Frequently asked questions

Learn more about Truyu and how it works.

About Truyu

What is Truyu?

Truyu is a digital identity protection tool that alerts you when your identity is being used or misused online. We are currently in pilot and we look forward to hearing your feedback as you use the service. Truyu is a mobile application that has been built by x15ventures which is built by CommBank.

When an identity check occurs in your name, Truyu can alert you for a majority** of ID checks that are conducted in Australia. We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours. In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional harm or loss.

Truyu will also alert you if your email address(es) have been exposed in a data breach and provides proactive guidance to enhance your online security.

Who can use Truyu?

Any Australian can install the Truyu app on their smartphone and receive data breach alerts.

You will need to be over the age of 18 and have either an Australian driver's licence or Australian Passport to receive ID usage alerts.

Why is Truyu in a pilot?

We are a trial initiative created by x15ventures, CommBank's corporate venture scaler. We have launched with/to a small group of customers to further test the proposition and collect feedback. About Us

What does Truyu cost?

Truyu is currently offering a 3-month free trial for our subscription service (to ID Usage Alerts) during the pilot, which will alert you when your identity information is used. After the free trial ends, you can continue to defend your identity for just $4.99 per month.

Additionally, you will be able to register up to 5 emails for data breach alerts, where Truyu will alert you if your information is detected in a data breach. The data breach service bears no cost.

Eligibility criteria:

All new subscribers are eligible for a free trial
You are not eligible if you’ve previously subscribed to any subscription in the Truyu app

If you wish to cancel your free trial or subscription, you can do so in the App Store or Play Store:

If you want to cancel a subscription from Apple – Apple Support (AU)

Cancel, pause, or change a subscription on Google Play - Android - Google Play Help

‍

Will creating a Truyu account impact my credit score?

No, creating a Truyu account has no impact on your credit score. Setting up ID usage alerts involves an identity verification process, but this also has no impact on your credit score.

What alerts will I receive?

The Truyu subscription sends ID usage alerts when your identity information (name and date of birth) is being used online at a majority** of Australian businesses that run identity checks, for example banks, telecommunications companies, gambling sites and other merchants.

Every Truyu user will receive their own notifications for data breaches when their registered email address(es) are detected in a breach. Upon registering your email address for monitoring, you will also receive alerts for historical data breaches.

Truyu will only send notifications if you give us permission. Without these notifications the service may not be as effective, however we will still alert you via email (as part of the both the data breach service and the ID usage alert service). You can manage your push notifications for Truyu through your phone settings.

Why should I care if my identity is being used online?

If it is not you who is using your identity online it could be a fraudster who has gained access to your personally identifiable information and is impersonating you online. 199,100 Australians were victims of identity theft in the 2022-23 financial year¹, with people spending up to $34,440 on recovery costs in 2023². In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional related harm or loss.

Why should I care if my email is part of a data breach?

A data breach can leave a trail of your personally identifiable information available to a fraudster who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you a historical record of data breaches that email has been involved in., as well as helpful proactive guidance to enhance your online security.

Your Personal Data

What data does Truyu collect and how is it protected?

Truyu account

When you sign up for a Truyu account, we collect and use:

Your email
Your phone number

These are encrypted and stored by Truyu. We keep these for 3 years after you delete your account for legal and compliance reasons.

Data breach alerts

If you set up data breach alerts, we collect and use:

Email(s) registered for monitoring

These are encrypted and stored by Truyu until you delete your account. Your emails are subject to an irreversible hash and de-identification treatment.

When you receive data breach alerts, we store:

Your data breach alert history

This is encrypted and stored by Truyu until you delete your account. Note: Deleting your account does not delete your exposed data from the original data breach.

ID usage alerts

If you set up ID usage alerts, we collect and use:

Legal first and last name
Date of birth

These are destroyed 7 days after you submit your ID check. After ID verification, your name and date of birth are subject to an irreversible hash and then stored with our service partners.

In addition to the above attributes, setting up ID usage alerts requires us to collect these fields to verify your identity:

Photo of your Australian licence or passport
Extracted details from the supplied document
Selfie that matches the photo in your document

These are destroyed 7 days after you submit your ID check.

When you receive ID usage alerts, we store:

Your ID usage alert history

This is encrypted and stored by Truyu until you delete your account.

For more information, view Truyu’s Privacy Policy.

How does Truyu use my data?

