Emailing ID Documents? Why it’s Time to Rethink Your Approach to Cyber Security

New research from the Customer Owned Banking Association (COBA) shows 40% of Australians are making an email mistake scammers are ready to exploit — and the financial consequences can be devastating.

This Privacy Awareness Week, COBA has sounded the alarm: emailing sensitive personal information like passports, driver’s licences, or tax file numbers puts Australians at heightened risk of identity theft, fraud, and financial scams.

COBA’s survey of over 1,000 Australians reveals:

• 40% have emailed photos of identity documents via personal email.
• 56% of those senders did not delete the email afterward.
• Only 25% of those who did, “double-deleted” it from their trash folder.
  

According to COBA’s Head of Financial Crimes and Cyber Resilience, Martin Latimer, scammers commonly gain access to this kind of information by breaching personal email accounts through phishing or malware. From there, they can impersonate victims, apply for credit, or create “synthetic identities” — combining real and fake data to open new accounts, take out loans, or apply for government benefits.

“Unless you’re using secure, end-to-end encrypted email and attachments, regular email is not a safe way to share sensitive documents,” Mr Latimer said.

“If you wouldn’t put it on a postcard, don’t put it in an email.”

Lextech Top Tips: How to Stay Safe When Sharing Sensitive Information

During the mortgage process brokers, lenders, and borrowers are required to reference and send personal data during loan processing and for verification of identity.

To help brokers, lenders and borrowers minimise scam risk, Lextech recommends the following smart lending cyber hygiene practices:

1. Avoid Email for ID Documents

Never send passports, driver’s licences, or TFNs via standard email. Use secure platforms with built-in encryption and identity protection.

2. Delete Sent Files (Twice)

If you must email sensitive information, delete the sent message and empty your trash folder (“double delete”) immediately afterward.

3. Enable Two-Factor Authentication (2FA)

Make sure your email and document storage systems are protected with 2FA to prevent unauthorised access.

4. Use Tech Solutions

Brokers and Lenders should use secure client portals for document collection, electronic signing, verification of identity (VOI) and communication — solutions that are compliant with the Privacy Act and industry best practices.

5. Have a Public Privacy Policy

Ensure your brokerage or lending operation maintains an up-to-date, publicly available privacy policy and obtains explicit client consent when handling personal information.

Cyber Security Is Smart Lending

At Lextech, we’re proud to support Australia’s lenders and brokers with solutions that don’t just streamline lending — they also protect customers from scams and fraud. Our ISO27001 compliant technology is designed with compliance and security in mind, offering smarter ways to request, store, and manage sensitive borrower data.

Privacy Awareness Week and COBA’s Scam-Safe Accord

Customer-owned banks are committed to working with the government and other industries to combat scams and protect Australians from financial harm. To find out more about the banking industry’s Scam-Safe Accord, head here.

Privacy Awareness Week (PAW) is an annual event to raise awareness of privacy issues and the importance of protecting personal information. For PAW 2025 (16 to 22 June) we are asking people, organisations and government agencies to get serious about privacy by shouting from the rooftops about our campaign theme ‘Privacy – it’s everyone’s business’. For more information about PAW, head here.

Privacy is everyone’s business. This week, and every week, let’s stay alert and stay secure.

Article Posted 17 June 2025 5:06 am