Computer Misuse Act 1993 · 2020 Revised Edition · Part 2 · Offences
8B. Supplying, etc., credential of another person
Feedback & supportLast amended by an amending law of 2025. 2 amendments in all.
A person shall be guilty of an offence if the person —
obtains or retains any credential of another person in relation to the national digital identity service; or
supplies, offers to supply, transmits or makes available, by any means, any credential of another person in relation to the national digital identity service.
It is not an offence under subsection (1)(a) if the person obtained or retained the credential of the other person for a purpose that is not any of the following purposes:
for use in committing, or in facilitating the commission of, any offence under any written law;
for the supply or transmission of, or making available, by any means, the credential to be used in committing, or in facilitating the commission of, any offence under any written law.
It is not an offence under subsection (1)(b) if —
the person did the act for a purpose other than for the credential of the other person to be used in committing, or in facilitating the commission of, any offence under any written law; and
the person did not know or have reason to believe that the credential of the other person will be or is likely to be used to commit, or facilitate the commission of, any offence under any written law.
For the purposes of subsection (1)(b), a person does not transmit or make available any credential of another person in relation to the national digital identity service merely because the person provides, or operates facilities for network access, or provides services relating to, or provides connections for, the transmission or routing of data.
national digital identity service
“national digital identity service” has the meaning given by paragraph 1(1) of the First Schedule;
Subject to subsections (5A) and (5B), a person who is guilty of an offence under subsection (1) shall be liable on conviction —
to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both; and
in the case of a second or subsequent conviction, to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 5 years or to both.
Where an individual is convicted of an offence under subsection (1)(a), the individual shall, in addition to the punishment under subsection (5), be liable to caning of not more than 12 strokes if the individual obtained or retained the credential —
for use in committing, or in facilitating the commission of, any scam offence; or
for the supply or transmission of, or making available, by any means, the credential to be used in committing, or in facilitating the commission of, any scam offence.
Where an individual is convicted of an offence under subsection (1)(b), the individual shall, in addition to the punishment under subsection (5), be liable to caning of not more than 12 strokes —
if the individual knew that the credential will be used to commit, or facilitate the commission of, any scam offence; or
if —
it is proved, to the satisfaction of the court, that the credential was used to commit, or to facilitate the commission of, a scam offence; and
the individual is not able to prove, to the satisfaction of the court, that he or she had, at any time, taken reasonable steps to ensure that the credential would not be used to commit, or to facilitate the commission of, a scam offence.
For the purposes of subsections (5A)(a) and (b) and (5B)(a), it is not necessary for the prosecution to prove that the credential was used to commit, or to facilitate the commission of, a scam offence.
For the purposes of subsection (5B)(b)(i), it is not necessary for the prosecution to prove that any person was convicted of the scam offence.
In this section —
a reference to a credential of another person in relation to the national digital identity service has the meaning given by paragraph 1(2) of the First Schedule; and
a reference to an offence under any written law includes an offence under subsection (1).