Got Scammed Online? How to Get Your Money Back in Australia

If you have been scammed in Australia, call your bank or card provider straight away and ask it to stop the payment and try to recover it; the sooner you report, the better your chances. Banks do not refund every scam loss. Your rights depend on how the money left your account, but if your bank says no you can make a formal complaint and then take it to the Australian Financial Complaints Authority (AFCA), which is free. Report the scam to Scamwatch and, where money or personal information was stolen, to police through ReportCyber.

What to do in the first hour after a scam

Scamwatch says there is no shame in being scammed. What matters now is speed:

1. Stop paying and cut contact. Do not send any more money, and block the scammer.
2. Call your bank or card provider. Use the number on its official website or the back of your card. Ask it to stop any transactions, and ask what else you should do. Get a reference number.
3. Secure your accounts. If you shared a password or let someone onto your device, change your passwords from a secure device and ask the bank to freeze your accounts.
4. Write down what happened. Note who contacted you, when, on which platform, what you shared and what you paid. Keep screenshots, receipts and messages.
5. Report it. Report the scam to Scamwatch, and report the theft to police online through ReportCyber.
6. Get identity help if you need it. If the scammer has your personal details, call IDCARE on 1800 595 160 for a free recovery plan.
7. Complain in writing if refused. Make a formal complaint to the bank, then to AFCA.

Do banks refund scam victims in Australia?

Sometimes, but not automatically. The answer turns mainly on one question: did you make the payment, or did the scammer?

If the scammer moved the money without your permission

Moneysmart defines an unauthorised transaction as someone transferring money from your account without your permission. This can happen after a phishing message or a remote access scam, where the scammer gets your login details and moves the money themselves. If your bank subscribes to the ePayments Code, which most banks, credit unions and building societies do, the Code sets the rules for who pays for unauthorised transactions.

Moneysmart says you are more likely to get the money back if it is clear you did not contribute to the loss, or the transaction happened after you told the bank someone may know your PIN or password. You are less likely to if you did not keep your PIN or password secret, or you unreasonably delayed telling the bank. Our guide on what to do when your bank won’t refund an unauthorised transaction covers this in more detail.

If you made the payment yourself

Many scams trick you into pressing send yourself, such as a fake investment or a caller pretending to be your bank. Because you made the payment, the unauthorised transaction rules may not help. That does not end the matter. Moneysmart says you can complain about your bank, or the bank that received the money, if you think it contributed to your loss. Explain what you think the bank did wrong, such as how it handled warnings, holds or recovery.

How you paid also decides who to contact first. Moneysmart’s scam and online shopping guidance is summarised below.

How banks can help recover money sent by fast transfer

Speed matters most here. Ask your bank to contact the receiving bank and try to freeze and recover the funds.

Under the banking industry’s Scam-Safe Accord, the Australian Banking Association says all its members and Customer Owned Banking Association members have joined shared fraud systems used to track down, freeze and return money customers have paid to another account. The ABA also says retail banks now use name-checking (Confirmation of Payee), add warnings and delays on payments to new payees, and limit payments to some high-risk channels, including some crypto platforms. The Accord page does not say banks will reimburse scam losses.

Do not confuse a scam with a mistaken payment. Moneysmart describes a mistaken transaction as paying the wrong person by using the wrong bank details, and under the ePayments Code different rules apply depending on whether you report it within 10 business days, after 10 business days, or after seven months. Ask your bank which process it is applying to your case.

For specific scams, see our guides to Facebook Marketplace scams, online shopping scams, rental listing scams and crypto investment scams.

How to report a scam in Australia

Reporting creates a record and helps stop the scammer reaching others. These services are free:

• Scamwatch (run by the National Anti-Scam Centre): report any scam. With your consent, your report can be used to get scam websites and ads taken down.
• ReportCyber: if you lost money or shared personal information through an online scam, report it online at cyber.gov.au; reports are sent to police for review. Keep any reference number for your bank complaint.
• IDCARE: Australia and New Zealand’s national identity and cyber support service. IDCARE can help you make a free plan if your identity documents or logins were exposed.
• The platform: report the scammer’s profile, listing or ad to the site or app where they found you.

Watch out for follow-up scams. Moneysmart warns that anyone offering to recover your losses for a fee or a percentage is using a scammer’s strategy. If the loss has left you in debt, a financial counsellor can help for free.

Complaining to your bank, then to AFCA

If your bank refuses to reimburse you, or you are unhappy with how it handled the scam, make a formal complaint through its internal dispute resolution process. Put it in writing, use the word “complaint” in the heading, set out the facts in date order, attach your evidence, and say what you want: the amount lost and how you want it repaid. AFCA’s tips on internal dispute resolution set out the same approach. Our guide to complaining about your bank and going to AFCA walks through the process.

Under ASIC’s Regulatory Guide 271, a financial firm must give its response to a standard complaint no later than 30 calendar days after receiving it, with some exceptions. It should tell you about your right to go to AFCA.

If you are not satisfied, complain to AFCA online, by phone on 1800 931 678, by email or by post. AFCA is free, fair and independent. AFCA’s time limits are, for most complaints, six years from when you first became aware (or should reasonably have become aware) of the loss, or two years from your bank’s internal dispute resolution response, whichever comes first. AFCA may extend these if it thinks there are special circumstances. It generally tries to reach a settlement first and, if that fails, it can make a decision; if you accept that decision, the bank must comply.

Our Scam Recovery Letter turns your answers into a formal demand to your bank and an AFCA complaint for you to check and lodge yourself if the bank says no.

The Scams Prevention Framework: what has started and what has not

The Scams Prevention Framework Act 2025 commenced on 21 February 2025. It adds a framework to the Competition and Consumer Act 2010 that requires businesses in designated sectors to prevent, detect, disrupt, report and respond to scams. Banks, telecommunications providers and some digital platforms have been designated.

It is not fully in force yet. The ACCC says most obligations apply from 31 March 2027, and that the codes and rules are still being developed. AFCA says it can only consider complaints under the Framework about matters that occur on or after 31 March 2027. Scams that happened before then are still handled through the bank and AFCA under existing law, which is the process set out above.

Frequently asked questions

Do banks refund scammed money in Australia?

Not automatically. If the scammer moved the money without your permission and your bank subscribes to the ePayments Code, the Code’s unauthorised transaction rules decide who bears the loss, including whether you contributed to it. If you made the payment yourself, you can still ask the bank to recover it and complain if you think it contributed to the loss.

Can I recover money transferred in a phishing scam in Australia?

Possibly. If the scammer used details taken through a phishing message to move money themselves, report it to your bank as an unauthorised transaction straight away and ask it to freeze your accounts. Moneysmart says you are less likely to get it back if you did not keep your password secret or you delayed telling the bank.

How long does my bank have to respond to a scam complaint?

For a standard complaint, ASIC requires a final response no later than 30 calendar days after the bank receives it, with some exceptions. If it misses that or you disagree with the answer, you can go to AFCA.

Is AFCA free, and is there a deadline?

Yes, AFCA is free. For most complaints, lodge within two years of the bank’s final response or six years from when you became aware of the loss, whichever comes first.

Is someone offering to get my scam money back legitimate?

Be very careful. Scamwatch, Moneysmart and cyber.gov.au all warn about people offering to recover your losses, including for a fee or a percentage. The free routes are your bank, AFCA, Scamwatch, ReportCyber and IDCARE.

Claim Done prepares your bank demand and AFCA complaint from your answers for you to check, download and send to your bank yourself. It costs $97 for both documents. It is not legal advice, and Claim Done does not represent you.