Unauthorised Transaction on Your Account? How to Dispute It

If money has gone from your account or card that you did not authorise, report it to your bank
straight away and put your dispute in writing. Under the ePayments Code, the account holder is generally not liable for
a transaction they did not authorise, unless an exception applies. Reporting quickly protects your position — an
unreasonable delay is one of the few things that can shift liability onto you.

What to do

1. Call your bank’s official fraud line now. Use the number on the back of your card or on your
   statement, never a number from a text or email. Report the unauthorised transaction, ask them to block the card or
   account so it cannot happen again, and ask for a reference number.
2. Put your dispute in writing. A written dispute locks in your transaction details and the date
   you raised it. State clearly that you did not make or authorise the transaction and did not benefit from it, and ask
   the bank to investigate and reimburse it.
3. Know your position under the ePayments Code. The ePayments Code is a voluntary code
   administered by ASIC that most banks subscribe to. For a transaction you did not authorise, the account holder is
   generally not liable — unless an exception applies, such as voluntarily sharing your PIN, passcode, password or
   one-time codes, giving someone remote access, unreasonably delaying your report, or being a party to the fraud. A
   subscribing bank must investigate and apply the Code’s liability rules, and commonly advises the outcome within about
   21 days.
4. For a card transaction, ask for a chargeback. This is a separate right to reverse a disputed
   card payment through the card scheme, with its own time limits, so ask early.
5. Report the cybercrime and the scam. Report to ReportCyber at cyber.gov.au or 1300 CYBER1, and
   to the National Anti-Scam Centre at scamwatch.gov.au. This helps authorities disrupt it even if your own money cannot
   be traced.
6. Secure your accounts. Change the passwords and PINs on your banking, email and any exposed
   accounts, ask the bank to reissue affected cards, turn on multi-factor authentication, and if you gave anyone remote
   access have the device checked. If you are in immediate danger, call 000.
7. If the bank refuses or does not resolve it, escalate to AFCA (the Australian Financial
   Complaints Authority), the free external dispute resolution scheme. From 12 March 2026 AFCA can also examine the
   receiving bank and the ‘mule’ account the money was sent to, even if you are not a customer of that bank.

Warning — money-recovery scams. After an unauthorised transaction you may be contacted by someone
claiming they can get your money back, sometimes pretending to be from the police, a government agency, a bank, a law
firm or a ‘fund recovery’ service. People who have already lost money are deliberately targeted. This is almost always a
second scam. Never pay an upfront fee, hand over more money, give remote access, or share codes or logins with anyone
who contacts you promising to recover your money. Legitimate agencies will not ask you to pay to get your money back.

Do it yourself, or have it drafted

You can write to your bank yourself for free. If you would rather have it done properly and fast, Claim Done drafts
two documents for a flat $49: a formal dispute to your bank or card provider raising the ePayments
Code and a chargeback where it applies, and a plain-English step-by-step action guide. We cannot guarantee
reimbursement — the outcome depends on the Code’s liability rules — and we take no percentage of anything you recover.
Start your dispute.

Frequently asked questions