What a stolen license number proves, and what banks treated it as proving
The Optus breach put millions of identity document numbers in criminals’ hands. Banks had used those numbers as proof of identity at account opening, in the contact center and in their own files. Each use needed a different fix.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On September 22, 2022, Optus, Australia’s second-largest telecommunications company, disclosed a cyberattack that exposed personal information of current and former customers, up to about 9.8 million people by the company’s count. The data included names, dates of birth, phone numbers and addresses and, for a large subset, identity document numbers such as driver’s license and passport numbers. Governments responded over the following weeks. Several states let affected people replace licenses with new card numbers, and the federal government pressed Optus to pay for replacement passports. In early October, a temporary regulation allowed Optus to share affected customers’ government identifier information with banks so they could watch for fraud. A breach at the health insurer Medibank followed weeks later, and parliament raised maximum privacy penalties before the year ended.
A driver’s license number identifies a person. For years, many organizations also used it to authenticate one: if a caller or applicant could supply a name, a date of birth and a license number, they were treated as the person named. That works only while the numbers are hard to obtain. Optus made millions of them easy to obtain in a single week.
Banks were the institutions most exposed to that shift, because they rely on identity documents more than almost anyone and because fraud converts stolen identity data into money. The exposure sat in three distinct places, each with its own owner. The first is opening new accounts, where know-your-customer checks verify identity. The second is servicing existing accounts, where the contact center and recovery flows decide who may change details or move money. The third is the bank’s own files, where copies of customers’ documents accumulate. The same three places exist at banks everywhere.
Opening accounts: proving the holder, not the number
Electronic identity checks typically confirm that a document is genuine and current with its issuer. Australia had a national document verification service that did exactly that. A valid number is not the same as a present holder. After the breach, a fraudster with a real customer’s details could pass a check designed to confirm that the details matched official records.
Stronger onboarding binds the document to the person in front of the bank. Options include comparing a live image of the applicant with the document photo, checking the device and network the application comes from, and confirming contact details through a channel the genuine person controls. Each adds friction and cost, and some applicants without smartphones or stable addresses will struggle. A risk-based design applies the stronger checks where the stakes are highest, such as accounts that can receive large payments or open credit quickly. It also keeps an assisted route for those who cannot use the digital one.
The harm from weak onboarding does not stop with the person impersonated. Accounts opened in stolen names are a common way for scam networks to receive and move victims’ money, so an account that passes a knowledge-based check today may be a mule account next month. Monitoring new accounts for early patterns, such as rapid inbound transfers from many unrelated senders followed by quick withdrawals, catches some of what onboarding misses. It also shortens the time a stolen identity stays useful.
Banks also needed to know which documents were compromised. The temporary sharing arrangement with Optus showed both the need and the awkwardness of solving it after the fact. A standing mechanism for issuers to mark compromised or replaced documents, and for verification services to reject them, is the durable fix.
Servicing accounts: the contact center as the weak door
Account takeover rarely starts with the online banking password. It often starts with a phone call in which a fraudster answers knowledge questions, asks to change the mobile number or email on file, and then resets everything else. Date of birth, address and identity document numbers were common knowledge questions. After Optus, they were public for millions of customers.
The servicing fix has several parts. Remove leaked data types from the list of acceptable verification answers. Require a stronger factor, such as an in-app confirmation on a registered device, before changing contact details. Add a cooling-off period and an alert to the old contact details whenever they change. Flag affected customers for extra scrutiny on high-risk requests. Each step makes some genuine customers’ calls longer. A clear script that explains why helps agents absorb the complaints.
Monitoring belongs here as well. A spike in contact detail changes, new payees or card replacement requests among a breached population is an early signal of organized use of the data. Fraud teams that can segment activity by exposure to a named breach can act on that signal quickly.
The bank’s own files: copies as liabilities
Optus held identity data on former customers years after they had left. Banks are prone to the same pattern. Anti-money-laundering rules require records of identity verification to be kept for set periods, and copies of passports and licenses pile up in onboarding systems, document stores, email and branch scanners. Many are kept long after any obligation ends because no one decides to delete them.
The retention fix is a records exercise. Identify every place document images and numbers are stored, including vendor systems. Keep what the law requires, in the form it requires, and no more: often a record that verification occurred and its result, rather than a full image. Delete the rest on a schedule. Restrict access to what remains. Each copy removed is one fewer to notify customers about after a breach. Organizations should check with counsel on record-keeping obligations in each jurisdiction where they operate.
Customer communication ties the three together. Customers affected by a breach elsewhere want to know whether their bank account is at risk and what to do. A short, accurate message, with a way to add extra protection to the account, builds trust at low cost.
With hindsight
Australia moved quickly on policy. In late November 2022, parliament sharply raised maximum penalties for serious or repeated privacy breaches. Further privacy reforms followed in 2024, as did a national digital ID law supporting reusable credentials that reduce the need to hand over document numbers. In August 2025, the Australian Information Commissioner filed civil penalty proceedings against Optus in the Federal Court. Elsewhere, mobile driver’s licenses spread across a growing number of U.S. states, and NIST’s updated digital identity guidelines, finalized in 2025, moved further from knowledge-based verification. By 2026 the principle is broadly accepted even where practice lags: identity numbers identify people but should not authenticate them, and organizations should not keep identity document data longer than they need it. Contact center verification remains the place where banks most often fall short of that principle.