Get the app
Truyu is a digital identity protection tool that alerts you when your identity may be being used or misused. We are currently in pilot and we look forward to hearing your feedback as you use the service. Truyu is a mobile application from x15ventures which is built by CommBank.
"Identity Check Alerts" and "Credit Activity Alerts" are features of our paid service, known as the Truyu Alerts subscription or Truyu Alerts Service. When referring to both, we use the term "Truyu Alerts".
Identity Check Alerts
When an online identity check occurs in your name, Truyu can alert you for a majority* of identity checks conducted by Australian businesses that run identity checks using systems which match your identity information against information held by the document issuer or official record holder using third party systems. We do not have full coverage of all identity checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours. In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional harm or loss.
Credit Activity Alerts
When your credit file has been accessed (typically by businesses to assess your application for credit products), or when an account is opened in your name, we are notified by our credit reporting agency, and will send you a Credit Activity Alert.
Email Leaks
Truyu will also alert you if we detect your email address(es) have been exposed in a data breach and provides proactive guidance to enhance your online security.
Any Australian can install the Truyu app on their smartphone for free and set up an account to start monitoring for Email Leaks and use Scam Checker.
You will need to be over the age of 18 and have either an Australian driver's licence or Australian passport to get your free identity protection scan and subscribe for Truyu Alerts.
We are a trial initiative created by x15ventures, CommBank's corporate venture scaler. We have launched with a small group of customers to further test the proposition and collect feedback. About Us
Truyu is free to install on the Apple App Store & Google Play Store. Setting up an account and accessing your identity protection scan is free.
At no cost, you will be able to access:
After we know you are who you say you are (with a successful ID verification), you can access:
Truyu is currently offering a 3-month free trial for our subscription service (Truyu Alerts) during the pilot, which will alert you when your identity information is used. After the free trial ends, you can continue to protect your identity for just $4.99 per month.**
Eligibility criteria:
If you wish to cancel your free trial or subscription, you can do so in the App Store or Play Store:
No, creating a Truyu account has no impact on your credit score. Setting up Truyu Alerts involves an identity verification process, but this also has no impact on your credit score.
With the Truyu Alerts subscription:
Available to all Truyu accounts (free):
If it is not you who is using your identity online, it could be a fraudster who has gained access to your personal information and is impersonating you online. 255,100 Australians were victims of identity theft in the 2023-24 financial year¹, with people spending up to $34,440 on recovery costs in 2023². In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and help avoid additional related harm or loss.
A data breach can leave a trail of your personal information available to a fraudster, who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you with a historical record of some data breaches that email has been involved in (if at all), as well as helpful proactive guidance to enhance your online security.
If your credit file is viewed or modified without your authorisation, it could be a sign of identity theft or fraud, potentially leading to financial loss. Unauthorised enquiries may also lower your credit score, affecting your ability to get loans, credit cards, or competitive interest rates. Monitoring your credit file helps ensure its accuracy and protects you from unauthorised use of your personal information.
We only collect the information we need to deliver our services like your contact details, verified identity information, and the details you choose to monitor.
Your data is protected using strong security measures, including encryption, access controls and strict retention policies.
You can learn more about how we handle and protect your information in our Privacy Policy.
Check our Privacy Policy for more details.
Setting up Truyu Alerts or your free identity protection scan requires a successful identity verification check which involves validating an Australian driver's licence or Australian passport accompanied by a selfie.
For Email Leaks, any email added for monitoring will be sent a verification code. You will need this verification code to start monitoring.
As part of our free identity protection scan, we provide you with a retrospective 180-day history of Identity Check Alerts after you’ve verified your identity.
If you don’t recognise an Identity Check Alert, this could mean your information is out there and your details were used by someone else. Our Alerts will tell you which documents or identity details were compromised. Follow the links and recommendations within the Truyu Alert to help re-secure your information as efficiently as possible.
Subscribe to Truyu Alerts so that you receive notifications of any further instances of misuse.
