Losing a bank card or a phone with mobile money creates two connected security risks. The card may be used for purchases, while the phone may contain banking apps, SMS codes, authenticators, Apple Pay or Google Wallet, and saved passwords. In Australia, where contactless cards and digital payments are routine, speed matters more than deciding exactly where the items were lost.
For most Australians, “mobile money” means a phone-based wallet or mobile banking service rather than a stored-value balance held in a separate mobile-money account. A debit card, credit card, public transport card, physical SIM and eSIM are separate things, although one device can connect them. Treat each access route separately: blocking a bank card does not stop a stolen phone from receiving messages or resetting an email account.
Use the first hour to reduce access. Find the phone from another trusted device, call the bank through an official channel, suspend the missing card and any wallet linked to it, and contact the mobile carrier. Do not delay the bank call while searching message history. A bank can usually block a card before you have a police report or a replacement in hand.
Keep a note of what was lost, the time you discovered it, the last known location, and the numbers you called. If there is immediate danger or violence, call 000 in Australia; otherwise use your state or territory police non-emergency service. The steps below cover card loss, phone loss, and both together, while bank procedures and fees vary.
Use another trusted device to open Find My iPhone or Google Find Hub. Mark the phone as lost so its location can still be checked and the activation lock remains connected. Avoid factory-resetting it immediately, because erasing data can remove useful evidence and may complicate carrier or wallet recovery. Record the IMEI, which appears on the box, SIM tray or handset settings, before attempting a remote wipe.
Call the card issuer using the number in the banking app, on a statement, or typed directly into the official website. Ask for a temporary block, suspension of the mobile wallet, and confirmation that recurring card payments are stopped. Then contact Telstra, Optus, Vodafone or your mobile virtual network operator to suspend the SIM or eSIM and protect the number against unauthorised porting. Keep the carrier account PIN somewhere other than the locked phone.
For a major Australian bank such as Commonwealth Bank, Westpac, ANZ, NAB, Bendigo and Adelaide Bank, Macquarie or a digital bank, use the app or secure phone line to report the missing card. Ask whether the block also covers cardless cash withdrawals and the digital wallet token. Keep the old card blocked even if the app offers a quick unblock; an unknown thief could have copied its details or retained the card.
Review Apple Wallet or Google Wallet from another device and remove the affected card if possible. Do not assume a locked screen disables payments: devices differ, and some wallet cards can remain usable after a phone is marked lost. Ask the issuer to suspend the token directly, then check recent transactions, pending merchant holds and automatic subscriptions. In Australia, EFTPOS and Visa or Mastercard purchases may appear quickly, but merchant refunds and disputed transactions can take longer to resolve.
Separate unauthorised spending from an approved transaction you did not remember. Report every suspicious item, give the bank transaction times and merchant names, and request a case reference. Ask about provisional credits or reimbursement under the bank’s fraud policy; do not assume every loss will automatically be repaid. If the loss occurred away from home, contact the venue or property as well because the phone may have been stolen while the physical card was left somewhere else.
The phone’s email account may be the master key. From a clean, trusted device, change its password, approve the sign-out of old sessions, check recovery email and phone details, and review recent sign-ins. Protect the Google or Apple account connected to the handset as well. If malware may be installed, avoid entering passwords on that device; disconnect it from questionable networks and seek technical support before restoring sensitive apps.
Next protect every route into the bank: change the banking password, update the app PIN, rotate a compromised passphrase, and store one-time codes or authenticator recovery codes away from the phone. Some bank apps use device binding or biometric checks, while others use SMS, so ask the bank which verification method is now active. If an authenticator app has been lost, do not delete and reinstall it blindly; use its documented recovery process or ask the bank to reset authentication after identity checks.
Australian banks and Scamwatch advise that no legitimate bank employee will request your full banking password, PIN or a one-time security code. Ignore urgent calls claiming a lost phone or fraudulent card, especially if the caller asks you to move money to a “safe” account. End the call and contact the institution using the official app or statement. If bank staff confirm suspicious activity, change credentials and request a temporary transaction limit where available.
