Get the app
Truyu is a digital identity protection tool that alerts you when your identity is being used or misused online. We are currently in pilot and we look forward to hearing your feedback as you use the service. Truyu is a mobile application that has been built by x15ventures which is built by CommBank.
When an identity check occurs in your name, Truyu can alert you for a majority** of ID checks that are conducted in Australia. We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours. In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional harm or loss.
Truyu will also alert you if your email address(es) have been exposed in a data breach and provides proactive guidance to enhance your online security.
Any Australian can install the Truyu app on their smartphone and receive data breach alerts.
You will need to be over the age of 18 and have either an Australian driver's licence or Australian Passport to receive ID usage alerts.
We are a trial initiative created by x15ventures, CommBank's corporate venture scaler. We have launched with/to a small group of customers to further test the proposition and collect feedback. About Us
Truyu is currently offering a 3-month free trial for our subscription service (to ID Usage Alerts) during the pilot, which will alert you when your identity information is used. After the free trial ends, you can continue to defend your identity for just $4.99 per month.
Additionally, you will be able to register up to 5 emails for data breach alerts, where Truyu will alert you if your information is detected in a data breach. The data breach service bears no cost.
Eligibility criteria:
If you wish to cancel your free trial or subscription, you can do so in the App Store or Play Store:
No, creating a Truyu account has no impact on your credit score. Setting up ID usage alerts involves an identity verification process, but this also has no impact on your credit score.
The Truyu subscription sends ID usage alerts when your identity information (name and date of birth) is being used online at a majority** of Australian businesses that run identity checks, for example banks, telecommunications companies, gambling sites and other merchants.
Every Truyu user will receive their own notifications for data breaches when their registered email address(es) are detected in a breach. Upon registering your email address for monitoring, you will also receive alerts for historical data breaches.
Truyu will only send notifications if you give us permission. Without these notifications the service may not be as effective, however we will still alert you via email (as part of the both the data breach service and the ID usage alert service). You can manage your push notifications for Truyu through your phone settings.
If it is not you who is using your identity online it could be a fraudster who has gained access to your personally identifiable information and is impersonating you online. 199,100 Australians were victims of identity theft in the 2022-23 financial year¹, with people spending up to $34,440 on recovery costs in 2023². In the event of identity misuse, Truyu provides helpful links and remediation prompts to help you resecure your information as efficiently as possible and avoid additional related harm or loss.
A data breach can leave a trail of your personally identifiable information available to a fraudster who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you a historical record of data breaches that email has been involved in., as well as helpful proactive guidance to enhance your online security.
Truyu account
When you sign up for a Truyu account, we collect and use:
These are encrypted and stored by Truyu. We keep these for 3 years after you delete your account for legal and compliance reasons.
Data breach alerts
If you set up data breach alerts, we collect and use:
These are encrypted and stored by Truyu until you delete your account. Your emails are subject to an irreversible hash and de-identification treatment.
When you receive data breach alerts, we store:
This is encrypted and stored by Truyu until you delete your account. Note: Deleting your account does not delete your exposed data from the original data breach.
ID usage alerts
If you set up ID usage alerts, we collect and use:
These are destroyed 7 days after you submit your ID check. After ID verification, your name and date of birth are subject to an irreversible hash and then stored with our service partners.
In addition to the above attributes, setting up ID usage alerts requires us to collect these fields to verify your identity:
These are destroyed 7 days after you submit your ID check.
When you receive ID usage alerts, we store:
This is encrypted and stored by Truyu until you delete your account.
For more information, view Truyu’s Privacy Policy.
For ID usage alerts, monitoring an identity requires a successful identity verification check which requires validating an Australian Driver's License or Australian Passport, accompanied by a selfie.
For data breach alerts, any email added for monitoring will be sent a verification code. You will need this verification code to start monitoring.
An ID usage alert is an in-app notification and email whenever we detect that the details you have provided (for example your name and date of birth) have been presented to an ID verification service provider for an ID check.
An ID check can occur when you open an account or service at merchants like banks and telcos, and is completed by ID verification service providers. We have partnered with an ID verification service provider to bring you the ID usage alert service.
Truyu is currently in its early stages and our merchant coverage for identity usage alerts covers a majority** of ID checks occurring at Australian businesses. Banks, telcos and gambling companies are common examples of businesses that run ID checks.
We do not have full coverage of all ID checks, so you should use Truyu in conjunction with your normal fraud-prevention behaviours.
We plan to continue to grow and expand our coverage, so your experience should keep getting better and better as we continue to improve and innovate within the space.
If you receive an ID usage alert and it was you, there is no need to take any action. Simply rest assured that Truyu is providing the service.
If it was not you, it could be an instance of identity misuse. Follow the links and recommendations within the alert to help re-secure your information as efficiently as possible and avoid additional related harm or loss.
If you require extra support, please contact us at contact@truyu.com.au and we will ensure you are supported through the process.
Truyu currently only matches on the name and date of birth you’ve registered with us. At the moment, we are only able to support one name and date of birth combination per account and one account per device. Make sure you register to our ID usage alerts feature with your most commonly used legal name, so we can catch as many cases as we can.
