identity.org.au

identity.org.au is not an Australian Government service. It is an open-source community service stewarded by the not-for-profit DETIO Foundation, currently in the process of applying for accreditation under the Digital ID Act 2024. How this service is different

Get started

Lost or new device

Your verified identity lives on the network, encrypted — not just inside one phone. Losing your phone does not mean losing your identity.

What a lost phone does — and does not — expose

  • Behind your screen lock: wallet data is encrypted. A thief with a locked phone has ciphertext.
  • Hardware biometrics never leave your phone's secure hardware unencrypted, and cannot be extracted by another person's fingerprint or face.
  • Your verified claims exist on the network in encrypted form — they are not destroyed with the device.
  • What is at risk is an unlocked phone in the wrong hands — which is why the wallet requires a screen lock and re-authenticates for sensitive actions.

Recovering on a new device

  1. Secure the old device (if lost or stolen)

    Use your platform's find-my-device feature to lock or remotely wipe the phone. The wallet's contents are encrypted behind your screen lock, so a locked phone exposes encrypted data only.

  2. Install the wallet on the new device

    From the official open-source repository — remember there are no app-store listings, so treat store results as suspect.

  3. Re-establish control of your wallet

    Restore access using your recovery material (the keys or phrase you saved at setup). This proves the new device is controlled by the wallet's owner.

  4. Complete a fresh biometric check

    A new selfie and liveness check confirms to the network that the person on the new device is still you — not someone who found your recovery phrase.

  5. Review your consents

    Your consent history carries over. Take a minute to review active grants and revoke anything you no longer need.

Keep your recovery material offline

Whoever holds your recovery keys can begin wallet recovery — the fresh biometric check is the backstop, but do not rely on it alone. Store recovery material offline (written down, in a safe place), never in email, notes apps or screenshots.

If you believe someone is using your identity

  1. Revoke consents from any device where you still have wallet access.
  2. Email [email protected] to flag the identity for review — verification can be suspended while it is investigated.
  3. Report identity theft to IDCARE (Australia's identity support service) and to police.