Email and phone number - Your email and phone number are used to reach you with messages relating to the services you have asked us to provide. With your permission, they can be used to share other communications also (you can choose to unsubscribe from these types of email or SMS by following the instructions within the email or SMS).
ID documents and selfies - Used for ID verification.
Emails for monitoring - We share the hashed and de-identified version of your email with our service partners who help us alert you if your email has appeared in a data breach until you delete your account.
Name and date of birth - We share the hashed and de-identified version of your name and date of birth with our service partners who help us detect any ID usage until you delete your account.

Can someone else monitor me if they have my data?

For ID usage alerts, monitoring an identity requires a successful identity verification check which requires validating an Australian Driver's License or Australian Passport, accompanied by a selfie.

For data breach alerts, any email added for monitoring will be sent a verification code. You will need this verification code to start monitoring.

ID Usage Alerts

How do ID usage alerts work?

An ID usage alert is an in-app notification and email whenever we detect that the details you have provided (for example your name and date of birth) have been presented to an ID verification service provider for an ID check.

An ID check can occur when you open an account or service at merchants like banks and telcos, and is completed by ID verification service providers. We have partnered with an ID verification service provider to bring you the ID usage alert service.

What businesses can you detect ID usage at?

Truyu is currently in its early stages and our merchant coverage for identity usage alerts covers a majority** of ID checks occurring at Australian businesses. Banks, telcos and gambling companies are common examples of businesses that run ID checks.

We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours.

We plan to continue to grow and expand our coverage, so your experience should keep getting better and better as we continue to improve and innovate within the space.

What do I do if I receive an ID usage alert, and it was me?

If you receive an ID usage alert and it was you, there is no need to take any action. Simply rest assured that Truyu is providing the service.

What do I do if I receive an ID usage alert, and it was not me?

If it was not you, it could be an instance of identity misuse. Follow the links and recommendations within the alert to help re-secure your information as efficiently as possible and avoid additional related harm or loss.

If you require extra support, please contact us at contact@truyu.com.au and we will ensure you are supported through the process.

I have multiple names. Can I use ID usage alerts?

Truyu currently only matches on the name and date of birth you’ve registered with us. At the moment, we are only able to support one name and date of birth combination per account and one account per device. Make sure you register to our ID usage alerts feature with your most commonly used legal name, so we can catch as many cases as we can.

What if someone else has the same name as me?

During the pilot we will only be matching on name and date of birth. While there is a risk of getting a match on someone else, as they would need to have the exact same first name, last name and date of birth.

If you have any concerns about this potentially being a risk for you, please contact us at contact@truyu.com.au

Can I use a digital driver's licence to set up ID usage alerts?

No. You can only use a physical driver’s licence to set up ID usage alerts.

I tried to set up ID usage alerts, but it says ‘One more step…’?

Sometimes your ID verification needs another pair of eyes for review. Sit tight and we’ll get back to you within 3 business days by email.

My ID was used. Why was I not notified?

During pilot this could be due to:

We may not have coverage of the merchant where your ID was used: Truyu is currently in its early stages and our merchant coverage for identity usage alerts and monitors a majority** of ID checks occurring at Australian businesses. Banks, telcos and gambling companies are common examples of businesses that run ID checks. We cannot alert you when your ID is used at merchants who use an ID verification service provider who is not partnered with us. Read more about it here.
- Let us know where your ID was used by emailing contact@truyu.com.au and we may be able to grow our network to partner with them.
You may have signed up with a different name: We cannot detect you if your registered name is different to the name presented to the merchant we have coverage of. Read more about it here.

If your ID was used, and it was not you, we recommend you contacting the merchant immediately. If you know what document was used, you should consider replacing it.

How do I unsubscribe from ID usage alerts?

You can manage your ID usage alert subscription in the Google Play Store or App Store:

Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help

IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)

Data Breach Alerts

How do data breach alerts work?

Every Truyu user will receive data breach alerts notifications when the emails you have registered for data breach alerts are detected in a data breach from public domain sources aggregated by one of our partners.

What happens if my data is exposed in a data breach?

What does dark web monitoring mean?

The dark web is a part of the internet known for being an anonymous hub for illegal activities. Such activities include the trading of personal information. Dark web monitoring is the process of searching these websites for this information (such as passwords and email addresses) and alerting you when your information is found, as part of our data breach alerts feature.

Why don’t I recognise a business that exposed my data in a data breach?

