New research has found that a complete Australian identity — your tax file number, date of birth and home address — is being sold on the dark web for as little as $280. That's less than a weekly grocery shop.
Security researchers from NordVPN analysed more than 75,000 listings across nine dark web marketplaces between January 2025 and February 2026. What they found should concern every Australian.
$280
Full Aussie identity bundle (TFN, DOB, address)
$45
Stolen digital scan of an Australian passport
$54
Australian driver’s licence on the dark web
75K+
Dark web listings analysed in the research
Why are Australians such a target?
Our documents are globally trusted and notoriously hard to replicate. A full set of Australian identity data costs six times more than the American equivalent — not because there’s more of it on the dark web, but because there’s less. That scarcity makes it more valuable, and it makes Australian businesses a prime target for the criminals who want to steal it.
Once that data is out, criminals can use it to file fraudulent tax returns, open credit accounts, execute SIM swaps, or build an entirely fake identity under your name. And most people won’t know it’s happened until the damage is done.
The real problem: verifying identity is still broken
Most businesses still rely on outdated methods to verify who they’re dealing with — uploading a photo of a licence, typing in a date of birth, or answering knowledge-based questions. These methods were designed for a world before data breaches. Today, that information is readily available to anyone willing to spend a few hundred dollars on the dark web.
The question is no longer whether someone’s data has been compromised — it’s what happens next when it gets used against your business or your customers.
How BlueKee helps
BlueKee is an Australian identity verification platform built for the reality of today’s threat landscape. Our digital identity app — and mobile SDK for businesses that want to embed verification directly into their own apps — confirms that a person is who they say they are, in real time.
Rather than relying on static data that may already be in criminal hands, BlueKee uses dynamic, layered verification that static documents simply can’t replicate. Whether you’re onboarding a new customer, approving a high-value transaction, or protecting access to sensitive accounts, BlueKee gives you confidence that the person on the other end is legitimate.
For businesses that collect and store customer identity data, using BlueKee’s SDK also reduces your own exposure — you’re not holding a trove of documents that become a target in themselves.
Don't let stolen data become your problem
BlueKee’s identity verification SDK integrates directly into your existing app — so your customers are protected from the moment they sign up, not after a breach has already happened.
