Get the app
Truyu is a digital identity protection tool that alerts you when your identity may be being used or misused. We are currently in pilot and we look forward to hearing your feedback as you use the service. Truyu is a mobile application from x15ventures which is built by CommBank.
"ID usage alerts" and "credit file alerts" are features of our paid service.
When referring to both, we use the term "ID alerts."
ID usage alerts
When an online identity check occurs in your name, Truyu can alert you for a majority* of ID checks conducted by Australian businesses that run identity checks using systems which match your identity information against information held by the document issuer or official record holder using third party systems. We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours. In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional harm or loss.
Credit file alerts
When your credit file has been viewed, or modified to reflect the opening of a new account, our credit reporting agency, Experian, reports this to us and Truyu sends you an in-app notification. Typically, your credit file is viewed or modified when you have applied for, or successfully opened, an account, service or financial product.
Data breach alerts
Truyu will also alert you if we detect your email address(es) have been exposed in a data breach and provides proactive guidance to enhance your online security.
Any Australian can install the Truyu app on their smartphone and receive data breach alerts.
You will need to be over the age of 18 and have either an Australian driver's licence or Australian Passport to receive ID alerts.
We are a trial initiative created by x15ventures, CommBank's corporate venture scaler. We have launched with a small group of customers to further test the proposition and collect feedback. About Us
Truyu is currently offering a 3-month free trial for our subscription service (to ID Alerts) during the pilot, which will alert you when your identity information is used. After the free trial ends, you can continue to defend your identity for just $4.99 per month.**
Additionally, you will be able to register up to 5 emails for data breach alerts, where Truyu will alert you if your information is detected in a data breach. The data breach service bears no cost.
Eligibility criteria:
If you wish to cancel your free trial or subscription, you can do so in the App Store or Play Store:
No, creating a Truyu account has no impact on your credit score. Setting up ID alerts involves an identity verification process, but this also has no impact on your credit score.
The Truyu subscription
Every Truyu user will receive their own notifications for data breaches when their registered email address(es) are detected in a breach. Upon registering your email address for monitoring, you will also receive alerts for historical data breaches.
Truyu will only send notifications if you give us permission. Without these notifications the service may not be as effective, however we will still alert you via email (as part of the both the data breach service and the ID alert service). You can manage your push notifications for Truyu through your phone settings.
If it is not you who is using your identity online, it could be a fraudster who has gained access to your personal information and is impersonating you online. 255,100 Australians were victims of identity theft in the 2023-24 financial year¹, with people spending up to $34,440 on recovery costs in 2023². In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and help avoid additional related harm or loss.
A data breach can leave a trail of your personal information available to a fraudster, who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you with a historical record of some data breaches that email has been involved in (if at all), as well as helpful proactive guidance to enhance your online security.
Truyu account
When you sign up for a Truyu account, we collect and use:
These are stored securely by Truyu. We retain these for 3 years after you delete your account for legal and compliance reasons.
Data breach alerts
If you set up data breach alerts, we collect and use:
These are hashed and stored until you delete your account.
When you receive data breach alerts, we store:
This is encrypted and stored by Truyu until you delete your account. Note: Deleting your account does not delete your exposed data from the original data breach.
ID alerts
If you set up ID alerts, we collect and use:
These are stored until you ask us to delete your details, 12 months after your subscription ends, or as required by law, whichever is earlier.
In addition to the above attributes, setting up ID alerts requires us to collect these fields to verify your identity:
These are destroyed 7 days after you submit your ID check.
When you receive ID usage alerts, we store:
This is stored securely until you delete your account.
For more information, view Truyu’s Privacy Policy.
For ID alerts, monitoring an identity requires a successful identity verification check which requires validating an Australian Driver's License or Australian Passport, accompanied by a selfie.
For data breach alerts, any email added for monitoring will be sent a verification code. You will need this verification code to start monitoring.
When you subscribe to Truyu’s ID Usage Alerts Service, we provide you with a history of ID usage alerts up to 180 days prior to your registration.