Truyu sends you an in-app notification when a credit file event is detected on your Experian credit file. There are two types of Credit Activity Alerts that Truyu provides you:
1. Your credit file was accessed – when a business views your credit file, usually indicating that you have applied for an account, service, or financial product.
2. An account was opened in your name – when a business modifies your credit file to indicate that an account has been successfully opened in your name for a particular service or financial product.
Truyu exclusively uses Experian as our credit reporting agency partner, meaning we cannot detect credit file activity with other agencies like Equifax or Illion.
Yes, you can still use Truyu Alerts. Truyu partners with different organisations to provide Identity Check and Credit Activity Alerts, including Experian, a credit reporting agency. If you’ve recently updated your personal details, ensure your creditors have the latest details, who will notify Experian to update the details on record.
If you have a ban on your credit file, Truyu won’t be able to access your credit file to set up Credit Activity Alerts and your Truyu Alerts may appear as ‘Monitoring incomplete’. A credit file ban will not impact your Identity Check monitoring, and you will continue to receive Identity Check Alerts.
To set up Credit Activity Alerts, you will need to contact your credit ban provider to lift your ban. Once this ban is lifted, you should be able to consent to Truyu as your access seeker and set up Credit Activity Alerts. If you wish to continue with your ban after you've set up Credit Activity Alerts, you can contact your credit ban provider to reinstate your ban.
Credit file bans will prevent credit providers from accessing your credit report. With Truyu’s Credit Activity Alerts, you can continue applying for credit while also being alerted if anyone else is accessing your credit file.
If you don’t have a credit file, you can still subscribe with Truyu Alerts and start monitoring for Identity Checks. While you’re subscribed, we’ll keep an eye on in the background so once you’ve established a credit file, we’ll automatically register you for Credit Activity Alerts. We’ll notify you if this happens.
Sometimes we can’t find a credit file that matches your provided details. This can happen if your details are different at the credit bureau to what you’ve provided us (for example, you recently moved house and haven’t updated your address with your bank yet), or your credit file isn’t being held by Experian. If you've recently updated your personal details (such as a change of address), make sure your creditors have your latest information so they can notify Experian to update your records.
While you’re subscribed to Truyu Alerts, we’ll keep an eye on in the background so once you’ve established a credit file, we’ll automatically register you for Credit Activity Alerts. We’ll notify you if this happens.
You don’t need to add extra ID for monitoring. We only use your ID for verification purposes. Our monitoring covers any use of your name, date of birth, and any government-issued ID linked to you.
An Identity Check Alert is an in-app notification, sent to you when your information (such as your name and date of birth) is used at a majority* of Australian businesses that require identity checks.
We don’t yet have full coverage, so you should use Truyu in conjunction with your normal fraud-prevention behaviours. In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you avoid additional harm or loss.
When you verify your identity with Truyu, we provide you with a 180-day history of Identity Check Alerts as part of your free identity protection scan.
Subscribe to Truyu Alerts and we will also notify you near real-time.
Truyu is currently in its early stages and our merchant coverage for Identity Check Alerts covers a majority* of identity checks occurring at Australian businesses. Banks, telcos and gambling companies are common examples of businesses that run identity checks.
We do not have full coverage of all identity checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours.
We plan to continue to grow and expand our coverage, so your experience should keep getting better and better as we continue to improve and innovate within the space.
For Credit Activity Alerts, we only monitor your Experian credit file, meaning we can detect when businesses that report to Experian check or update your file. However, we do not have coverage of businesses that solely report to other credit bureaus such as Equifax or Illion.
If you receive a Truyu Alert and recognise the activity, no action is needed. You can simply rest assured that Truyu is monitoring and keeping you informed.
Sometimes a merchant’s name isn’t available. In these cases, we will provide you with the merchant’s industry or sector. If you require further assistance, contact us through the contact form on our website for more information.
