Truyu warns of telco checks in identity fraud test

Truyu has identified a fraud pattern in which criminals use telco identity checks to verify stolen personal information. The finding is based on analysis of nearly 25,000 identity checks flagged through the app across Australia.

Analysis by the CommBank-built identity protection app found that nearly a third of unauthorised identity checks were preceded by an earlier, unrelated check at a telecommunications provider. Truyu has labelled the tactic "Stolen Identity Validation", describing it as a way for fraudsters to test whether compromised personal details will pass routine verification processes before attempting broader misuse.

According to the analysis, 32% of unauthorised identity checks followed an earlier telco check. In 47% of those cases, another unauthorised identity check took place within a week, suggesting that once personal information is confirmed as valid, it is reused quickly.

The pattern sheds light on an early stage of identity fraud that can be difficult for consumers to detect. Criminals often need enough accurate personal information to satisfy checks used to open bank accounts, apply for credit cards or seek personal loans, leaving victims to deal with financial and administrative fallout.

The app alerts users when their identity details are checked by merchants responsible for 63% of identity checks in Australia. Users are then asked to confirm whether they recognise the activity, and those responses formed the basis of the analysis.

James Roberts, Spam Prevention Officer at CommBank, said the data pointed to a deliberate method of testing stolen information.

"Criminals are constantly looking for ways to test and exploit stolen identity information before using it for wider fraud. Activating prepaid SIM cards is one method we're seeing used," said James Roberts, Spam Prevention Officer at CommBank.

Telecommunications services can provide a relatively low-friction way for criminals to check whether a stolen identity will withstand scrutiny. A successful check can signal that the same details may work elsewhere, including in banking and credit applications.

Roberts said the concern was not only the initial verification attempt, but what can follow once an identity has effectively been confirmed.

"This 'Stolen Identity Validation' technique is about what comes next. Once criminals confirm your details are accurate, they can reuse them across services to open accounts, apply for credit, or impersonate you," he said.

Consumer warnings

Melanie Hayden, Managing Director at Truyu, said unexpected signs of account or credit activity should not be dismissed simply because no funds have yet been taken. She pointed to identity verification notices, unexplained account openings and credit enquiries as possible indicators that personal details are being tested.

"Unexplained account openings, credit enquiries, or identity verification notifications can be early signs your details are being tested, even if no money has been stolen at that point. Don't ignore the warning signs. If you notice unexpected activity involving your personal information, take it seriously. Act quickly to secure your accounts and report it to your bank, telco or relevant provider," said Melanie Hayden, Managing Director at Truyu.

The warning comes as identity theft remains a persistent issue for Australian consumers and businesses, particularly after data breaches expose names, dates of birth, email addresses and other personal details that can be combined to pass verification checks. While a single leaked data point may appear minor, several pieces together can be enough to support fraudulent applications.

App activity

Launched through x15ventures, CommBank's venture scaling arm, Truyu says it has helped prevent an estimated AUD $51 million in potential fraud losses since it began operating. The estimate is tied to alerts and monitoring tools that notify users about suspicious activity linked to their identity and accounts.

It has issued more than 105,000 email leak alerts, identified more than 10,000 leaked passwords and sent alerts linked to nearly 25,000 identity checks. In addition to identity check notifications, the app monitors credit file access and updates, checks whether card details have been exposed, and scans for passwords linked to known breaches.

Truyu is also offered to organisations as a breach response and cyber remediation service for customers affected by data breaches. Its identity check alerting system currently covers 63% of identity checks in Australia.