Relationship Authorisation Manager (RAM) website logo

    Fraud and cybersecurity incident policy

    How we identify or manage cybersecurity or fraud incidents, and how you can complain about cybersecurity or fraud.

    Published 21 July 2026

    Identification of fraud and cybersecurity incidents

    Protecting your information is a primary goal of Relationship Authorisation Manager (RAM). Constant monitoring for real or suspected fraud and cybersecurity incidents is done through:

    • referrals from the Australian Government Digital ID System (AGDIS) Administrator
    • reporting and tip-offs from the public
    • fraud modelling tools
    • cybersecurity monitoring tools.

    Management and resolution of fraud and cybersecurity incidents

    Once a suspected or real fraud or cybersecurity incident is identified:

    • we will investigate the matter to determine whether fraud or a cybersecurity incident has occurred; if fraud or a cybersecurity incident is confirmed, the impacted RAM authorisations will be suspended to prevent further misuse
    • we notify the AGDIS Administrator so they can identify where the compromised RAM authorisation might have been used and notify impacted parties (see note)
    • if we can confirm we have your legitimate contact details, we will attempt to notify you of the incident and what steps you need to take to protect yourself
    • your RAM authorisation will remain suspended until we can confirm
      • it was not compromised, and
      • you have full control of your authorisation
    • if your RAM authorisation was compromised, or you do not have full control of your identity, you will need to be reauthorised in RAM.

      • Note: The AGDIS is designed for your privacy, which means RAM does not have visibility of any services you access. Only the AGDIS Administrator can access this information and, by law, can only do so in limited circumstances. This includes where a suspected or real fraud or cybersecurity incident has occurred.

    Complaints related to fraud and cybersecurity incidents

    If you suspect your RAM authorisation has been compromised, or you want to make a complaint regarding how a fraud or cybersecurity incident is being handled, contact us.

    Your issue will be escalated, and we will:

    • investigate the issue
    • contact you to provide support and resolve the issue.

    We aim to resolve complaints within 28 business days. If your complaint is complex, it may take longer. If we can’t resolve your complaint, we’ll explain why and let you know your other options.

    Where a resolution cannot be reached due to a technical issue caused by a fraud or cybersecurity incident, we will refer the issue to the AGDIS Administrator.