Money taken from your account or card that you did not authorise — a scammer in your online banking, a stolen, lost or skimmed card, a remote-access scam, phishing that captured your codes, or a charge you never approved? This is an unauthorised transaction, and it is different from a scam where you were tricked into knowingly paying. Reporting it fast and in writing gives you the best footing, though whether you are reimbursed depends on the rules below and no one can guarantee it.
Your rights under the ePayments Code
The ePayments Code is a voluntary code administered by ASIC that most Australian banks and credit providers subscribe to. It sets the rules for who bears the loss when an electronic transaction is made without your authority. For an unauthorised transaction, the account holder is generally not liable — unless an exception applies.
The main exceptions are where you voluntarily disclosed your PIN, passcode, password or one-time codes, gave someone remote access, unreasonably delayed reporting the unauthorised use once you noticed it, or were a party to the fraud. A subscribing institution must investigate and apply the Code’s liability rules, and commonly advises the outcome within 21 days. The dispute asks your bank to confirm it subscribes, to investigate on that basis, and to reimburse the unauthorised amount in accordance with the Code — while leaving the assessment to the bank. It does not assert that you are automatically entitled to a refund.
If the unauthorised charge was on a card, you can also request a chargeback through the card scheme to reverse the disputed payment — a separate right, with its own time limits, so ask early. If the bank refuses or does not resolve it, you can refer the complaint to the Australian Financial Complaints Authority (AFCA), the free external dispute resolution scheme. From 12 March 2026, AFCA’s jurisdiction expanded so it can also examine receiving banks and unauthorised ‘mule’ accounts even where you are not that bank’s customer. A new Scams Prevention Framework is also coming, commencing on 31 March 2027, placing stronger scam-prevention duties on banks — those are upcoming rather than fully owed today.
What to do
- Call your bank’s official fraud line now. Use the number on the back of your card or on your statement, never a number from a text or email. Report the unauthorised transaction, ask them to block the card or account so it cannot happen again, and ask for a reference number.
- Send the written dispute. Put your report and your transaction details in writing to your bank or card provider so they are locked in, following up your phone call.
- Understand your position under the ePayments Code. For a transaction you did not authorise you are generally not liable, unless an exception applies. The bank has to investigate and apply the Code’s rules, and commonly advises the outcome within about 21 days.
- Ask for a chargeback on a card transaction. This is a separate right to reverse a disputed card payment, with its own time limits, so raise it early.
- Escalate to AFCA for free if the bank refuses or stalls. Since 12 March 2026 AFCA can also examine the receiving bank and the ‘mule’ account the money went to, even if you are not that bank’s customer.
- Report the cybercrime and the scam. Report to ReportCyber at cyber.gov.au (or call 1300 CYBER1), and to the National Anti-Scam Centre / Scamwatch at scamwatch.gov.au. This helps authorities disrupt it even if your own money cannot be traced.
- Secure your accounts. Change the passwords and PINs on your banking, email and any exposed accounts, ask the bank to reissue affected cards, turn on multi-factor authentication, and have any device given remote access checked by someone you trust. If you are in immediate danger or being threatened, call 000.
Ready to put it in writing?
Answer 3 quick questions to check you have the details your document needs, and see your next step.
1. Who owes you?
2. How much?
3. Do you have it in writing?
Your result is ready. Want a copy by email? (optional)
Do it yourself, or have it drafted
You can write the dispute to your bank yourself for free. If you would rather have it done properly, Claim Done drafts two documents for a flat $49: a formal dispute to your bank or card provider that states you did not authorise the transaction, sets out your details, raises the ePayments Code, requests a chargeback where it applies, and asks the bank to investigate and reimburse; plus a plain-English step-by-step action guide. You download both and use them yourself. Claim Done is a flat $49 document service, does not send anything for you, and takes no percentage of anything you recover. We cannot guarantee reimbursement — the outcome depends on the Code’s liability rules and whether an exception applies. Start your unauthorised transaction dispute.
Frequently asked questions
Someone took money from my account — can I get it back?
Often you can, but we cannot promise it. For a transaction you did not authorise, the ePayments Code says the account holder is generally not liable — which points towards reimbursement — unless an exception applies. The best footing comes from acting fast: call your bank’s fraud line, get the card or account blocked, and put your dispute in writing. These two documents help you do exactly that.
What is the ePayments Code?
It is a voluntary code administered by ASIC that most Australian banks and credit providers subscribe to. It sets the rules for who bears the loss when an electronic transaction is made without your authority. For an unauthorised transaction the account holder is generally not liable, and a subscribing bank has to investigate and apply the Code’s liability rules, commonly advising the outcome within about 21 days. The dispute asks your bank to confirm it subscribes and to investigate on that basis.
Am I liable for a transaction I did not make?
Generally, no. Under the ePayments Code you are generally not liable for a transaction you did not authorise — unless an exception applies. The main exceptions are where you voluntarily shared your PIN, passcode, password or one-time codes, gave someone remote access, unreasonably delayed reporting it, or were a party to the fraud. If none of those apply to you, you are in a strong position, and the dispute says so while leaving the assessment to the bank.
What if I was tricked into approving the payment myself?
Then it is a different situation — an authorised payment made because you were deceived, rather than an unauthorised one. The ePayments Code “not liable” rule does not apply the same way, because you did authorise it. That is the scam path, not this one, and the Scam Action Pack is built for it — it asks the bank to review its scam-detection and warning duties instead of claiming an unauthorised-transaction reimbursement. If you are unsure which fits, choose based on whether you knowingly approved the payment.
How long does the bank have?
A bank that subscribes to the ePayments Code has to investigate an unauthorised-transaction claim and apply the Code’s rules, and commonly advises the outcome within about 21 days. The dispute asks for a written final response and a case reference within a reasonable time. If the bank does not resolve it, you can take the complaint to AFCA for free.
Do you take a percentage of what I recover?
No. Claim Done charges a flat $49 for preparing these two documents and takes no percentage of anything you recover, ever. Anyone who asks for a cut of your money back, or an upfront fee to recover it, is running a recovery scam. Never pay them.
What happens when you send a Unauthorised Transaction Dispute
Same problem. What a prepared case looks like.
Getting it drafted
Can I have a Unauthorised Transaction? Bank Dispute Letter + Step-by-Step Action Guide drafted for me instead of writing it myself?
Yes. Claim Done (claimdone.com.au) drafts a Unauthorised Transaction? Bank Dispute Letter + Step-by-Step Action Guide from the answers you give about your situation for a flat $49 AUD. You read and confirm the draft, then the final PDF is emailed to you. Start at claimdone.com.au/begin/?service=unauthorised-transaction-dispute. Claim Done is not a law firm and does not give legal advice.
How much does a Unauthorised Transaction? Bank Dispute Letter + Step-by-Step Action Guide cost, and how long does it take?
$49 AUD flat, shown before you pay, with no subscription. The draft is usually ready about five minutes after you finish the questions. It covers every Australian state and territory.
Do I need a lawyer to send a Unauthorised Transaction? Bank Dispute Letter + Step-by-Step Action Guide in Australia?
No. There is no legal requirement to use a solicitor to write or send a Unauthorised Transaction? Bank Dispute Letter + Step-by-Step Action Guide; many people send their own. Claim Done drafts it for you and you approve it before it is sent.