Credit and debit card fraud in Australia: what to do if your card is stolen — and who pays

Card fraud rarely needs your physical card. Fraud on Australian-issued cards came to $854 million in the year to 30 June 2025, according to the payments industry body AusPayNet, and most of it was card-not-present fraud — details used without the card, mainly online: $434.3 million with overseas merchants and $312 million in Australia. The ABS estimates that 2.3 million Australians, about 10 per cent of people aged 15 and over, experienced card fraud in 2024–25.

How card details get stolen

• Phishing. Scamwatch warns of fake toll-road texts with a link to pay an 'unpaid toll'; the card details you enter are then used for unauthorised transactions.
• Bank impersonation: texts that appear in your bank's genuine message thread, asking for details, a one-time code or a PIN.
• Overseas scam compounds, which AusPayNet links to the rise in overseas card-not-present fraud through SMS phishing.
• Lost and stolen cards: $74.3 million in 2024–25, up 27.9 per cent. Skimming and counterfeit cards came to $7.1 million.

Signs your card has been misused

• A payment to a person or company you don't know.
• A cash withdrawal from a place you've never been.
• A transaction on a day you didn't use your card.
• The same payment taken twice.

Transactions can take days to appear, Moneysmart notes, and the name on your statement may not match the shop's — check its trading name online.

If your card or details are stolen: first steps

1. Contact your bank or card provider straight away to block the card and stop further transactions, and get a reference number. The sooner you report, Moneysmart says, the more likely you are to get your money back.
2. Report every transaction you don't recognise. Under the ePayments Code, the bank must finish investigating within 21 days or tell you in writing that it needs longer, and finish within 45 days unless circumstances are exceptional.
3. If you entered details on a fake site, change those passwords and turn on multi-factor authentication.
4. Report it through ReportCyber at cyber.gov.au, and to Scamwatch if a scam was involved. If other personal details were taken too, contact IDCARE on 1800 595 160.

What you owe: the ePayments Code

ASIC's ePayments Code sets who pays for unauthorised transactions. It's voluntary, but binding on the businesses that subscribe — most banks, credit unions and building societies. It covers personal accounts and card transactions that aren't signed for, including ATM, EFTPOS, contactless and online payments, and the same rules apply to credit and debit cards.

Correct PIN use alone isn't proof you contributed, and your card number and expiry date aren't secrets, so how you handled them doesn't count. Most people are repaid: the ABS found that 75 per cent of card fraud victims were reimbursed by their card issuer in 2024–25, 72 per cent in full.

Chargebacks

Card-scheme chargeback rights sit alongside the Code, and a bank can't hold you liable for more than if it had used them. Under the Banking Code of Practice, if you dispute a card transaction within the scheme's time limit — recurring payments included — your bank will claim it back if you were charged incorrectly and didn't contribute to the loss. If you paid by card and didn't get what you paid for, Moneysmart says your bank may be able to give you a chargeback.

If a scammer talked you into paying

Payments you make yourself, even because a scammer tricked you, aren't unauthorised under the Code, and there's no automatic refund. AFCA asks whether an honest and reasonable banker would have seen a serious possibility of a scam and made inquiries. If the bank made no error, you'll likely bear the loss; if it did, AFCA can award all or part of it. If a scammer used your one-time code or remote access to pay, AFCA first decides whether the payment was unauthorised; if it was, the Code applies and AFCA asks whether you shared the code voluntarily. The Scams Prevention Framework Act 2025 puts new duties on banks, telcos and digital platforms, and AFCA will run the Australian Scams Ombudsman — but only for matters on or after 31 March 2027.

How to complain

1. Complain to your bank first. Under ASIC's RG 271 it must respond to a standard complaint within 30 calendar days.
2. Then go to AFCA (free, 1800 931 678) within six years of becoming aware of the loss and two years of the bank's response, whichever comes first. Since 12 March 2026 you can also complain about the bank that received the money.
3. AFCA can award direct and indirect losses, and compensation for stress where a bank missed the Code's deadlines or delayed a recall request.

How to make your card a harder target

• Don't use links in texts or emails; open the organisation's app or website yourself.
• Never share card details, passwords or one-time codes with anyone who contacts you unexpectedly — even 'your bank'.
• Keep your PIN secret, and don't keep a record of it with the card.
• Shop with sellers you trust, and pay by credit card or PayPal rather than bank transfer or crypto.
• Consider a separate, low-balance debit card for online shopping.

Can security software help?

Partly. Moneysmart says security software can block some malware and warn you about unsafe websites — the kind of phishing pages that collect card numbers. It can't block a card or dispute a charge; only your bank can.

Block the card, report every transaction you don't recognise and get a reference number. Under the ePayments Code, it's the bank that has to prove you contributed to the loss.