During the pilot we will only be matching on name and date of birth. While there is a risk of getting a match on someone else, as they would need to have the exact same first name, last name and date of birth.
If you have any concerns about this potentially being a risk for you, please contact us at contact@truyu.com.au
No. You can only use a physical driver’s licence to set up ID usage alerts.
Sometimes your ID verification needs another pair of eyes for review. Sit tight and we’ll get back to you within 3 business days by email.
During pilot this could be due to:
If your ID was used, and it was not you, we recommend you contacting the merchant immediately. If you know what document was used, you should consider replacing it.
You can manage your ID usage alert subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
Every Truyu user will receive data breach alerts notifications when the emails you have registered for data breach alerts are detected in a data breach from public domain sources aggregated by one of our partners.
A data breach can leave a trail of your personally identifiable information available to a fraudster who can then exploit this data point to gain unauthorised access to other accounts. This can lead to them impersonating you online for nefarious purposes. For each of the email addresses you register for Truyu to monitor, we provide you a historical record of data breaches that email has been involved in., as well as helpful proactive guidance to enhance your online security.
The dark web is a part of the internet known for being an anonymous hub for illegal activities. Such activities include the trading of personal information. Dark web monitoring is the process of searching these websites for this information (such as passwords and email addresses) and alerting you when your information is found, as part of our data breach alerts feature.
There are many possible reasons why you may not recognise the name of a business associated with a data breach:
A data breach is when data held about you by a third company is accessed by someone who is not authorised. If the unauthorised party makes this information accessible to other parties, or decides to sell it online, it is likely to reach our partner's database and become an alert in Truyu. If the unauthorised party does nothing with the information, it will not be accessible to our partner's database, and therefore not an alert, e.g the Optus or Medicare data breach. This does not mean that the unauthorised party will not do something in the future that would make it accessible to other parties and our partner's database. In this case, you would receive an alert from Truyu.
Another reason you may not have received an alert for a data breach is that the data breach did not contain your email. Truyu uses only your email to detect if you’ve been in a data breach.
All Australian driver’s licences have two numbers - licence number and card number. Both need to be valid to pass an ID verification check.
Replacing your driver’s licence changes your card number - which does stop fraudsters from passing ID checks. For a more thorough replacement, you can change your licence number as well. Changing your licence number usually requires evidence and a police report to support the request.
We recommend considering replacing your licence if it’s found in a data breach, and changing your licence number if your ID is detected to be used by someone who isn’t you.
Replacing your card number:
Changing your licence number:
These typically require additional evidence of fraud or police reports. Check with your state or territory’s issuer for more information.
While some documents can be re-issued with a new number, some maintain the same number and allow for a block.
Truyu can alert you when your data is found on the dark web (through our data breach alerts service), or when your identity has been used (through our ID usage alerts service). Without a Truyu account you may miss the opportunity to proactively remediate the situation when your data or identity may have been used without your authority.
Rather than cancelling your account, we recommend you consider retaining the data breach alerts service, which bears no subscription cost, which still notifies you if your details are detected in a data breach.
To delete your Truyu account, go to “Settings” and tap “Delete account”
If you’ve lost access to your Truyu account or your device and want to delete your account, contact us at contact@truyu.com.au
You can manage your ID usage alert subscription in the Google Play Store or App Store:
Google/Android Instructions - Cancel, pause, or change a subscription on Google Play - Android - Google Play Help
IOS instructions - If you want to cancel a subscription from Apple – Apple Support (AU)
Email us at complaints@truyu.com.au and we’ll get back to you within 1 business day.
If you want to provide feedback or have more general enquiries, email us at contact@truyu.com.au
Here’s how you’ll know when we’re contacting you:
If you receive an SMS or email from another address claiming to be us, please report it to us at contact@truyu.com.au
Be sure to check your spam or junk email folders for messages from Truyu. If you find one there, move it to your inbox or mark it as ‘not spam’. Emails from us should appear in your main inbox from then on.
Truyu is a brand of CBA New Digital Businesses Pty Ltd ABN 38 633 072 830 trading as Truyu.
CBA New Digital Businesses Pty Ltd is a wholly owned but non-guaranteed subsidiary of the Commonwealth Bank of Australia ABN 48 123 123 124. CBA New Digital Businesses Pty Ltd is not an Authorised Deposit-taking Institution for the purposes of the Banking Act 1959 and its obligations do not represent deposits or other liabilities of Commonwealth Bank of Australia.
To access detailed terms and conditions about Truyu please click here. For information on how we collect and handle personal information, see our Privacy Policy.
* There is an initial three-month trial, for all new customers. A monthly subscription fee of $4.99 will debited from your Apple App Store or Google Play Store payment method once the trial is completed, unless you cancel your subscription before the end of the trial.
** The ID Usage Alert Service is not comprehensive and is limited to over 60% of identity checks conducted at businesses in Australia that run identity checks (subject to change). Importantly, you will not receive an alert if your identity information is used at a merchant that is not part of our ID Usage Alert Service.
Truyu 2024. All rights reserved.
