There are card transactions I didn't make. Will my bank refund them?
What the ePayments Code says about who pays for unauthorised card transactions, how to report them, and where to escalate.
AI-assisted research and reviewed for accuracy. Something out of date? Let us know.
Usually, yes. Under the ePayments Code you are not liable for a transaction you did not authorise unless the bank proves you shared your PIN, kept it with the card or unreasonably delayed reporting, and if a PIN was used but you did nothing wrong your liability is capped at $150. The bank has 21 days to give you a written outcome. If it refuses, the Australian Financial Complaints Authority decides, free of charge.
Already tried and got nowhere?
That's where we start. Our team takes it from here.
Do you have to pay for transactions you didn't make?
No, in almost every case. The bank carries the loss unless it can prove you caused it, and the fact that the right PIN or password was used is not proof on its own.
The rules are in the ePayments Code, administered by the Australian Securities and Investments Commission (ASIC). It covers card, ATM, online, internet and mobile banking and BPAY transactions on consumer accounts at every subscribing bank, including all the majors. An unauthorised transaction is one made without your knowledge and consent; a payment you made yourself because a scammer tricked you is a different problem with different rules.
Your liability falls into one of three boxes.
- Not liable at all (clause 10). The card was forged, faulty, expired or cancelled; the transaction happened before you received the card or PIN, or after you reported it lost, stolen or compromised; the same purchase was debited twice; bank or merchant staff did it; only the card number and expiry were needed, with no PIN or device; or it is clear you did not contribute to the loss.
- Liable for no more than $150 (clause 11.7). A PIN or password was needed, but the bank cannot prove you breached the passcode rules. You pay the least of $150, the account balance, or the actual loss at the time you reported it, and nothing above your daily limit.
- Liable in full (clauses 11.2 and 11.5). The bank proves, on the balance of probabilities, that you voluntarily told someone your PIN, kept it written on or with the card without disguising it, were extremely careless with it, or unreasonably delayed reporting a lost card or compromised passcode. Even then you are only liable for losses before you reported, and never beyond your daily limit or account balance.
If a PIN was used and you did nothing wrong, the most you can lose is $150.
Three details tilt most disputes your way. Clause 11.8 says use of the correct PIN is significant but not of itself proof you contributed, and that the card number and expiry date are not secrets, so their use is irrelevant. Clause 11.10 says the bank cannot hold you liable for more than it would have recovered through chargeback. Clause 17.3 requires it to accept a report up to six years after you became aware, even if the chargeback window has closed.
The bank must give you a written outcome, or ask for more time, within 21 days, and finish within 45 days.
An ATM that debits you without paying out is covered by the same Code: see an ATM didn't give me my cash.
What should you do first?
Step 1: Call the bank now and get a reference number
Report the transactions and have the card blocked. Clause 17 requires the bank to give you a free way to report, around the clock. Anything after this call is the bank's loss under clause 10.1(e), so note the time and the reference number. Change your banking and email passwords and keep any scam messages as evidence.
Step 2: Ask in writing and set a deadline
Follow the call with a written dispute through the bank's online form or secure message, listing each transaction with date, merchant and amount.
Subject: Unauthorised transactions on card ending [digits], reported [date], reference [number]
The following transactions on my [credit/debit] card were not made or authorised by me: [date, merchant, amount, one per line]. I became aware on [date] and reported them by phone at [time] on [date].
I have never disclosed my PIN or passwords. Under clause 10 of the ePayments Code I am not liable for these transactions, and under clause 11.7 my liability cannot in any event exceed $150. Use of my card number and expiry date is not relevant to my liability (clause 11.8).
Please refund $[total] and any interest or fees, and under clause 18.1 give me a written outcome within 21 days citing the Code clauses you rely on. If you find me liable, please provide the evidence clause 18.5 requires. If the refund is not made I will lodge with the Australian Financial Complaints Authority.
Step 3: Ask for a chargeback on card purchases in parallel
For merchant purchases the bank can also reverse the payment under Visa or Mastercard rules. The window is 120 days from the transaction date for Visa and Mastercard, and 210 days for eftpos (ANZ, NAB). A failed chargeback does not end your Code rights. While a credit card amount is under chargeback, clause 19.1(d) requires the bank to suspend your obligation to pay it and any interest; pay the undisputed part as normal.
Step 4: Report the crime and protect your identity
Lodge a report at ReportCyber, the Australian Government's cybercrime reporting service; the bank may ask for the number. If your ID documents or passwords may be exposed, call IDCARE on 1800 595 160, the free national identity support service, and check your credit report for accounts you did not open.
What if the bank says you're liable?
The burden is on the bank, and it has to show its work. Escalate in this order.
