Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Westpac confirmed in June 2019 that compromised Westpac Live accounts had been used to make large numbers of PayID lookups. The information reportedly returned was account-name information—not bank account numbers. Westpac said customer bank account numbers were not compromised.
What happened in the Westpac PayID misuse
On 4 June 2019, Westpac said it had “detected mis-use” of PayID lookups and had taken additional preventative actions without shutting down the system, according to CIO’s report. The activity used compromised Westpac Live accounts to search PayIDs and obtain the short names associated with them.
CIO reported that a confidential memo sent by the bank to the wider banking industry attributed about 600,000 lookups to seven compromised accounts, with 98,000 resolving to a short name displayed to the person making the lookup. The memo reportedly said the activity had occurred regularly since 7 April 2019. Those figures are media-reported figures from the confidential memo, not independently audited totals.
Recommended Free Tools
Westpac said it detected no further inappropriate activity after taking preventative action, CIO reported. Computerworld also reported the bank’s confirmation and quoted its statement that “No customer bank account numbers were compromised as a result.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What information was exposed—and what was not
The reported results were account names returned by PayID lookups. Westpac said customer bank account numbers were not compromised. The contemporary reporting and statements cited here do not establish that passwords, balances, or transaction histories were exposed, so the incident should not be described as a breach of those details.
NPP Australia, which operates the PayID service, said during the incident response that “The only details obtained have been the account name which was designed to be returned to a legitimate enquiry,” according to Computerworld’s 4 June 2019 report. The spokesperson also said that financial details and credentials were not available from the PayID database. These were statements made in 2019, not an independent audit of the system or its later security controls.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why a PayID lookup can show a name
PayID lets someone use an identifier such as a mobile number, email address, or ABN instead of entering a BSB and account number. When a payer enters a registered PayID, the associated name can appear before the payer confirms the payment. That confirmation step is intended to help people check they are paying the right recipient; repeated lookups can also make the feature a privacy risk.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWestpac’s current PayID display-name FAQ says personal customers’ PayID names display as their first and last names. This is Westpac’s guidance and should not be assumed to describe every bank’s display rules.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Can you avoid displaying your name through Westpac PayID?
Westpac says customers who do not want their name displayed can receive eligible fast Osko payments using their BSB and account number without setting up a PayID. This option is specific to Westpac’s stated guidance; whether comparable alternatives are available depends on the customer’s bank and payment eligibility.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to check a payment safely
- Check the name before confirming. Westpac says the registered PayID name appears to the payer before payment confirmation.
- Verify an unexpected mismatch independently. If the displayed name does not match the intended recipient, Westpac advises calling the payee using a trusted number rather than relying on contact details in a suspicious message. See Westpac’s PayID payment guidance.
Westpac announced Verify on 5 March 2023 as an additional check for certain payments to a new BSB and account number, such as where an account-name mismatch may exist or the customer has not previously paid the account. The announcement said those payments could be held for four hours for review. Verify is a later payment-safety measure; the announcement does not establish that a particular technical change resolved the 2019 lookup misuse. Details are in Westpac’s 5 March 2023 announcement.
Quick Recap
Best Value
- Manufacturer Information: Manufactured by Hirsch Secure, Inc. - formerly Identiv
- Phishing-Resistant Security: FIDO Alliance-certified SecureKey stores site-specific cryptographic credentials on-device to help defend against phishing, password theft and replay attacks
- Passwordless and Multi-Factor Authentication: Supports FIDO2, U2F and WebAuthn for passwordless sign-in, 2FA and MFA
- USB-A and NFC Connectivity: Works with compatible laptops, desktops and mobile devices across Windows, macOS, Linux, ChromeOS, Android and iOS
- Multi-Protocol Support: Supports HOTP and PIV, with SecureKey Manager for FIDO2 PIN and device management
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