If you find your ID details have been misused in an ID usage alert, this means your information is out there and your details were used by someone else. Our alerts will tell you which documents or identity details were compromised. Follow the links and recommendations within the alert to help re-secure your information as efficiently as possible. Keep your Truyu subscription active so that you receive notifications of any further instances of misuse.
Truyu sends you an in-app notification when a credit file event is detected on your Experian credit file. There are two types of Credit File Alerts that Truyu provides you:
1. Your credit file was accessed – when a business views your credit file, usually indicating that you have applied for an account, service, or financial product.
2. An account was opened in your name – when a business modifies your credit file to indicate that an account has been successfully opened in your name for a particular service or financial product.
Truyu exclusively uses Experian as our credit reporting agency partner, meaning we cannot detect credit file activity with other agencies like Equifax or Illion.
Yes, you can still use ID alerts. partners with different organisations to provide ID alerts, including Experian, a credit reporting agency. If you’ve recently updated your personal details, ensure your creditors have the latest details, who will notify Experian to update the details on record.
If you have a ban on your credit file, Truyu won’t be able to access your credit file to set up Credit File Alerts and your ID alerts may appear as ‘Monitoring incomplete’. A credit file ban will not impact your ID usage monitoring, and you will continue to receive ID usage alerts.
To set up Credit File Alerts, you will need to contact your credit ban provider to lift your ban. Once this ban is lifted, you should be able to consent to Truyu as your access seeker and set up Credit File Alerts. If you wish to continue with your ban after you've set up Credit File Alerts, you can contact your credit ban provider to reinstate your ban.
Credit file bans will prevent credit providers from accessing your credit report. With Truyu’s Credit File Alerts, you can continue applying for credit while also being alerted if anyone else is accessing your credit file.
An ID usage alert is an in-app notification, sent to you when your details (such as your name and date of birth that you have provided us) have been presented to a participating ID verification service for an ID check.
An ID check can occur when you open an account or service at merchants like banks and telcos, and is completed by participating ID verification gateway service providers at the time you provide consent. Truyu has partnered with an ID verification gateway service provider to provide the ID Usage Alert Service.
When you subscribe to Truyu’s ID usage alerts Service, we provide you with a history of ID usage alerts up to 180 days prior to your registration.
We will also notify you near real-time when an ID verification attempt is detected with a participating ID verification service using your identity while you have a Truyu ID Usage Alert Service subscription.
Truyu is currently in its early stages and our merchant coverage for identity usage alerts covers a majority* of ID checks occurring at Australian businesses. Banks, telcos and gambling companies are common examples of businesses that run ID checks.
We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours.
We plan to continue to grow and expand our coverage, so your experience should keep getting better and better as we continue to improve and innovate within the space.
For credit file alerts, we only monitor your Experian credit file, meaning we can detect when businesses that report to Experian check or update your file. However, we do not have coverage of businesses that solely report to other credit bureaus such as Equifax or Illion.
If you receive an ID alert and it was you, there is no need to take any action. Simply rest assured that Truyu is monitoring and keeping you informed.
Sometimes a merchant’s name isn’t available. In these cases, we will provide you with the merchant’s industry or sector. If you require further assistance, contact us at contact@truyu.com.au for more information.
If it wasn’t you, it could be a case of identity misuse. Follow the links and recommendations within the alert to re-secure your information as efficiently as possible and prevent further harm or loss.
For credit file alerts, you may want to contact the business that made the enquiry or opened the account. You should also consider placing a temporary ban on your credit file.
You can apply for credit file bans with all of the Australian credit reporting agencies (CRAs), by engaging just one of them and requesting that they place bans with all CRAs if you agree to their terms and conditions.
You can place a ban request at each credit reporting agency using the following links:
Experian: Request a Ban
Equifax: Request a Ban
Illion: Request a Ban
If you need additional support, contact us at contact@truyu.com.au, and we’ll assist you through the process
The name on your ID usage alert and credit file alert might be unfamiliar as it could have come from a third party representing the merchant. Sometimes merchants use third party companies to handle transactions on their behalf.
A merchant can also use a different name, known as its trading name, publicly instead of its legally registered name.
