If an insurer asks for identification before releasing your personal claim information, first confirm who is asking, what verification is required and where to submit it. Do not assume the request is fraudulent simply because you already have a claim number, but do not send identity documents to an unverified message sender either.
This article concerns identity verification for a privacy access request, not the evidence needed to establish an insured loss. Completing this check does not mean the claim has been accepted or that a repair or payment is authorised.
Understand why another check may be needed
The Office of the Australian Information Commissioner (OAIC) explains that an organisation must be satisfied that an access request comes from the individual concerned or someone they have authorised. It may ask for a written request and information identifying the requester. Knowing a policy number does not by itself settle every identity or representative-authority question.
That guidance does not prescribe a universal insurance ID pack. Do not assume that every insurer needs the same documents, or that a passport must always be supplied. Ask the organisation to explain its requirements for this particular request before collecting and transmitting sensitive material.
Verify the destination independently
Start from contact details in your existing policy documents or the insurer’s official website, rather than relying only on a link in a new email or text. Ask whether the privacy team sent the message, whether the reference is genuine and which submission method it accepts. This is a practical verification step, not proof that every official-looking website or message is safe.
- Record the organisation and team handling the access request.
- Match the request reference with your own sent correspondence.
- Confirm the exact portal, postal address or other accepted channel.
- Ask whether you will receive a submission acknowledgement and a later verification outcome.
If an unexpected message changes the destination, confirm that change through an established contact route before sending anything. Do not disclose passwords or login codes to demonstrate identity to a caller.
Clarify the minimum acceptable information
Ask which identifying details or documents are needed, why they are needed for this request and whether another verification method is available. If you do not hold the requested document, explain that rather than sending an unrelated bundle of financial and medical records.
Before obscuring document fields or watermarking copies, ask whether the proposed version will be accepted and which details must remain legible. Do not assume that editing a copy preserves its usefulness. Conversely, do not send extra documents merely because they are available. Ask how copies will be handled and retained; the response should inform your decision, not be treated as a guarantee that there is no privacy risk.
Keep identity and representative authority separate
In a hypothetical example, a daughter requests access to her father’s personal claim information. Showing the daughter’s own identification does not establish that the father authorised disclosure. Ask what authority the organisation needs, which person it covers and whether it applies to this specific access request.
A family relationship, shared address or ability to discuss appointment logistics should not be treated as unlimited authority over someone else’s information. If a person cannot provide authority in the usual way, ask about the applicable process rather than inventing a signature or assuming that another family member may approve it.
Track the two confirmation points
Keep a short register with the request reference, document description, submission date, channel and acknowledgement. Avoid placing full identification numbers in an ordinary tracking sheet. A useful follow-up is: ‘Please confirm that the material reached the privacy access team, whether identity and authority checks are complete, and what remains outstanding.’
An upload receipt establishes transmission or receipt according to that system; it does not establish successful identity verification or release of the requested information. If the insurer says it cannot find an attachment, reconcile the existing receipt and reference before repeatedly sending copies. Our checklist for confirming claim attachment allocation explains the separate receipt-versus-correct-file distinction.
What if the request is still stalled?
Ask for a clear explanation of the outstanding verification issue and a practical alternative if the stated method is inaccessible. Keep any access refusal and its reasons separate from the claim decision. The OAIC describes privacy complaint options when you are dissatisfied with an access response; that process is not a substitute for resolving the insurance merits.
Final checklist: verified recipient, agreed documents, confirmed authority where relevant, retained receipt and explicit verification outcome. Continue dealing with urgent claim or complaint deadlines separately: an identity-check exchange does not automatically extend them.
Source: OAIC guidance on access requests, identity and authorised representatives.
This is general information for Australian readers, not personal financial advice. It is not legal advice. Policy/PDS terms, applicable law and the individual claim assessment determine cover; identity verification does not establish entitlement.
