How to Watermark Australian ID Documents Before Sending Them

The rental application asks for scans of your driver's licence, a Medicare card and a payslip. The crypto exchange asks for a licence and a passport for the 100-point check. The neobank asks for a licence upload plus a selfie. The new-employer onboarding portal wants a licence for TFN verification. Each request is normal on its own; each also creates a permanent file in someone else's system that you have no visibility into afterwards.

The Optus data breach in 2022 and the Medibank breach the same year both dumped millions of Australian ID copies into the wider criminal ecosystem, and neither was a niche incident — they hit customers who had done nothing more risky than sign up for a service that later got breached. That is the context for this article. What Australian ID documents actually reveal, what the Privacy Act 1988 and its 2024 amendments give you, when a watermark helps and when the 100-point check accepts it, and how to watermark the file locally in your browser so a leaked copy is bound to exactly one transaction.

What Australian ID documents actually reveal

The three most-requested Australian ID documents are the state-issued driver's licence, the Medicare card and the Australian passport. Each carries a different mix of identifying data, and each has slightly different rules about what it is legitimately used for.

A state driver's licence (NSW, Victorian, Queensland, WA, SA, Tasmanian, ACT or NT) prints your full name, address, date of birth, licence number, photograph, signature, and (on the newer digital licences) a barcode encoding the same fields. Address on the licence is significant — most other Australian IDs do not print your home address, but the licence does. That makes a licence copy the primary vector for identity fraud targeting Australian consumers: a fraudster with a clean licence scan can pass most automated checks that require proof of address.

A Medicare card shows your name, Medicare number, an individual reference number (1-9) that identifies you within a household, and an expiry date. The number is a health identifier, not a general identity credential — but because it is on the 100-point list, businesses often ask for it anyway. Handing out your Medicare number routinely is a bad habit; it is one of the fields that tends to end up in fraud databases after breaches.

An Australian passport biographical page carries the same shape of data as any modern e-passport — passport number, full name, nationality, date of birth, sex, place of birth, expiry, photograph, signature and MRZ. The MRZ (two lines of OCR-A text at the bottom) encodes most of the fields in machine-readable form; if you mask the printed fields but leave the MRZ visible, the copy is effectively unmasked.

Combined — licence for address + passport for identity + Medicare card for the third document — one submission gives a fraudster the full 100-point kit. That is why rental applications and crypto exchanges are among the most-targeted collection points.

The 100-point check, briefly explained

The 100-point identity check comes from the Financial Transaction Reports Act 1988 and remains the standard shape of identity verification used by Australian banks, financial services and many government agencies. Documents are assigned point values:

• 70 points — Australian or foreign passport, birth certificate, citizenship certificate.
• 40 points — driver's licence, proof-of-age card, government-issued firearms licence.
• 35 points — utility bill in your name at your current address (if not from a document already used).
• 25 points — Medicare card, credit card statement, ATO notice of assessment.
• Other secondary documents at 25 or 40 points, depending on the type.

You need 100 points combined. The check does not depend on the file being unmarked — the recipient reads the identity fields off each document, and any watermark that leaves those fields legible is acceptable. What triggers rejection is a heavy watermark that covers name, number, photo or date of birth. The rule of thumb: opacity 30-45%, tiled coverage, light neutral color, and check every field is legible before you send.

Where the Privacy Act 1988 fits

The Privacy Act 1988 and its Australian Privacy Principles (APPs) apply to businesses turning over more than $3 million per year, plus specific sectors regardless of size (health service providers, credit reporting bodies, businesses handling tax file numbers, some others). Most businesses asking for your ID copy are covered, though small landlords and small businesses under the threshold may not be — which cuts both ways.

The 2024 amendments (Privacy and Other Legislation Amendment Act 2024, in force through 2025) added several things worth knowing:

• A statutory tort for serious invasions of privacy, giving individuals a right to sue for damages in specific circumstances.
• Explicit right to erasure and clearer rules on retention. Businesses should hold personal data only as long as needed for the disclosed purpose, and delete it when that purpose ends.
• Higher penalties for repeated privacy breaches, and broader powers for the Office of the Australian Information Commissioner (OAIC).
• Clearer breach-notification obligations, tightening the already-existing NDB scheme.

Practically, the two questions to ask when a business collects an ID copy are: "What is it used for, and how long is it kept?" Under APP 5, you are entitled to be told both at collection. Under APP 12 and APP 13 you can request access and correction. And now, increasingly, you can request deletion at the end of the retention period.

What to write on the watermark

Three elements every time: the recipient, the purpose, the date. Write the recipient's registered name — the trading name on the ABR (Australian Business Register) if the recipient is a business.

• Weak: "COPY" or "CONFIDENTIAL".
• Weak: "For 100-point check only" — which 100-point check?
• Strong: "For CoinJar Australia Pty Ltd account opening only — 6 Sep 2026".
• Even stronger: "For CoinJar (via GreenID) 100-point check — 6 Sep 2026". Naming the KYC provider makes the copy visibly out of place at any other provider.

Scenario by scenario

Rental application

The Australian rental market is one of the most privacy-hostile settings in the country. Agencies routinely collect scans of driver's licence, Medicare card, bank statements, payslips, references — and share them with third-party tenant-check services (TICA, Equifax Tenancy Verification, National Tenancy Database) whose retention periods are long and whose accuracy has been questioned by consumer advocates. Recent OAIC enforcement against agencies for excessive collection is worth being aware of.

At the inspection stage, offer to show the licence for sighting rather than sending a scan. At the application stage, a licence copy is expected but should be watermarked with the agency's trading name, the property address, and "rental application only" plus the date. The Medicare card is worth pushing back on — it is not necessary for a rental application; a passport, birth certificate, utility bill or bank statement can substitute at 100-point value if the agency insists on their own tally.