If it wasn’t you, it could be a case of identity misuse. Follow the links and recommendations within the Truyu Alert to resecure your information as efficiently as possible and prevent further harm or loss.
For Credit Activity Alerts, you may want to contact the business that made the enquiry or opened the account.
You should also consider placing a temporary ban on your credit file.
You can apply for credit file bans with all of the Australian credit reporting agencies (CRAs), by engaging just one of them and requesting that they place bans with all CRAs if you agree to their terms and conditions.
You can place a ban request at each credit reporting agency using the following links:
Experian: Request a Ban
Equifax: Request a Ban
Illion: Request a Ban
If you need additional support, contact us through the contact form on our website, and we’ll assist you through the process.
The name on your Truyu Alert might be unfamiliar as it could have come from a third party representing the merchant. Sometimes merchants use third party companies to handle transactions on their behalf.
A merchant can also use a different name, known as its trading name, publicly instead of its legally registered name.
Truyu currently only matches on the name and date of birth you’ve registered with us. At the moment, we are only able to support one name and date of birth combination per account. Make sure you register to Identity Check Alerts with your most commonly used legal name, so we can catch as many cases as we can.
During the pilot, Identity Check Alerts will only be matching on name and date of birth. While there is a risk of getting a match on someone else, we believe for a pilot of this size it is unlikely, as they would need to have the exact same first name, last name and date of birth.
If you have any concerns about this potentially being a risk for you, please contact us through the contact form on our website.
No. You can only use a physical driver’s licence to set up Truyu Alerts.
Sometimes your ID verification needs another pair of eyes for review. Sit tight and we’ll get back to you within 3 business days by email.
During pilot, this could be due to:
Limited coverage
A change in your details
If your identity was used, and it was not you, or your credit file was accessed fraudulently, we recommend you contact the business immediately, as well as place a ban request at each credit reporting agency; Experian, Equifax and Illion.
If you know what identity document was used, you should consider replacing it.
You can manage your Truyu Alerts subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
The Identity Protection Scan is a free one-off check that shows whether your personal information has appeared in known data breaches or dark web sources. See if your details are already out there and how you can protect yourself.
We’ll check the verified details you’ve provided to us for:
You’ll get a snapshot of your current exposure and practical steps you can take. To keep watching for new activity, you can subscribe to Truyu Alerts.
We’ll check your card number against data that’s available to us from online sources. It’s not a scan of every source on the internet, but it can help you spot if your card details may have been exposed.
Regardless, stay cautious. Keep using your normal fraud prevention habits when online shopping to prevent your details from being exposed.
New breaches happen every day. Checking regularly with Card Leaks helps you stay one step ahead.
Card Leaks helps you find out if your debit or credit card details have been caught up in a known data breach or appeared in sources from the dark web.
It’s a secure way to check if your card details might be out there so you can act fast to protect your money.
Yes, your details are secure. We only ask for your card number and we’ll never ask for your expiry date or CVC.
We only use your card details to check if your details are out there, not for any payment.
The Card Leaks feature is only offered in the app. We will never ask you for your card number outside of the Truyu app.
You can check most Australian debit and credit cards from major providers like Visa, Mastercard and American Express.
We’ll check your card number against data that’s available to us from online sources. It’s not a scan of every source on the internet, but it can help you spot if your card details may have been exposed.
If your card details are found in a leak, there’s a risk someone else could use them.
We’ll guide you through the steps to stay protected:
Not at all. Card Leaks doesn’t involve a credit check, it only scans breached data.
Every Truyu user will receive Email Leaks notifications when the emails you have registered for Email Leaks are detected in a data breach from public domain sources aggregated by one of our partners.
A data breach can leave a trail of your personal information available to a fraudster who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you a historical record of data breaches that email has been involved in, as well as helpful proactive guidance to enhance your online security.
The dark web is a part of the internet known for being an anonymous hub for illegal activities. Such activities include the trading of personal information. Dark web monitoring is the process of searching these websites for this information (such as passwords and email addresses) and alerting you when we find your information as part of our Data Breach Alerts feature.
