How to Dispute a Fraudulent Transaction with Your Australian Bank

Spotting an unfamiliar line item on your statement can stop you in your tracks, especially when the amount was charged overseas and you have not left the country. Card-not-present fraud, scams run through fake merchants and skim devices at suburban ATMs all hit Australian account holders every week, and the reaction is usually the same: panic, then a scramble to ring the bank's fraud line.

The framework for sorting things out is, fortunately, well established. Australia's ePayments Code compels banks and other payment providers to deal with unauthorised transactions promptly, and the Australian Financial Complaints Authority picks up cases that the institution refuses to resolve. With paperwork and a clear timeline, most disputes are settled within weeks rather than months.

This guide walks through the practical steps, from the first phone call all the way to a formal complaint, and points out the small habits that reduce the risk of a second incident. It is written for everyday account holders who bank with the major institutions or a digital challenger, and it sits comfortably alongside the broader lessons in a traveller's guide elsewhere on this site.

Recognising the dodgy charge before it snowballs

The faster you spot a suspicious entry, the stronger your position when lodging a dispute. Most banks allow roughly 60 to 120 days from the statement date to claim an unauthorised transaction, but the investigation almost always goes more smoothly if you raise it within the same week the amount appears. Setting up real-time alerts through your banking app, including push notifications for any purchase above one dollar, is the easiest early-warning system available.

There are some patterns worth watching. Small test charges, often under five dollars, can be a sign that a stolen card number is being validated before a larger hit is run. Likewise, recurring debits from unfamiliar subscription services, particularly ones denominated in US dollars or euros, sometimes turn out to be the residue of a leaked credential from a breached website. Cross-checking the merchant name against your email receipts or your PayPal and Apple Pay histories will usually tell you whether the entry is genuine.

If you travel often, get into the habit of opening your banking app while you are still at the airport or the servo. A quick scan of pending transactions in the arrivals hall of Sydney or on the tram back from a Melbourne footy match has caught more than one compromised card before the thief could drain the account. Anything you cannot match to a recent purchase should be flagged immediately.

Contacting the bank and lodging the formal dispute

Once you have spotted something fishy, the next step is to call the fraud hotline rather than simply emailing or using the chat function. Verbal reports, ideally followed by a written submission, create a timestamped record that the ePayments Code requires lenders to log. Have your card number, the suspicious transaction amount, the merchant name and the date of the charge ready before you dial, because the operator will need this within the first few minutes.

Most of the big four, plus the neobanks such as Up and 86 400, will freeze the card during the call and issue a replacement within five to ten business days. They will also open a formal dispute case, which usually involves filling in a signed declaration describing how you first noticed the charge and confirming that neither you nor anyone with access to your wallet made it. Some institutions let you upload evidence through secure online portals, while others still ask for a signed PDF or scanned form returned by email.

When lodging your claim, avoid speculation. Stick to facts: the date, the amount, the merchant descriptor, whether your card was in your possession, and whether you have travelled recently. If you have screenshots of the transaction from your banking app, attach them. Banks are wary of claims that read like a story, because vague language can lead the assessor to classify the loss as a scam rather than fraud, which changes which internal team handles the case.

What happens during the bank's investigation

Behind the scenes, your dispute moves through a fairly mechanical process. A caseworker examines the merchant details, looks for signs of skimming or BIN attacks, and either reimburses the provisional amount, often within five to seven business days, or holds the funds while contacting the acquirer. For amounts under a few thousand dollars, the outcome is usually one of two things: the merchant has no record of a corresponding transaction, in which case the charge is reversed, or the merchant insists the transaction was authorised, in which case the bank will typically side with you if your account shows no prior relationship with that business.

The investigation can take anywhere from 30 to 90 days depending on the complexity and whether an international scheme, such as Visa or Mastercard, needs to be involved. While it is running, keep all related statements handy, because the caseworker may ask follow-up questions about your spending patterns, your typical purchase locations or the devices you use. CBA and Westpac customers generally receive email updates at every milestone, while NAB and ANZ rely more heavily on in-app messages.

One small Australian quirk worth knowing about is that even if the dispute is decided against you, you are still entitled to receive a written explanation. Under the ePayments Code, banks must supply the reasoning on request, and this document can be useful later if you decide to escalate the matter to AFCA.

Escalating through AFCA when the bank says no

If the institution rejects your claim or drags the process beyond its own stated timeframe, the Australian Financial Complaints Authority is the next port of call. AFCA is a free, independent ombudsman service that handles disputes between consumers and financial providers, and its decisions are binding on the bank, even if you disagree with the outcome. There is no fee to lodge a complaint, although time limits apply, so it pays to start the AFCA process within months rather than years of the original incident.

The complaint itself is submitted online through AFCA's portal and works best when accompanied by the original dispute reference number, the bank's rejection letter, your signed declaration and any correspondence you can produce. AFCA will then assign a case manager who reviews the file, asks both sides for written submissions, and usually resolves straightforward unauthorised-transaction cases through a phone conciliation within 60 to 90 days.

A practical tip is to read your bank's rejection letter carefully before lodging with AFCA. Many declined claims come down to a technicality, such as the wrong date on the form or an inconsistency between your telephone script and your written statement. Cleaning up these small errors before referring the matter often leads to a quicker win and saves the hassle of a full tribunal.

Building habits that keep the next scam at bay

Once the dust settles, the cheapest form of protection is a small bundle of habits layered onto your everyday banking. Keep your banking app set to send push notifications for every transaction above zero dollars, store your card numbers in Apple Pay or Google Pay rather than typing them into websites, and use a unique pass-phrase for each shopping account so a single breach does not cascade.

Travellers in particular should consider a separate travel card with a low daily limit, leaving the main account largely untouched while overseas. The federal government's Smartraveller site recommends the same precaution, and pairing it with a quick check-in at the airport makes a meaningful difference to how quickly an unauthorised charge is noticed.

Around the home front, change the PIN every couple of years and never share it with anyone, including staff at your local branch. If your bank offers biometric login on its app, switch it on. These steps are mundane, but they line up with the kind of evidence assessors look at when assessing future claims, so a clean record of hygiene actually helps if you ever need to dispute again.

Stage	What you do	Typical timeframe	Practical tip
Detect	Enable push alerts, scan statements	Same day	Freeze the card in-app first
Report	Call fraud hotline, lodge written dispute	1–3 business days	Keep the reference number safe
Investigate	Bank reviews merchant records	30–90 days	Send all screenshots and receipts
Escalate	Refer to AFCA if the answer is no	60–90 days	Attach the bank's rejection letter
Prevent	Use tokenised wallets, separate travel card	Ongoing	Audit accounts monthly

The clearest takeaway is that disputes are won or lost on paperwork, not volume. Capture a screenshot of the transaction list the moment you suspect something is off, write down the date and time of the call to the fraud line, and keep every email. A small, well-ordered folder often makes the difference between a quick reversal and a months-long back-and-forth, especially once AFCA gets involved.