Truyu currently only matches on the name and date of birth you’ve registered with us. At the moment, we are only able to support one name and date of birth combination per account and one account per device. Make sure you register to our ID alerts feature with your most commonly used legal name, so we can catch as many cases as we can.
During the pilot we will only be matching on name and date of birth. While there is a risk of getting a match on someone else, as they would need to have the exact same first name, last name and date of birth.
If you have any concerns about this potentially being a risk for you, please contact us at contact@truyu.com.au
No. You can only use a physical driver’s licence to set up ID alerts.
Sometimes your ID verification needs another pair of eyes for review. Sit tight and we’ll get back to you within 3 business days by email.
During pilot this could be due to:
A change in your details
If your ID was used, and it was not you, or your credit file was accessed fraudulently, we recommend you contact the business immediately, as well as place a ban request at each credit reporting agency; Experian, Equifax and Illion.
If you know what identity document was used, you should consider replacing it.
If your credit file is viewed or modified without your authorisation, it could be a sign of identity theft or fraud, potentially leading to financial loss. Unauthorised enquiries may also lower your credit score, affecting your ability to get loans, credit cards, or competitive interest rates. Monitoring your credit file helps ensure its accuracy and protects you from unauthorised use of your personal information.
You can manage your ID alert subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
Every Truyu user will receive data breach alerts notifications when the emails you have registered for data breach alerts are detected in a data breach from public domain sources aggregated by one of our partners.
A data breach can leave a trail of your personal information available to a fraudster who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you a historical record of data breaches that email has been involved in., as well as helpful proactive guidance to enhance your online security.
The dark web is a part of the internet known for being an anonymous hub for illegal activities. Such activities include the trading of personal information. Dark web monitoring is the process of searching these websites for this information (such as passwords and email addresses) and alerting you when your information is found, as part of our data breach alerts feature.
There are many possible reasons why you may not recognise the name of a business associated with a data breach:
A data breach is when data held about you by a third company is accessed by someone who is not authorised. If the unauthorised party makes this information accessible to other parties, or decides to sell it online, it can reach our partner's database and, where your email address is included, this will become an alert in Truyu. If the unauthorised party does not publish this information to a location we monitor, it will not be accessible to our partner's database, and therefore not an alert. This does not mean that the unauthorised party will not do something in the future that would make it accessible to other parties and our partner's database. In this case, you would receive an alert from Truyu.
Another reason you may not have received an alert for a data breach is that the data breach did not contain your email. Truyu uses only your email to detect if you’ve been in a data breach.
All recent Australian driver’s licences have two numbers - licence number and card number. Both need to be valid to pass an ID verification check.
Replacing your driver’s licence changes your card number - which does stop fraudsters from passing ID checks. For a more thorough replacement, you can request to change your licence number as well. Changing your licence number usually requires evidence and a police report to support the request.
We recommend considering replacing your licence if you suspect fraudulent activity, and changing your licence number if your ID is detected to be used by someone who isn’t you.
Replacing your card number:
Changing your licence number:
These typically require additional evidence of fraud or police reports. Check with your state or territory’s issuer for more information.
While some documents can be re-issued with a new number, some maintain the same number and allow for a block which prevents the document being used as proof of identity through the document issuer. We recommend contacting IDCARE or the relevant issuing agency if you have any questions.
Scam Checker uses AI and available data to analyse the text message (and any personal information within them) for multiple factors, such as requests for personal information, suspicious links and payment requests. Once the text messages are analysed by AI against available data, Scam Checker provides a suggestion of whether the message is “probably a scam” or “unable to confirm”. Please note this is a suggestion only and requires your individual verification. AI is not a perfect tool and is not always correct.
Upload a screenshot of a text message into Scam Checker. It will analyse the message and suggest whether the message is “probably a scam”, along with relevant pre-determined common scam indicators and details to keep you informed about current scam tactics.
Tips when uploading text messages
Scam Checker utilises AI and available data to analyse text messages and will provide a suggestion that a text message is "probably a scam" or "Our checks didn’t identify any suspicious indicators." based on patterns like suspicious links, requests for personal information, and payment requests.