There are many possible reasons why you may not recognise the name of a business associated with a data breach:
A data breach is when data held about you by a third company is accessed by someone who is not authorised. If the unauthorised party makes this information accessible to other parties, or decides to sell it online, it can reach our partner's database and, where your email address is included, this will become an Alert in Truyu. If the unauthorised party does not publish this information to a location we monitor, it will not be accessible to our partner's database, and therefore not an alert. This does not mean that the unauthorised party will not do something in the future that would make it accessible to other parties and our partner's database. In this case, you would receive an Alert from Truyu.
Using your email address, we’ll scan the dark web for any email and password combinations so you can stay a step ahead. Passwords often end up on the dark web through data breaches or stolen logs, and once exposed, they can be misused to access your accounts.
Note: Recommendations are general in nature. They do not assure protection from future leaks.
You may not recognise your password because it was stored in a scrambled (hashed) format before it was leaked, and we’ve found the hashed version. Hashing is when websites scramble your password in a one-way algorithm, and is a security measure many websites take so that they don’t see your actual password. Even so, a leaked hashed password can still be risky. Criminals can spot patterns by comparing hashes of common passwords and try to access your accounts.
Another reason you may not recognise your password is that your email address may have been used by someone else to create an account that was then leaked online. Since we use your email address to find any matches of email and password combinations from sources on the dark web, any passwords associated to your email address will be found, even if it wasn’t you who created the email and password combination.
If you see any leaked passwords, you should follow our recommendations in the app.
You may have some old accounts that use this password. Even if you don’t use these accounts or services anymore, your personal information may be on there which could be misused by criminals. If you can still access your old accounts, update your passwords. If you don’t need these accounts anymore, you may want to contact the service providers to remove your personal information or delete the account.
There are many reasons for this, for example, you may have different email and password combinations for different accounts or have changed your password over the years.
We’ll check your email address against data that’s available to us from online sources. It’s not a scan of every source on the internet, but it can help you spot if your details may have been exposed. Keep using your normal fraud prevention habits when online to prevent your details from being exposed.
New breaches happen every day. Checking regularly with Password Leaks helps you stay one step ahead.
All recent Australian driver’s licences have two numbers - licence number and card number. Both need to be valid to pass an ID verification check.
Replacing your driver’s licence changes your card number - which does stop fraudsters from passing identity checks. For a more thorough replacement, you can request to change your licence number as well. Changing your licence number usually requires evidence and a police report to support the request.
We recommend considering replacing your licence if you suspect fraudulent activity, and changing your licence number if your identity is detected to be used by someone who isn’t you.
Replacing your card number:
Changing your licence number:
These typically require additional evidence of fraud or police reports. Check with your state or territory’s issuer for more information.
While some documents can be re-issued with a new number, some maintain the same number and allow for a block which prevents the document being used as proof of identity. We recommend contacting IDCARE or the relevant issuing agency if you have any questions.
Scam Checker uses AI and available data to analyse the text message (and any personal information within them) for multiple factors, such as requests for personal information, suspicious links and payment requests. Once the text messages are analysed by AI against available data, Scam Checker provides a suggestion of whether the message is “probably a scam” or “unable to confirm”. Please note this is a suggestion only and requires your individual verification. AI is not a perfect tool and is not always correct.
Upload a screenshot of a text message into Scam Checker. It will analyse the message and suggest whether the message is “probably a scam”, along with relevant pre-determined common scam indicators and details to keep you informed about current scam tactics.
Tips when uploading text messages
Scam Checker utilises AI and available data to analyse text messages and will provide a suggestion that a text message is "probably a scam" or "Our checks didn’t identify any suspicious indicators." based on patterns like suspicious links, requests for personal information, and payment requests.
The more of these red flags that appear, the more likely the message is to be a scam.