- Demand the evidence. Clause 18.4 requires the outcome and reasons with the Code clauses relied on. If the bank finds you partly or wholly liable, clause 18.5 requires it to give you the transaction logs and say in writing whether there was any system malfunction. "The correct PIN was used" is not a finding under clause 11.8; ask what else the bank relies on.
- Internal complaint. Tell the bank you are complaining about its decision. ASIC Regulatory Guide 271 then requires a written response within 30 calendar days, and if it cannot meet that it must write to you with the reason and AFCA's details.
- Australian Financial Complaints Authority (AFCA). Free. Lodge at afca.org.au or on 1800 931 678 within two years of the bank's final response, or six years of becoming aware of the transactions, whichever is first. AFCA first decides whether the transactions were more likely unauthorised, giving most weight to records made at the time, then puts the onus on the bank to prove you breached the passcode rules. AFCA can also cut your liability if the bank had no reasonable daily limit (clause 11.9). Lodge promptly: AFCA says scam volumes are slowing it down.
- Police and ReportCyber. These do not get your money back, but a report number supports the bank claim and the AFCA file.
If the card is a business card, or the bank is not a Code subscriber, AFCA decides under your account terms, the law and good industry practice instead. A tribunal is not the route: AFCA covers every bank and its determinations bind the bank once you accept them.
Two years from the bank's final response to lodge with AFCA.
Two changes are reshaping scam cases, which are different from unauthorised transactions. Since 12 March 2026 AFCA can consider complaints involving the bank that received scammed funds and accounts opened in your name without your consent, even if you are not that bank's customer. And the Scams Prevention Framework, legislated in February 2025, will impose duties on banks, telcos and platforms once it commences; until then the ePayments Code and AFCA's current approach apply. If you were tricked into paying yourself, your claim runs under AFCA's authorised transactions approach, not clause 10.
What doesn't work
- Waiting to see if more transactions appear. Clause 11.5 makes you liable for losses between when you became aware and when you reported, if the delay was unreasonable.
- Cancelling the card without disputing the transactions. A replacement card does not trigger an investigation; you have to report each transaction as unauthorised.
- Saying "I may have given my PIN to my partner". Voluntary disclosure to anyone, including family, is the breach the bank needs under clause 12.2(a); only say it if it is true.
- Paying the disputed amount to stop interest. If a chargeback is running the bank must suspend it; paying can be read as accepting the charge.
- Treating a scam payment you made as fraud. If you keyed the payment yourself, clause 10 does not apply; use AFCA's authorised transaction route instead.
Common questions
I never lost my card. How could someone have used it, and am I liable?
Online and phone purchases only need the card number, expiry and CVV, which can be stolen in a data breach or by skimming. Clause 10.2 says you are not liable for a transaction that did not need a PIN or device, and clause 11.8 says use of your card number is irrelevant to your liability.
The bank says the correct PIN was used, so I must have shared it. Is that right?
No. Clause 11.8 of the ePayments Code says access with the correct PIN is significant but does not of itself prove you contributed to the loss. The bank must prove on the balance of probabilities that you disclosed the PIN or were extremely careless. Ask for the evidence, then take it to AFCA.
I only noticed the transactions three months later. Am I too late?
No. The bank must accept a report of an unauthorised transaction up to six years after you became aware of it, and cannot refuse because the chargeback window has closed. Report now. The 120-day chargeback window for Visa and Mastercard may have passed, but your rights under the Code have not.
Do I have to keep paying my credit card bill while the dispute is open?
Pay the undisputed part. If the bank is pursuing the disputed amount through a chargeback, clause 19.1(d) requires it to suspend your obligation to pay that amount and any interest on it until the dispute is resolved. Ask the bank to confirm in writing that it has done so.
It was a debit card, not a credit card. Do the same rules apply?
Yes. The ePayments Code covers debit cards, EFTPOS, ATM withdrawals, internet and mobile banking and BPAY as well as credit cards, provided the account is a consumer account at a subscribing bank. The chargeback route also exists for Visa and Mastercard debit purchases, with a 210-day window for eftpos.
I was tricked into making the payment myself. Does this page apply?
Not directly. A payment you made, even under a scammer's instructions, is treated as authorised, so the clause 10 and $150 rules do not apply. Still report it to your bank immediately, ask it to try to recall the funds, and complain to AFCA, which assesses scam losses under its authorised transactions approach.
- ASIC, ePayments Code (effective 2 June 2022)
- Australian Financial Complaints Authority, Factsheet: Unauthorised transactions
- ASIC Moneysmart, Unauthorised and mistaken transactions
- ANZ, View or dispute transactions
- NAB, Chargebacks: prevention and dispute guide for merchants
- Australian Signals Directorate, ReportCyber
Still owed? We'll take it from here.
Other
Banking
Issues
Read about the issues consumers are facing. Have a different issue? You can still make a complaint.