Waking up to find an unfamiliar charge on your statement is unsettling, particularly in a country where tap-and-go payments have become second nature. From grabbing a flat white in Surry Hills to filling up the car at a service station in Geelong, Australians move money with a quick wave of a card or a tap on a phone. That ease also makes it harder to notice when something goes wrong, because transactions blend into a busy financial life and small amounts can slip past attention.
The good news is that Australian consumers sit behind some of the strongest banking protections in the region. The ePayments Code, oversight from the Australian Prudential Regulation Authority, and the dispute pathways run by the Australian Financial Complaints Authority give you clear options once you realise your account has been touched without your permission. Knowing what to do, and in what order, can be the difference between getting your money back and absorbing the loss yourself.
The first few minutes after spotting a suspicious transaction are critical. Open your banking app and freeze or block the affected card immediately. Every major Australian bank — Commonwealth Bank, NAB, Westpac and ANZ — lets you lock a card in a couple of taps, which stops further activity without closing the account outright. If the bank has a 24-hour hotline, call it at the same time so a representative can flag the merchant and place additional holds on the merchant category.
While the card is frozen, change the passwords connected to the account. This includes your banking app login, your email address (because email resets often unlock everything else), and any saved payment wallets such as Apple Pay, Google Wallet or Samsung Wallet. Australians who use mobile wallets in cities like Brisbane and Perth often forget that the token stored on the phone can still be used by a thief who has both the physical device and the linked card number. Removing the card from those wallets is a fast way to close that loophole.
If you cannot reach your banking app, call the bank's automated line or visit a branch — the major banks keep branches open in suburban centres from Parramatta to Footscray, which is helpful when login details feel out of reach. Once the immediate damage is contained, you can move on to a more formal dispute.
Once the immediate threat is contained, contact your bank through its official fraud line and open a formal dispute. Under the ePayments Code, banks are expected to investigate unauthorised transactions promptly and, in most cases, refund the money if the loss was not caused by your own negligence. The investigator will usually ask you to confirm which transactions you did not authorise, when you last used the card yourself, and whether you have shared any details with anyone in the preceding weeks.
Keep a written record of every conversation. Note the date, the name of the person you spoke with, and what they said. Save screenshots of the disputed transactions, including the merchant name, amount and timestamp. Many Australians find that lodging the dispute in writing through secure messaging inside the banking app creates a cleaner paper trail than a phone call alone. If the bank initially rejects the claim, you have the right to escalate the matter to the Australian Financial Complaints Authority, which resolves disputes for free and can order the bank to pay compensation.
Do not delete any suspicious emails or text messages, because the bank or the police may need them as evidence later. Save the original message header if you can, and forward copies to your bank's fraud inbox. Small steps like these often speed up an investigation that might otherwise stall on missing detail.
A bank dispute does not cover every angle. If your card details were stolen through phishing, a skimming device, or a data breach, the matter also belongs with Australia's national anti-scrime bodies. Report the incident to Scamwatch, which is run by the Australian Competition and Consumer Commission. Scamwatch collects data that helps regulators track new fraud patterns and warn other consumers. Where there is clear evidence of identity theft — for example, if someone has used your details to open an account or take out credit — you should also contact IDCARE, the country's dedicated identity and cyber support service.
For more serious losses, particularly those involving organised crime or losses above a few thousand dollars, consider filing a report with your local police station or through the Australian Cyber Security Centre's ReportCyber portal. A police report creates an official record that can support insurance claims, tax records and any future legal proceedings. Some victims in regional areas, from Townsville to Bunbury, have found that local police are increasingly familiar with digital fraud and can refer complex cases to specialist units.
If the fraud involved a Buy Now Pay Later provider such as Afterpay or Zip, contact that provider directly as well, because separate accounts can be opened in your name using stolen credentials. Each provider you use has its own fraud team, and reporting once to your bank is not always enough to cover every account that has been touched.
Prevention is cheaper than recovery. After the dust settles, take time to harden the everyday habits that protect your finances. Turn on two-factor authentication for your banking app and email, and use a unique password for each account. A password manager is worth the small subscription cost, especially if you also hold accounts with smaller institutions like credit unions and neobanks that may not yet offer biometric login on every device.
Review your transaction alerts. Most Australian banks let you choose a low threshold — say, every transaction over one dollar — so you receive a real-time notification. This single habit catches most fraudulent activity within minutes rather than weeks. Be cautious with the links you click, particularly in SMS messages claiming to be from AusPost, myGov or your bank, because phishing remains the leading entry point for account takeover. Scammers sometimes build convincing copies of lending platforms or shopping sites that harvest your banking details at checkout, which is why it pays to confirm that any financial app or service you use appears on an official register — a directory of approved lenders shows how transparency in provider lists typically works.
You should also check your credit report at least annually through Equifax, Experian or Illion. Because identity theft sometimes shows up as a credit enquiry rather than a bank transaction, this step catches problems your statement alone would miss. Set a calendar reminder each year, and review any enquiry you do not recognise straight away.
Refunds are not always instant. Banks in Australia typically complete investigations within 30 to 45 days, though straightforward cases are often resolved in under a fortnight. While you wait, monitor the disputed account closely for any further activity and keep using a different card for everyday spending. If the outcome is unfavourable, escalate to AFCA before accepting the result. AFCA decisions are binding on the bank, and many cases that initially look unwinnable are reversed on appeal.
Beyond the money, dealing with fraud can leave you feeling exposed, particularly if the losses were large or the breach involved personal identity documents. Give yourself time to absorb the experience and talk to someone you trust, whether that is a family member, a friend in Melbourne's inner west, a colleague in Adelaide, or a counsellor through your employer's employee assistance programme. Practical steps like setting up a separate everyday account with a small balance, leaving your main savings in a higher-tier account with restricted withdrawals, can restore a sense of control over your financial life going forward.
Australians who treat their bank account the way they treat a front door — kept locked, watched over and used carefully — almost always come out ahead. If you spot something odd today, take the first step tonight: freeze the card, change the password, and start the conversation with your bank. The sooner the system is alerted, the better your chances of walking away with your money and your peace of mind intact.