Silvana's identity theft nightmare started in such a simple way — juggling shopping and two young children at a department store, she left her mobile phone behind in a case containing her credit card and driver's licence.

Key points: Identity theft is a growing problem in Australia, costing $2.2 billion per year

Identity theft is a growing problem in Australia, costing $2.2 billion per year Some jurisdictions don't let victims change driver's licence details if they are stolen

Some jurisdictions don't let victims change driver's licence details if they are stolen Driver's licences are one of the main forms of ID used when applying for finance

As soon as she realised her mistake she cancelled her phone contract and credit card, and deleted her phone data remotely.

But she was too late. Scammers had already managed to secure what is known in the security industry as the "golden ticket" to her identity — the driver's licence — and quickly moved to exploit it.

For Silvana, whose surname the ABC has chosen not to publish, the gravity of the situation was revealed when she discovered her bank was poised to give a $100,000 loan to a criminal in her name.

But then an even worse realisation dawned on her — for the rest of her life she would remain exposed to this type of attack.

She lives in a state, Western Australia, where it is impossible to change her driver's licence number, and that number has now been permanently compromised.

Her case has called into question how ready Australia's authorities are to deal with the rising threat of identity theft, with experts saying the system is failing victims and leaving people vulnerable to further abuse.

Do you know more about this story? Contact Rebecca Trigger

A black book of victim's details

A cautious person by nature, Silvana thought it was a hoax when months after she lost her cards she received an email from the WA Police.

Her brother, a cyber-security expert, looked over the email and told her she should call police.

A detective told her that her driver's licence number and an unknown debit card had been found by police in a notebook in a Perth house, along with the details of other victims of suspected fraud.

Pulling her credit history from credit reporting agency Equifax, she learned someone had tried to take out a $100,000 credit card in her name.

When she contacted her bank she learned an entire profile had been created in her name, along with the $100,000 credit application.

"That was a shock to my system, I was really really distressed," she said.

"You just go to your local store, you lose … your wallet or your phone, and you're suddenly exposed to this kind of fraud happening right here in WA.

"You think of overseas hackers and people working overseas in other countries, but it's happening right here on our doorsteps. It's quite scary."

Silvana, who works in contract management, is diligent with her data.

She has two-factor authentication set up on her accounts and takes care to not hand out her personal details, even to government departments, without the appropriate authority.

Silvana initially thought an email from WA Police was another scam. ( ABC News: Rebecca Trigger )

It has taken many hours of her life to try to rectify the damage, including meetings at her bank and working with the WA Police, to help her remove the fraudulent loan application from her credit history.

But her driver's licence number, which was used to apply for the loan in the first place, could not be changed because she lives in WA, which issues one licence number per person for life.

All other jurisdictions, aside from the Northern Territory, allow victims of identity crime to change their driver's licence number to protect themselves once their identity is compromised.

But experts say the process is convoluted and more challenging in some states than others, with the onus placed on the victim to repair their credit history and protect themselves after the crime.

Driver's licence the 'golden ticket' for criminals

Christine Jackson, security counsellor and centre manager for IDcare, a national support service for victims of identity crime, said when a driver's licence became compromised, criminals could open up lines of credit in the victim's name.

"So often that will be telephone accounts, mobile phones are purchased, they might purchase iPads, tablets and things like that as well — so it can rack up to a lot of money," she said.

"They'll also apply for credit cards, personal loans and they'll just keep going until your credit history is in a mess and they can't go any further.

"And then they'll lay low for a while, wait for you to clean it up when you find out what's gone on, and then they'll reinvest in that compromised document."

Ms Jackson said driver's licences were sought after by criminals because they were regularly used to verify identities by government departments, phone companies and banks.

"They love it when they grab a driver's licence because that's the golden ticket for them," she said.

The "golden ticket": A driver's licence can unlock a world of ID theft possibilities for a criminal. ( ABC News: James Carmody )

She said transport departments left people exposed by delivering driver's licences through the mail, despite them being the most common identity documents used to commit fraud.

"Letterboxes are targeted by criminals, they know important stuff gets sent to our letterboxes and they'll go for it," she said.

It was difficult to protect someone's identity when their licence was stolen because of different rules across the country.

"It's a big problem. What we're actually talking about is you can replace your driver's licence, but when you do, it doesn't [necessarily] change the driver's licence number," she said.

"The number is what's used when organisations are approving credit applications and so if you get a replacement driver's licence and it has the same number, it doesn't do anything [to protect you]."

Christine Jackson says driver's licences are the most common identity documents used to commit fraud. ( ABC News: Jacqueline Street )

But she said even if the licence number could be changed, as was the case in many states, it only offered partial protection.

"Not every organisation checks the validity of the document and this is the big problem," she said.

Driver's licences just one piece of the puzzle

Queensland University of Technology senior lecturer Cassandra Cross, who has researched victim impacts of online fraud, said driver's licences were part of a greater challenge around identity theft and technology in Australia.

"Whilst we can go to the bank and change our credit card details fairly easily, if we think about other identity credentials such as driver's licences in some cases, but also date of birth, social security numbers … biometric details that are out there about individuals, they pose significant challenges because they are fixed," she said.

She said victims experienced significant trauma after the fraud took place, having to tell their story over and over again to banks, telcos and government.

The ID theft experience could be traumatic to the victim, who is forced to explain it multiple times. ( ABC: 7.30 )

"It can be a very frustrating process for an individual to have to contact various agencies to try to establish how their identity has been used by another person, and then the process of having to prove to that agency they are who they are," she said.

She said a national coordinated approach could streamline the system for victims.

A spokeswoman for the WA Department of Transport (DoT) said it was aware of an increasing number of identity fraud cases nationally.

She said the department was is in the process of implementing a national agreement between states that would help protect people from identity fraud.

This would include sharing citizen's biometric driver's licence data with national agencies, a move heavily criticised by privacy experts.



The spokeswoman said a decision on implementing changeable driver's licence numbers would not be made until a policy and systems review for that agreement had been completed. No timeframe was provided.

"It should be noted that while a driver's licence is often used as a de facto identity document, its original purpose was proof of a person's authority to drive," the spokeswoman said.

"Currently, due to integration with other state government record systems, DoT is unable to change the number of a person's driver's licence on the driver's licence register."

ID theft a $2-billion-a-year business

According to the Australian Bureau of Statistics, 126,300 people were victims of identity theft in the 2014–15 financial year, the latest statistics available.

Despite older people often being targeted by scammers, it was in fact people aged 25–34 who were most likely to fall victim to identity theft, followed by those aged 35–44 and those aged 15–24.

A 2016 report from the Attorney-General's department estimated identity crime cost Australians $2.2 billion per year.

ID theft affects one in four Australians, and the number of victims is rising. ( Supplied: Accenture )

It cost another $390 million per year for prevention and response activities by authorities.

An Australian Institute of Criminology (AIC) 2017 report found one in four Australians reported being a victim of identity crime at some point in their lifetimes, while 13 per cent had been victims in the past 12 months.

The report found those numbers had both risen from 2016 levels and victims spent an average of 23 hours repairing the damage caused.

Last year the Department of Home Affairs launched a review on the national arrangements for the protection and management of identity information which was due to be completed in November last year.

This and the submissions made to the review are yet to be made public.