidence a reviewer would ask for

An internal auditor or examiner testing the program would start with the current list of acceptable verification factors and the date it last changed. Next comes the policy for contact detail changes, with a sample of recent changes showing it was followed. Then onboarding fraud outcome reports by check type, the inventory of document storage locations, and deletion logs. A bank that can produce all five has turned a set of good intentions into something that can be checked.

Identity checks to test at the contact center, at opening and in the files

1. Which personal details do our contact center agents accept as proof of identity, and could a criminal buy any of them?
2. What does someone have to do to change the mobile number or email on an account, and does the old contact get an alert?
3. At account opening, how do we confirm that the person applying is the person on the document?
4. If a large breach happened at another company tomorrow, could we identify which of our customers were affected and watch them more closely?
5. How many places hold copies of customers’ passports and licenses, including vendors, and when were any last deleted?

With hindsight

Australia moved quickly on policy. By December 2022, sharply higher maximum penalties for serious or repeated privacy breaches were in force. The new ceiling for a company is the greatest of 50 million Australian dollars, three times the benefit obtained, or 30 percent of adjusted turnover in the relevant period. Further privacy reforms followed in 2024, as did a national digital ID law supporting reusable credentials that reduce the need to hand over document numbers. With a reusable credential, once your identity has been checked properly, you can prove who you are to others without reciting the underlying numbers each time.

The identity-document problem recurred almost at once. In March 2023, the consumer lender Latitude Financial disclosed a breach that it eventually said included about 7.9 million Australian and New Zealand driver’s license numbers, many supplied more than a decade earlier. That was the retention failure from the Optus files, repeated inside a financial services company.

The durable fix for compromised documents arrived as well. Since late 2022, the federal government has run a credential protection register. Issuing agencies can add documents known to be compromised in a breach, and the national document verification service then refuses to verify them. The document still works for its main purpose, such as travel, but it can no longer be used to pass an identity check. Ministers have since reported that the register has blocked hundreds of thousands of fraudulent verification attempts.

The banks moved too. In November 2023, the Australian Banking Association and the Customer Owned Banking Association announced a Scam-Safe Accord. Under it, the major banks committed to at least one biometric check for new individual customers opening accounts online by the end of 2024. The industry also committed to a confirmation of payee system that checks the account name a sender enters against the account details. In February 2025, parliament passed the Scams Prevention Framework Act, which places scam prevention obligations on banks, telecommunications companies and some digital platforms, with the competition regulator as general regulator.

Optus faced its regulators. In 2024 the communications regulator began Federal Court proceedings alleging that a coding error had left access controls ineffective on an internet-facing interface for years, and that Optus had failed to protect customers’ information. In August 2025, the Australian Information Commissioner filed separate civil penalty proceedings in the Federal Court, alleging serious interference with the privacy of about 9.5 million Australians. Because the conduct predated the December 2022 increase, the older and lower per-contravention maximum applies. The court’s decisions on penalty are for the court.

Elsewhere, mobile driver’s licenses, digital versions of the license held on a phone, spread across a growing number of U.S. states. In late 2023, the U.S. Federal Communications Commission adopted rules requiring carriers to authenticate customers before moving a number to a new SIM or provider, targeting the same weak link that undermined text-message codes. NIST’s updated digital identity guidelines, finalized in 2025, moved further from knowledge-based verification, the practice of proving identity by answering questions about personal details.

A new problem also arrived. Generative AI made convincing fake images, video and voices cheap. In November 2024, FinCEN issued an alert to financial institutions on fraud schemes using deepfake media, including to get past identity checks at account opening. Selfie checks and voice recognition, the replacements for knowledge questions, now need their own defenses against synthetic input.

By 2026 the principle is broadly accepted even where practice lags: identity numbers identify people but should not authenticate them, and organizations should not keep identity document data longer than they need it. Contact center verification remains the place where banks most often fall short of that principle.

That gap deserves a leader’s attention precisely because it is unglamorous. Digital channels attract investment and scrutiny; the phone script is often older than the people following it. Yet a single weak question in a call flow can undo controls that cost far more to build. Regulators have raised the price of losing data, so keeping less of it is now a financial decision as much as a privacy one. Until reusable credentials are universal, the practical test for any bank is simple: if a criminal knows everything that was in the Optus files, what can they still do with one of our accounts?