If you think indepth, anyone with the skills, can make realistic looking id.
DL would be the easiest, and Medicare card.
Just need a 3d printer than can print on plastic, will be expensive, but would expect people in the know, can do it.
Either that, or that they have applied online, and that the verification matches your (old) records, via Experian etc.
===
Very hard to say for sure tho.
---
Just like for eg, for a while over the past 2 years, on a previous card, I would buy drinkng water in bottles from those Coca Cola vending machines, maybe one every few days, and yep, my debit card then started showing zero $ authorization s, then it started with $25 uber eats.
Another time, my bank sent me a message, and I rang the 13 phone #, ie, the message said to contact bank, the girl said my card # appeared on something called "list", and they dont know how or where it started, this was before the uber eats one.
---
ANZ falcon tho, probably is the best, havent tried it, but it might be the best one to avert all this weird odd transactions, they say they keep an out for it.
===
To sum up my waffle, maybe its that all your data, was matched into a likely document, or online acceptable id list, and they started with that.
As for how they know you dealt with CBA in the past, most likely the data/info is on the darkweb
Maybe that the QFF data breach, had that loan with CBA as you had earnt rewards points with CBA in the past.
---
Security vulnerabilities make it easy to modify NSW's digital driver's licence system to create fake IDs.
www.crikey.com.au
===
Edit/update: wow, they used a passport!/?
In your name?/!