Australians will soon need to prove their age to access social media and cybersecurity experts are warning the confusion about how it will work could open the door to a new wave of scams. As the federal government prepares to roll out the Online Safety Amendment (Social Media Minimum Age) Bill 2024, concerns are emerging over how scammers might exploit public confusion about the changes. The ban, set to come into effect in December 2025, will require social media companies to take "reasonable steps" to prevent users under 16 from creating accounts. That includes verifying all users' ages but not through government-issued ID.

Still, many Australians mistakenly believe they'll need to submit sensitive documents like their driver's licence or passport to continue to scroll on Instagram or TikTok.

And according to experts, that misconception could give scammers a dangerous new opportunity.

What's actually required?

The new legislation explicitly bans platforms from requiring government-issued identification, including a digital ID, for age assurance. Instead, companies will need to implement alternative verification methods, though exactly what that looks like remains unclear. Despite this, many Australians are under the impression they'll be asked for their ID. On Reddit, one user warned the policy "will confuse people and make more vulnerable boomers that get scammed asking for ID". "The status quo now is never to provide ID. Once the government says you must, the door is wide open," they wrote.

That confusion could make people more susceptible to scams disguised as legitimate ID verification requests.

A new type of scam

Experts say scammers are quick to jump on policy grey areas especially when public awareness is patchy and technical details are vague. Professor Toby Murray from the University of Melbourne's School of Computing and Information Systems said it's "not impossible" scammers will try to impersonate social media companies and trick users into uploading personal documents.

"Mass text message scams where people are getting texts purporting to be from Facebook saying, 'You've got to click this link and verify your age before you're able to log into your Facebook account again' & It's not impossible that we might start to see that kind of stuff emerging," he told SBS News.

David Lacey, CEO of IDCARE, a not-for-profit support service for identity theft victims, agreed, saying scammers were likely to exploit the uncertainty by impersonating social media platforms like Meta a tactic they already use. "The most likely response will be scammers impersonating Meta, which already happens," Lacey told SBS News. "We haven't seen this specific nuance just yet, but expect it will happen." Mohiuddin Ahmed, senior lecturer in computing and security at Edith Cowan University, agreed the changes are likely to "instigate scammers to devise new ways to gather personal information and use them for fraudulent activities".

He said these scams could involve:

  • Fake websites requiring users to upload ID;
  • Phishing messages with links asking for ID to "continue using" an app;
  • Attempts to remotely access a victim's device or install spyware. 

"The possibilities are limitless, as the requirement to submit ID is also broadening the threat landscape," Ahmed told SBS News.

Exploiting public confusion

A key risk isn't the legislation itself it's the public misunderstanding of it. And right now, there's little clarity on what age verification will actually look like in practice. Each platform will be responsible for creating and implementing its own solution, which may vary widely. That uncertainty creates what Murray called an "information vacuum" ideal conditions for scammers to operate in.

"Australian consumers, we're not used to having to hand over our ID documents to online websites to access them. There's certainly been a lot of confusion around what kinds of age assurance mechanisms are actually going to be used," Murray said.

"When different platforms might be using different technologies, that only creates additional uncertainty and confusion for people," Murray said. "Most scams take advantage of the fact that the person who is being scammed doesn't understand what's going on as well as the scammer does." He said the rollout of two-factor authentication brought similar risks new technology can help with security, but also introduces new vulnerabilities.

"As age assurance technologies are going to start to become more widely rolled out, people are going to have to learn what risks they present and how to use them securely," he said.

But until clearer public guidance is issued and until platforms publish details of their chosen systems scammers may continue to exploit the gap. "We don't know how it's going to look, so because of that, it has created a potential risk," Murray said. "It remains to be seen how dangerous that risk is going to be in practice." A spokesperson from the Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts said guidance around the ban would be issued by September. "We know that data privacy is a significant concern for Australians, and is a key consideration as we work towards implementing the social media minimum age," the spokesperson told SBS News.

"The eSafety Commissioner will issue regulatory guidance by September, detailing the regulators expectations on the steps platforms will need to take to comply with the legislation. This will include how platforms should safeguard users personal information."

What happens when someone steals my identity?

If scammers get hold of sensitive documents like a driver's licence or passport, the consequences can be long-lasting.

They may use these to:

  • Apply for credit cards or loans;
  • Open bank accounts;
  • Register vehicles or apply for government services;
  • Conduct illegal activity in someone else's name.

"It's the kinds of things that enable them to get money and then for you to be the one who's maybe liable for that," Murray said.

Ahmed said stolen identities can also severely impact a victim's credit score. "If the scammers use the stolen ID to apply for multiple credit cards or other loans, then the victim will have a tough time rebuilding their credit score," he said.

According to the latest figures on personal fraud from the Australian Bureau of Statistics, in 2023-24:

  • 14 per cent of Australians aged 15 and over experienced personal fraud;
  • 1.2 per cent around 255,100 people were victims of identity theft. Of these, 25 per cent said scammers used their details to access money from a bank, superannuation or investment. And 12 per cent reported new accounts (like phone or utilities) being opened in their name. 
Murray said older Australians remain the most at-risk group. Ironically, the age group most affected by the new social media ban younger people who often don't yet possess an ID may also be the safest from scams.