There are many possible reasons why you may not recognise the name of a business associated with a data breach:

The business may be a sub-contractor of another business that collected your data
A data breach may not be of a specific business, but a collection of stolen data added to the dark web
The business may have since closed, or be operating under a different name

I was in a data breach. Why don’t I see an alert for it?

A data breach is when data held about you by a third company is accessed by someone who is not authorised. If the unauthorised party makes this information accessible to other parties, or decides to sell it online, it is likely to reach our partner's database and become an alert in Truyu. If the unauthorised party does nothing with the information, it will not be accessible to our partner's database, and therefore not an alert, e.g the Optus or Medicare data breach. This does not mean that the unauthorised party will not do something in the future that would make it accessible to other parties and our partner's database. In this case, you would receive an alert from Truyu.

Another reason you may not have received an alert for a data breach is that the data breach did not contain your email. Truyu uses only your email to detect if you’ve been in a data breach.

Replacing Your ID Documents

How do I replace my driver’s licence?

All Australian driver’s licences have two numbers - licence number and card number. Both need to be valid to pass an ID verification check.

Replacing your driver’s licence changes your card number - which does stop fraudsters from passing ID checks. For a more thorough replacement, you can change your licence number as well. Changing your licence number usually requires evidence and a police report to support the request.

We recommend considering replacing your licence if it’s found in a data breach, and changing your licence number if your ID is detected to be used by someone who isn’t you.

Replacing your card number:

NSW - Replace a NSW driver licence online
QLD - Replacing your licence
ACT - Renew or replace your driver licence
WA - Replace your driver's licence
VIC - Replace License | VicRoads | offices Location & Hours
SA - Replace driver's licence after identity theft
NT - Replace your driver licence card if lost, stolen or damaged
TAS - Apply for, renew or replace a personal information card

Changing your licence number:

These typically require additional evidence of fraud or police reports. Check with your state or territory’s issuer for more information.

NSW - Changing your licence or customer number
QLD - https://www.publications.qld.gov.au/ckan-publications-attachments-prod/resources/803272fa-63c7-4f6a-bc23-6590db6b8812/request-new-customer-reference-number-kit-data-breach.pdf?ETag=24f740f9a90c2c4d521a69def0869e7c
WA - Identity security
VIC - https://www.vicroads.vic.gov.au/-/media/files/formsandpublications/licences/information-sheet-change-of-licence-number-due-to-identified-fraud.ashx
SA - Replace driver's licence after identity theft
TAS - Apply for a new driver licence number

How do I replace my other ID documents?

While some documents can be re-issued with a new number, some maintain the same number and allow for a block.

Australian Birth & Marriage Certificate - Request a block on the certificate
Australian Passport - Replacement passport
Citizenship Certificates - Can’t be blocked or replaced
ImmiCard - Can’t be blocked or replaced
Medicare card - Get a new Medicare card if it expires or is lost, stolen or damaged - Medicare card - Services Australia

Your Truyu Account

How do I close my Truyu account?

Truyu can alert you when your data is found on the dark web (through our data breach alerts service), or when your identity has been used (through our ID usage alerts service). Without a Truyu account you may miss the opportunity to proactively remediate the situation when your data or identity may have been used without your authority.

Rather than cancelling your account, we recommend you consider retaining the data breach alerts service, which bears no subscription cost, which still notifies you if your details are detected in a data breach.

To delete your Truyu account, go to “Settings” and tap “Delete account”

If you’ve lost access to your Truyu account or your device and want to delete your account, contact us at contact@truyu.com.au

How do I sign in to my account on another device?

Your Truyu account is linked to your mobile device. If you would like to sign into another device, email us at contact@truyu.com.au and we can support you.

Contact with Truyu

I have a complaint

Email us at complaints@truyu.com.au and we’ll get back to you within 1 business day.

If you want to provide feedback or have more general enquiries, email us at contact@truyu.com.au

How will I know if it’s really Truyu contacting me?

Here’s how you’ll know when we’re contacting you:

Any SMS will come from ‘Truyu’
Any email will come from contact@truyu.com.au, complaints@truyu.com.au or no-reply@truyu.com.au

If you receive an SMS or email from another address claiming to be us, please report it to us at contact@truyu.com.au

Why aren’t I receiving emails from Truyu?

Be sure to check your spam or junk email folders for messages from Truyu. If you find one there, move it to your inbox or mark it as ‘not spam’. Emails from us should appear in your main inbox from then on.