identity.org.au

identity.org.au is not an Australian Government service. It is an open-source community service stewarded by the not-for-profit DETIO Foundation, currently in the process of applying for accreditation under the Digital ID Act 2024. How this service is different

Security

Device security checklist

Practical steps to keep the phone that holds your Identity Wallet safe — most take under a minute.

Last updated 20 July 2026

Your wallet's security is anchored in your phone's secure hardware, but good device habits still matter. Work through this checklist — most items take less than a minute.

Essential

  • Set a screen lock — a PIN of 6+ digits, or fingerprint/face unlock. The wallet relies on your device lock as its first barrier.
  • Keep your operating system updated. Install system updates when offered; they carry security fixes the wallet depends on.
  • Install the wallet only from source you trust. The reference app is open source; there are no official app-store listings, so treat any store listing claiming to be this wallet as suspect.
  • Turn on your platform's find-my-device feature so you can remotely lock or wipe a lost phone.

Strongly recommended

  • Use biometric unlock (fingerprint or face) where your device supports it — it is both more convenient and harder to shoulder-surf than a PIN.
  • Avoid rooted or jailbroken devices. Device integrity attestation will fail on tampered devices, and Trusted-level verification will be unavailable.
  • Review which apps have accessibility or screen-reading permissions — malicious apps abuse these to watch other apps.
  • Keep a record of your recovery information somewhere safe and offline, in case your device is lost.

Things the wallet does for you

The wallet encrypts identity material on-device before anything is transmitted, uses your phone's hardware-backed keystore where available, and proves its own integrity to the network through Play Integrity (Android) or App Attest (iOS). A stolen phone with a locked screen exposes encrypted data only.

No one legitimate will ever ask you to read out codes from your wallet, approve a request you did not initiate, or install a remote-access app. If that happens, stop and read the scams article.