A police report can support an insurance claim and help flag the handset’s IMEI. Use 000 only for immediate danger or serious injury; for a theft without danger, use the non-emergency channel for your state or territory. Give police the make, model, IMEI, serial number, colour and approximate time and place of loss. Keep the report or crime reference number because the bank, insurer and carrier may each request it.
A carrier suspension stops calls and messages but does not erase personal data or prevent every stolen handset from working on another SIM. Ask the carrier to apply an IMEI block where possible and explain the difference between suspending the service, blocking the eSIM and porting the number. If the phone was used for work or contains a corporate mobile-device profile, inform the employer or IT administrator as well. A modest amount of cash is still useful in regional Australia, but carrying your bank card and only emergency cash together concentrates risk.
Check for other exposed items such as a driver’s licence, passport, Medicare card, Tax File Number correspondence or transport pass. Report stolen identity documents to the issuing authority, and contact Services Australia about a missing Medicare card. IDcare’s national identity-theft service, 1300 737 632, can guide Australians through recovery. Mobile transport accounts also need attention: suspend passes used in Opal in Sydney, Myki in Melbourne or TransLink in Brisbane.
If your loss occurred during travel and a card may have been left at an accommodation, use verified contact details. When contacting a property such as Arushi Villa about a wallet left at reception, use its official site or booking confirmation, and never disclose card numbers, PINs or one-time codes in an unsecured message.
Secure the replacement device before restoring financial services. Set a strong screen lock, enable device encryption and biometric protection, install apps only from official stores, and sign into the correct Apple or Google account. Ask the carrier for a replacement SIM or eSIM and keep the same mobile number if it is needed for banking verification. Update the bank after the new number is active, especially if the old number was used for SMS codes.
The bank can explain whether it offers a temporary digital card, a replacement card with a new number, or both. Review saved cards, browser autofill, authenticator accounts and wallet cards before restoring them; remove unknown devices and revoke old sessions. Once the new card arrives, update rent, utilities, subscriptions and insurance payments, then check statements for duplicate charges. Test a small transaction only after balances, limits and delivery details are correct.
Maintain a written incident log with call dates, case numbers, disputed transactions and actions taken. Consider a credit-file check with Equifax Australia, Experian Australia or illion if identity information may have been exposed. Continue reviewing accounts for at least a full billing cycle because compromised credentials can be reused. Keep old statements for evidence, but do not reactivate the missing physical card merely because its replacement has not yet arrived.
Use card controls offered by your bank to limit contactless purchases, turn off international use and set alerts for unusual transactions. Keep a separate everyday card, and use a different card for travel or online spending where practical. A four-digit Australian EFTPOS or card PIN should never be written beside the card or stored in the phone. Where available, use passkeys or an authenticator rather than SMS for important changes.
Prepare an offline emergency record containing bank and carrier numbers, a spare securely stored card, device account details and the phone number of a trusted person. Enable Find My iPhone or Find Hub and check that family or emergency access is set up correctly. Keep a power bank for long journeys or regional outages. If you are considering portable solar charging, solar panel myths provides a useful reality check before relying on it for a security phone.
Do not store every financial credential in one place or use public Wi-Fi for sensitive banking after a loss. Keep software updated and separate the phone used for banking from casual travel apps where practical. Review whether phone insurance, travel insurance or a bank fee waiver covers a replacement device and emergency cash. These arrangements do not prevent loss, but they reduce how much access a finder can inherit and make recovery faster.
The priority order is what matters: secure the device, stop the card and wallet, protect the email and bank account, then rebuild access. Keep the police, carrier and bank reference numbers, document disputed payments, and monitor the accounts even after a replacement arrives. A lost phone can expose identity and authentication systems well beyond the value of the handset, while a missing card can remain usable until the issuer stops it. The lesson to remember is that rapid containment comes before replacement, documentation or convenience.