Banks and neobanks (CBA, ANZ, Westpac, NAB, Up, Judo, Volt)

Regulated under AUSTRAC's AML/CTF regime; identity verification and record-keeping for at least seven years are legally required. Bank onboarding routes through a third-party KYC provider named in the privacy policy — GreenID, Frankie Financial, Onfido and IDVerse are common in Australia. A light watermark passes automated checks; a fresh scan is expected for account tier upgrades.

AUSTRAC-registered digital currency exchanges

CoinJar, Independent Reserve, BTC Markets, Swyftx and others are registered with AUSTRAC as digital currency exchange providers and run full 100-point KYC. The file retention is measured in years. Watermark with the exchange's registered corporate name, the KYC vendor if named, and the date.

Employment onboarding (TFN, superannuation)

A new employer collecting your TFN, superannuation choice and identity documents is legitimately required to verify identity. The ATO's guidance says employers should handle TFN information under separate privacy provisions (TFN Rule 2015). Watermark the licence copy with the employer's legal name and "employment onboarding only" plus the date. Do the upload through the HR portal, not by email attachment to a hiring manager.

Motor vehicle sales, hire and insurance

Buying or selling a car, hiring one, changing insurance — all of these usually ask for a licence copy. Some of these are collected loosely (a small dealership on a phone camera); some are collected through professional systems (large insurers with proper document management). Watermark on the spot from your phone browser: "For [business] [transaction] only — [date]".

Medicare-linked and health-service contexts

Genuinely need your Medicare number: bulk-billed GP appointments, PBS prescriptions, some hospital admissions. Do not need your Medicare number: rental applications, gym signups, mobile phone plans, age-verification signups. The card should not travel outside health contexts as a general 25-point ID document if you can avoid it.

Beyond the watermark

• Strip EXIF metadata before you send. A phone photo of your licence typically carries GPS coordinates and a precise timestamp; your licence already prints your address, but the GPS adds where you actually were at the moment. Remove them with the EXIF cleaner.
• Mask MRZ on a passport copy when the recipient does not need to verify document authenticity. Use mosaic or solid color, not blur.
• Use the recipient's portal rather than email. Portals leave audit trails and control access; email attachments sit forever on multiple servers.
• Refuse to send Medicare cards to non-health contexts. The 25-point value is not worth the circulation risk of a health identifier.
• Request access annually. Ask one or two businesses holding your ID copy for a copy of what they hold, under APP 12. It tells you what they have.

If an ID copy has already leaked

1. Report to Scamwatch and ReportCyber — the first for scam and fraud reports at the ACCC, the second for cybercrime through the Australian Cyber Security Centre. Both produce reference numbers useful for later steps.
2. Contact IDCARE — Australia's national identity and cyber support service, free for individuals, at idcare.org or 1800 595 160. They walk you through recovery specific to Australian ID documents.
3. Place a ban on your credit report at Equifax, Experian and illion. It stops new credit accounts opening in your name; free, online, effective for 21 days at a time and extendable.
4. Apply for a new driver's licence number at your state licensing authority if the licence itself was in the leak. NSW, Vic and other states process these under fraud-flag procedures once you can point to a specific breach.
5. If the passport was in the leak, contact the Australian Passport Office to discuss cancellation and reissue.

A watermarked copy makes step 4 and 5 much cleaner. You can identify the specific submission that leaked, the agency involved and the date — instead of trying to reconstruct which of the many places you sent an ID copy to over the last five years was the source.

FAQ

Q: What is the 100-point identification check and does watermarking break it?
A: The 100-point check comes from the Financial Transaction Reports Act 1988. Documents are assigned point values — passport 70, licence 40, Medicare card 25 — and you need 100 combined. A semi-transparent watermark does not change the point value as long as identifying details remain legible. Keep opacity at 30-45% and verify every field is readable.

Q: What does the Privacy Act 1988 give me when a business holds my ID copy?
A: Rights to be informed of purpose and retention (APP 5), access (APP 12), correction (APP 13), and increasingly deletion after the 2024 amendments. Businesses turning over more than $3 million are covered, plus specific sectors regardless of size. The OAIC handles complaints.

Q: Will a watermark get my crypto exchange or bank application rejected?
A: Not if it stays light. AUSTRAC-registered financial services and DCE providers verify identity through KYC vendors like GreenID, Frankie Financial, IDVerse and Onfido. Opacity around 30-40% with tiled coverage passes most automated checks.

Q: Can a real estate agent legally demand my licence copy at inspection?
A: They can ask, but the APPs limit collection to what is reasonably necessary. Offer to show the licence for sighting at inspection; a copy is expected at application stage. Recent OAIC enforcement targets agencies for excessive tenant data collection.

Q: Should I mask my Medicare card number?
A: For most purposes outside health services, yes. The Medicare number is a health identifier, not a general identity credential. Ask why it is being collected, and consider masking the number itself with the mosaic tool while keeping the name visible.

Q: Does ImageMarker upload my ID to a server?
A: No. Everything runs inside your browser, so the image never leaves your device. Switch on flight mode and the tool still works.

Before you hit send

Handing over ID copies in Australia is not something you can avoid. The Optus and Medibank breaches taught the whole country that a routine copy can outlive both the reason you sent it and the business you sent it to. What you can control in the ten seconds before send is what is written across the file. Bind each copy to one agency, one purpose, one date. Skip the Medicare card where it is not needed. Strip the metadata. Send through official portals. That is the difference between a copy that works for exactly the transaction it was made for and a copy that works for whoever ends up with it.