We don't give a definitive, 100% certain answer because legitimate messages can sometimes resemble scams, and scammers are constantly changing tactics. Scam Checker is also reliant on AI and available data, the accuracy and reliability of which we cannot guarantee. You are ultimately responsible for verifying the accuracy of the suggestion provided by Scam Checker.
Our goal is to provide an informed likelihood while encouraging caution and vigilance.
Text messages you upload to Scam Checker may contain your personal information and in some circumstances your sensitive information. We will only collect and use this information for the purposes of facilitating and improving your use of the Truyu Scam Checker service and to generate insights regarding scams. We may also share the information with our parent company the Commonwealth Bank of Australia, for the purposes of providing and improving the Scam Checker service, generating insights regarding scams, cybersecurity and fraud, and providing intelligence to:
You may have received an offer code which, once redeemed, grants you an extended free trial of Truyu’s Alerts Service subscription.
You will see the option to add your offer code after subscribing to our Truyu Alerts Service. Checkout with the 3-month introductory free trial, then apply your offer code in the Account page.
If you’ve already started your 3-month free trial, apply your offer code in the Account page.
To check your subscription status, you’ll need to do so through the platform you originally used to subscribe. Here’s how you can do it:
If you subscribed via Google Play:
If you subscribed via the App Store:
If you're encountering an error message when logging in, please ensure that you have updated to the latest version of the Truyu app. If the issue persists after updating, Please contact us through the contact form on our website and we'll assist you further.
You can manage your Truyu subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
Truyu helps keep you informed when your personal information may be at risk, whether it’s found on the dark web, used in an identity check, or linked to a new credit enquiry. Without an active account, you may miss important alerts that help you act quickly to protect yourself.
If you’d prefer not to subscribe, you can still keep your Email Leaks service. It’s free and will continue to notify you if your email address appears in a data breach.
To delete your Truyu account, go to Account and tap Delete account.
If you’ve lost access to your account or your device, you can reach out via the contact form on our website and we’ll help you delete your account.
If you need assistance, simply complete the contact form on our website.
If something hasn’t met your expectations, please let us know by completing the contact form on our website.
Here’s how you’ll know when we’re contacting you:
If you receive an SMS or email from another address claiming to be us, please report it to us through our contact form on our website.
Please do not click on any unexpected or suspicious links, even if the message appears to come from Truyu. If in doubt, get in touch with us.
The Card Leaks feature is only offered in the app. We will never ask you for the CVC or Expiry of your card to complete our services. We will never ask you for your card number outside of the Truyu app.
Be sure to check your spam or junk email folders for messages from Truyu. If you find one there, move it to your inbox or mark it as ‘not spam’. Emails from us should appear in your main inbox from then on.
Truyu is a brand of CBA New Digital Businesses Pty Ltd ABN 38 633 072 830 trading as Truyu.
CBA New Digital Businesses Pty Ltd is a wholly owned but non-guaranteed subsidiary of the Commonwealth Bank of Australia ABN 48 123 123 124. CBA New Digital Businesses Pty Ltd is not an Authorised Deposit-taking Institution for the purposes of the Banking Act 1959 and its obligations do not represent deposits or other liabilities of Commonwealth Bank of Australia.
To access detailed terms and conditions about Truyu please click here. For information on how we collect and handle personal information, see our Privacy Policy.
*The Identity Check Alert Service is not comprehensive. Importantly, you will only receive a notification if GBG has informed us that your first name, last name and date of birth have been used at an Australian merchant that is onboarded by GBG as part of our Identity Check Alert Service. As at 5 February 2025, GBG handles over 60% of online identity checks run by Australian merchants.
**There is an initial three-month trial, for all new customers. A monthly subscription fee of $4.99 will be debited from your Apple App Store or Google Play Store payment method once the trial is completed, unless you cancel your subscription before the end of the trial.
Apple and the Apple Logo are trademarks of Apple Inc. Google Play and the Google Play logo are trademarks of Google LLC.
Truyu 2024. All rights reserved.
