Got a question? Ask Lawmail

Send your questions to Lawmail

Can't find the info you are looking for?Got a problem you can’t solve?

If you're under 25, or an adult asking on behalf of a person under 18, you can send your questions to Lawmail and we will email an answer to you in under 10 days. Urgent matters are dealt with more quickly.

Go to Lawmail. It’s free and confidential.

All donations over $2 are tax deductible.

Identity Theft (Fake Profiles & Hacking)

What is identity theft?

Is identity theft illegal?

How does identity theft happen?

What can I do to stop it?

What if it happens to me?

What if I’ve done it?

What is identity theft?

Identity theft is when a person pretends to be someone else, without that person’s knowledge or permission, to get a benefit or to cause harm.  An identity thief takes on another person’s identity by using their personal information, which includes the person’s name, address, date of birth and email and social media log-in details.   

When most people think of identity theft they think of someone using another person’s bank or credit card details to steal money or trick the person into buying something.  But this is not the only way it can happen.  This factsheet looks at how identity theft can occur through social and online media.


Is identity theft illegal?

Identity theft is a crime.  It is illegal to have someone else’s personal information with the intention of committing a crime.   It is also illegal to make, use or give someone else another person’s personal information with the intention of committing a crime.  

If you steal a student’s or teacher’s identity while they are at school and use that information to stalk, harass or intimidate them, you can face extra charges under the law.  This is because there are special laws for offences involving students and teachers while they are at school.


How does identity theft happen?

Even if you think something is just a joke or a harmless prank it could still be a crime.  Below are some examples of identity theft which could lead to criminal charges and punishment:  

  • Creating a fake social media profile
Creating a fake social media profile about someone else might seem like a bit of fun, but it can be identity theft.  If you use someone’s personal information to create a fake online profile for the purpose of committing a crime, or to help to commit a crime, you could face criminal charges.  This would include creating a fake profile to harass or offend someone.

You could also be breaking the social media site’s rules of use.  For example, Facebook does not let you create an account for anyone else without their permission or create more than one account per person.  If you break these rules you are not committing a crime but Facebook can stop you from continuing to use its site.


Mark created a Facebook profile using the personal information of a classmate of his, Barry Schnelle.  Mark changed the name to Barry Smells and put in all of Barry’s personal information, including his date of birth, home address and a number of photos.  He posted status updates pretending to be Barry saying “I stink” and “I haven’t showered in months”.  Because Mark is using Barry’s personal information to harass and offend Barry, Mark may face criminal charges.   It does not matter if Mark thinks it is just a joke.

  • Hacking into a person’s email or social media profile

It is illegal to access someone’s emails, online instant messages or social media profiles using their password or login details without their permission.   If you access this information without a person’s permission and you plan to use it to commit a serious crime, like identity theft, you will face more serious charges.   It is also illegal to change someone’s password or login details for an online site without their permission.    

Sarah and Jessica go to school together.  One day in the school library, Sarah accessed Jessica’s password protected email account without her permission.  Sarah had seen Jessica’s email password written in her diary in class.  Sarah sent an email to everyone in their class pretending to be Jessica saying “I hate you all and I am so much better than everyone here”.  Jessica is now bullied by everyone in her class.

Sarah may face criminal charges as she has accessed Jessica’s secure email account without her permission.   She may also face charges for identity theft  as well as charges for harassing Jessica using the internet while at school.
What will happen to me if I do it?

If you know someone’s password or login details for online or social media sites and use them or give them to someone else with the intention of committing a crime, you could be charged with identity theft and face up to 10 years in jail.

Even if you have not actually used the other person’s password or login details, but you have them and intend to use them to commit a crime, you could face up to 7 years in jail.

Think about the types of things that are password protected on your computer.  This includes all of your work on your school computer, all of your emails, and all of the content on your Facebook page.  If you access someone else’s password protected material without their permission you could face up to 2 years in jail.   If you access this and are thinking about committing a serious crime with that information, you could go to jail for up to 3 years.   A serious crime is one that is punishable by a gaol term of 5 years or more.  It is a serious crime to use someone’s login details, or have them in your possession, for the purpose of committing a crime.  


What can I do to stop it?

There are a number of ways you can protect yourself against identity theft:

  • Always monitor your online profile:

If you think that someone may have hacked into your account, change your password immediately and consider removing your account. You should also contact the website administrator.  Their details are usually on the bottom of the website page.

  • Don’t post too much personal information on your online profile:  

If you wouldn’t want everyone in the world knowing it, don’t put it online.  Remember that any information you put online about yourself could be used by an identity thief to guess the answers to your security questions and then hack into your email, social media or online messenger accounts.

  • Be on the lookout for fake profiles:

If you find a fake profile that is pretending to be you and is harassing or threatening you, then you should report it straight away.  Tell a parent, older sibling or teacher or contact the website administrator.

  •  Keep your login information for social media and other secure sites in a safe place:

Use different passwords for different websites.  Don’t just use the same one each time or something simple like “P@ssw0rd” or “12345”.  Make the password difficult to crack.  The best passwords have 8 characters or more and should include a number, a capital letter and a symbol.  Also, try to avoid telling other people your password.

  •  Be cautious when using a public computer or letting others use your own:

Always sign out of your email and any social media websites.  If you are using a public computer and don’t sign out, other people may be able to access the websites that you had open.  Never allow your password details to be saved to the computer.  When other people use your personal computer, make sure that they don’t access your accounts without your permission.

  •  Be careful when banking or making online purchases:

Only transfer money or make online purchases from websites that are safe and secure.  If a website seems to be untrustworthy, don’t buy anything from it. It is possible that your information could be stored and passed on to other people without your permission.  

  •  Be careful when clicking links:

Only click on links to websites that you know are safe.  Never download files from websites that you can’t trust.

  •  Be careful with junk emails:

You may receive emails that say that you have won money or a holiday or an iPad.  Be very careful about giving away your personal information in response to these emails.  If it seems too good to be true, it probably is.

  •  Use antivirus software and keep it up-to-date:

Identity theft can also occur through viruses or trojans on your computer that monitor your keystrokes or record your website activity. Use up to date antivirus software and schedule regular virus scans of your computer.

What if it happens to me?

  •  Tell an adult that you trust. They will be able to give you advice on whether further action should be taken.
  •  Tell a teacher, school counsellor or principal if the identity theft has taken place on school grounds or you think a fellow student is involved.
  •  If you’re feeling upset and don’t know who to talk to you can call the Kids Helpline on 1800 55 1800 at any time of day or night to chat confidentially with a counsellor
  •  Record evidence. Take a screenshot or print off any fake profiles, pages or emails and store them in a safe place in case the police or another authority needs them.
  •  Report the identity theft to the website administrator.  They may do their own investigation and remove any offending content.


If someone created a Facebook profile pretending to be you or someone else, report it to the administrator by:

  • Going to the timeline of the fake profile
  • Click the    and then select Report/Block
  • Select Submit a Report
  • Choose This person is impersonating someone
  • Follow the on-screen directions to complete your report

In more serious cases contact the police, particularly if the identity theft is ongoing or you are being harassed.


What if I’ve done it?

  •  If you’ve impersonated someone else you should contact them immediately, apologise and remove any fake profiles or pages that you might have made.
  •  Talk with an adult that you trust about what you have done. They will be able to give you advice on whether further action should be taken.


The following websites are full of information about being safe online:


This page was last updated 17 July 2015.