Bank Won’t Refund an Unauthorised Transaction? Here’s How to Make Them

Money left your account and you didn’t send it. Maybe your card was skimmed, maybe your details were stolen in a data breach, maybe a scammer convinced you to “verify” something. You reported it within hours. And the bank’s response was a form letter: “Our investigation found the transaction was authorised. Your claim has been declined.”

That letter is often wrong, and banks know it. The rules on unauthorised transactions are written down, the burden of proof is mostly on the bank, and there’s a free ombudsman that overturns these decisions every week.

Your rights

• The ePayments Code. Administered by ASIC, subscribed to by every major bank. Under the Code, you are not liable for unauthorised transactions where: the loss was caused by the bank’s or a merchant’s fraud or error; the transaction happened before you received your card or PIN; it happened after you reported the loss/theft/compromise; or it was a forged, faulty, expired, or cancelled device. Where the bank claims you contributed (e.g. shared your PIN), the bank must prove it on the balance of probabilities. Even then, your liability is capped (generally $150 for daily-limit-type breaches) unless you were grossly negligent.
• Chargeback rights under card scheme rules. For Visa, Mastercard, and Amex transactions, your bank must raise a chargeback where you have grounds (fraud, goods not received, not as described). The bank can’t refuse to try just because it’s inconvenient. Time limits are typically 120 days.
• The Banking Code of Practice. Banks must act fairly, investigate complaints properly, and respond within set timeframes (generally 30 days, 21 days for hardship).
• Scam obligations. Under AFCA’s approach and the new Scams Prevention Framework, banks are expected to have reasonable scam detection and to intervene on unusual transactions. Where they didn’t, AFCA has ordered banks to reimburse scam victims, particularly where the bank ignored red flags or failed to act quickly once notified.
• Australian Consumer Law. Financial services are largely excluded from the ACL, but the ASIC Act 2001 has mirror provisions on misleading conduct and unconscionable conduct (ss 12DA, 12CB).

What to do right now

1. Report and block immediately if you haven’t. Every hour matters for recovery. Get the report reference number.
2. Request the bank’s written reasons. Ask specifically: what evidence do they rely on to say the transaction was authorised? Under the ePayments Code they have to tell you.
3. Write your timeline. When you last used the card, where, when you noticed, when you reported, what the bank said. Include any scam messages, calls, or emails (screenshots).
4. Lodge an internal dispute resolution (IDR) complaint. Use the word “complaint”, in writing, to the bank’s complaints team (not the branch). Cite the ePayments Code clauses. They have 30 days.
5. Send a Letter of Demand. A formal letter citing the specific ePayments Code provisions, the bank’s burden of proof, the Banking Code timeframes, and a deadline before AFCA tends to get the decision reviewed by someone senior rather than the fraud team that declined it.
6. Go to AFCA. If the bank doesn’t fix it within 30 days (or says no), lodge with the Australian Financial Complaints Authority. Free, online, binding on the bank up to $1 million+. AFCA applies the ePayments Code and regularly finds against banks on “authorised” determinations.
7. Report the scam. Scamwatch (ACCC), ReportCyber (police), and IDCARE for identity support.

“But you gave them the code”: scams vs. unauthorised transactions

Banks draw a line between an unauthorised transaction (someone else used your card or account without your involvement) and an authorised push payment scam (you were tricked into sending the money yourself). The rules differ, and the bank will try to put you in the second category whenever it can.

• Unauthorised (skimming, stolen card details, account takeover, SIM swap): the ePayments Code applies and you’re generally not liable unless the bank proves you were grossly negligent or breached the pass code rules. “You must have shared your PIN” is not proof.
• Scam where you were manipulated into approving a transaction: the ePayments Code is less helpful, but AFCA looks at whether the bank met its own obligations: did it warn you, did it flag an unusual payment, did it act promptly to recall funds once you reported it, did it have reasonable scam controls? Banks have been ordered to reimburse in full or in part where they failed.
• Remote access scams (“your computer has a virus”): where the scammer used remote access to make the transaction, AFCA has frequently treated it as unauthorised.

Timing is your friend. Banks are expected to attempt recall of funds from the receiving bank immediately. If you reported within hours and the bank waited days, the delay itself is a basis for compensation.

The “goodwill” offer. Banks sometimes offer 50% “as a gesture” with a release. You don’t have to accept it. AFCA determinations often award 100% where the bank’s evidence is thin.

Credit vs. debit. The rules are the same, but credit card fraud is often refunded faster because the bank’s own money is at stake. If a debit card fraud is stalling, cite the ePayments Code clauses directly.

Who to complain to

Australian Financial Complaints Authority (AFCA) is your main avenue. ASIC for ePayments Code and misconduct reports. Scamwatch and ReportCyber for the scam itself. If the transaction was through a non-bank payment provider (PayPal, Afterpay, a crypto exchange), they’re also AFCA members and the same process applies.

Start your claim — $49

Claim Done drafts your Scam Recovery Letter in about 5 minutes for $97. Tell us what happened — we handle the legal language.

Start My Claim — $97 →

You approve it before anything is sent.