The more of these red flags that appear, the more likely the message is to be a scam.
We don't give a definitive, 100% certain answer because legitimate messages can sometimes resemble scams, and scammers are constantly changing tactics. Scam Checker is also reliant on AI and available data, the accuracy and reliability of which we cannot guarantee. You are ultimately responsible for verifying the accuracy of the suggestion provided by Scam Checker.
Our goal is to provide an informed likelihood while encouraging caution and vigilance.
Text messages you upload to Scam Checker may contain your personal information and in some circumstances your sensitive information. We will only collect and use this information for the purposes of facilitating and improving your use of the Truyu Scam Checker service and to generate insights regarding scams . We may also share the information with our parent company the Commonwealth Bank of Australia, for the purposes of providing and improving the Scam Checker service, generating insights regarding scams, cybersecurity and fraud, and providing intelligence to:
You may have received an offer code which, once redeemed, grants you an extended free trial of Truyu’s ID Usage Alerts Service subscription.
You will see the option to add your offer code after subscribing to our ID Usage Alerts Service. Checkout with the 3-month introductory free trial, then apply your offer code in the Settings page.
If you’ve already started your 3-month free trial, apply your offer code in the Settings page.
To check your subscription status, you’ll need to do so through the platform you originally used to subscribe. Here’s how you can do it:
If you subscribed via Google Play:
If you subscribed via the App Store:
If you're encountering an error message when logging in, please ensure that you have updated to the latest version of the Truyu app. If the issue persists after updating, please email us at contact@truyu.com.au and we'll assist you further.
Truyu can alert you when your data is found on the dark web (through our data breach alerts service), or when your identity has been used (through our ID usage alerts service). Without a Truyu account you may miss the opportunity to proactively remediate the situation when your data or identity may have been used without your authority.
Rather than cancelling your account, we recommend you consider retaining the data breach alerts service, which bears no subscription cost, which still notifies you if your email address is detected in a data breach.
To delete your Truyu account, go to “Settings” and tap “Delete account”
If you’ve lost access to your Truyu account or your device and want to delete your account, contact us at contact@truyu.com.au
You can manage your ID alert subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
Email us at complaints@truyu.com.au and we’ll get back to you within 1 business day.
If you want to provide feedback or have more general enquiries, email us at contact@truyu.com.au
Here’s how you’ll know when we’re contacting you:
If you receive an SMS or email from another address claiming to be us, please report it to us at contact@truyu.com.au
Please do not click on any unexpected or suspicious links, even if the message appears to come from Truyu. If in doubt, get in touch with us.
Be sure to check your spam or junk email folders for messages from Truyu. If you find one there, move it to your inbox or mark it as ‘not spam’. Emails from us should appear in your main inbox from then on.
Truyu is a brand of CBA New Digital Businesses Pty Ltd ABN 38 633 072 830 trading as Truyu.
CBA New Digital Businesses Pty Ltd is a wholly owned but non-guaranteed subsidiary of the Commonwealth Bank of Australia ABN 48 123 123 124. CBA New Digital Businesses Pty Ltd is not an Authorised Deposit-taking Institution for the purposes of the Banking Act 1959 and its obligations do not represent deposits or other liabilities of Commonwealth Bank of Australia.
To access detailed terms and conditions about Truyu please click here. For information on how we collect and handle personal information, see our Privacy Policy.
*The ID Usage Alert Service is not comprehensive. Importantly, you will only receive a notification if GBG has informed us that your first name, last name and date of birth have been used at an Australian merchant that is onboarded by GBG as part of our ID Usage Alert Service. As at 5 February 2025, GBG handles over 60% of online identity checks run by Australian merchants.
**There is an initial three-month trial, for all new customers. A monthly subscription fee of $4.99 will be debited from your Apple App Store or Google Play Store payment method once the trial is completed, unless you cancel your subscription before the end of the trial.
Apple and the Apple Logo are trademarks of Apple Inc. Google Play and the Google Play logo are trademarks of Google LLC.
Truyu 2024. All rights reserved.
