How to get your money back after a scam payment

An unauthorised transaction is money moved out of your account without your permission — a stolen card, a compromised login, a payment made by someone who got your codes. Moneysmart defines it exactly that way: someone transferring money from your account without your permission. This is the strongest position you can be in, because the ePayments Code sets rules for who bears the loss and the default is not you.

A mistaken transaction is a payment you made deliberately but to the wrong account — you keyed a digit wrong, you used an old BSB, you paid an invoice whose bank details had been altered. Moneysmart's definition is paying the wrong person or company by using the wrong bank details. This has its own recovery machinery under the Code, run between the sending and receiving institutions rather than through a liability argument.

An authorised payment procured by deception is the third and by far the commonest scam case. You were shown a fake invoice, a fake investment portal, a fake romance, a fake bank employee telling you to move funds to a 'safe' account. You typed the details, you approved the payment, and the transaction is genuine in every technical sense. Historically this category had the weakest protection of the three, because nothing was unauthorised and nothing was keyed incorrectly.

The boundaries between the three are not always where you expect. If a scammer using remote access software moved money while you watched the screen, that is closer to unauthorised than authorised. If you paid a real supplier's real invoice but a criminal had intercepted the email and swapped the account details, that is payment redirection — the National Anti-Scam Centre recorded $166.8 million of it in 2025 — and it sits awkwardly between mistaken and authorised, which is precisely why it is worth arguing about.

Write down which category you are claiming and why, before you call. Banks triage on this classification, and a claim that drifts between categories during the call gets handled as the weakest of them. If you genuinely do not know — for example, you shared a one-time code under pressure and are not sure what was done with it — say so plainly and ask the bank to establish from its own logs which of its systems authenticated the payment.

Keep the raw material. Screenshots of the messages, the phone number that called you, the website address, the invoice as it arrived and the invoice as it should have read, the exact times. Every subsequent step — the bank's internal review, an AFCA complaint, a police report, a civil claim — runs on the same evidence, and it is far easier to gather on day one than on day sixty.

Call the fraud line, then follow up the same day in writing through internet banking or email. The phone call starts the clock; the written record proves when. Moneysmart's advice is blunt about why this matters — the sooner you contact your bank, the more likely you are to get your money back, and where the transaction is unauthorised the sooner the bank can stop further transactions.

Ask for five specific things and name them: an attempted recall of the payment, a trace of where the funds went, a block on further payments to that payee, a review or freeze of the account if your credentials or device were compromised, and a written complaint reference number. Moneysmart specifically tells you to get a reference number when you report a mistaken or unauthorised transaction, because you will need it every time you contact them again.

The recall is not a phone call between two managers. Under the Australian Banking Association's Scam-Safe Accord, all ABA and Customer Owned Banking Association members committed to joining the Australian Financial Crimes Exchange and the automated Fraud Reporting Exchange — the FRX being, in the ABA's own words, the system used to recover money that customers have paid to another account. When your bank raises a recall, it is putting a request into that shared system for the receiving bank to freeze what remains.

That is why hours matter more than days. The FRX can only freeze funds that are still sitting in the receiving account. Scam proceeds are routinely broken up and moved through several mule accounts within minutes, or converted to cryptocurrency, and once they have left the regulated banking system the ABA itself describes recovery as virtually impossible. A recall raised on the same morning has a materially different prospect from one raised the following week.

Ask, in writing, what the bank's own systems did before the payment left. The Scam-Safe Accord also committed retail banks to a confirmation-of-payee name-checking system, to increased warnings, payment delays and security questions when you pay someone new or raise a limit, and to limiting payments to high-risk channels including some crypto platforms. If none of that fired on a large, out-of-character payment to a brand-new payee, that is a question the bank has to answer, and it becomes the spine of any later complaint.

Do not accept a verbal decline. Ask for the outcome in writing, with the reason, and for the internal dispute resolution reference. Banks are required to have an internal dispute resolution process, and Moneysmart's instruction is explicit: your first step is a formal complaint through that process, and only then can you take it to AFCA.

Finally, secure the rest of the account. If you shared a password, a one-time code, or gave anyone remote access to your device, the bank should be treating the account as compromised rather than treating one payment as an isolated event. Say the words 'remote access' if they apply — Moneysmart lists remote access scams as one of the three main banking scam types, and it changes how the claim is handled.

ASIC's ePayments Code applies to consumer electronic payment transactions — ATM, EFTPOS and credit card transactions, online payments, internet and mobile banking, and BPAY — and it expressly sets out the rules for determining who pays for unauthorised transactions. If your institution is a subscriber, those rules are not a matter of goodwill. Check ASIC's subscriber list if you are unsure whether yours has signed up.

Moneysmart sets out the circumstances in which you are more likely to get your money back, and they read as a list of situations where the bank or a third party, rather than you, created the exposure: a forged, expired, blocked or cancelled card was used; a bank employee or a seller made the transaction fraudulently; the transaction happened before you received your card, PIN or password; a seller debited your account more than once; the transaction happened after you told the bank your card was lost or stolen; or after you told the bank someone may know your PIN or password.

The catch-all in that list is the most important line in the whole area: you are more likely to be reimbursed where it is clear that you have not contributed to the loss. That is the pivot. The argument in an unauthorised transaction case is almost never about whether the transaction happened — it is about whether you contributed to it, and the practical burden of showing that you did sits with the bank.

Moneysmart is equally clear about where you lose. You are less likely to get your money back if you acted fraudulently, did not keep your PIN or password secret, unreasonably delayed telling the bank your card was lost or stolen, unreasonably delayed telling the bank that someone else may know your PIN or password, or left your card in an ATM. Three of those five turn on delay or on secrecy of credentials, which is why the first call and an honest account of what you disclosed both matter so much.

The soft spot in most real cases is the one-time code. Scammers running bank-impersonation scripts talk people into reading out an SMS code, or into approving an in-app prompt while being told it is a security check. Moneysmart's own guidance is that while your bank may contact you about a suspicious transaction, it will never ask for online banking passwords or codes, ask you to download software, ask you to transfer money, or ask you to log in through a link in a text or email. A bank will lean on a disclosed code to argue you contributed to the loss.

That argument is not automatically fatal. Whether a disclosure amounts to contributing to a loss is a judgement, not an arithmetic result, and it is exactly the kind of judgement AFCA is set up to review. Where you disclosed a code because a spoofed number and a convincing script made you believe you were speaking to the bank's own fraud team, say so in those terms and put it in writing, because that framing is what an external reviewer will weigh.

Watch the account for a second wave. Moneysmart's advice after any compromise includes signing out of all accounts and devices, creating new and previously unused passwords, monitoring the account closely for further unauthorised transactions, requesting a temporary ban on your credit report so no new credit can be taken out in your name, and requesting a free copy of that report to check for applications you do not recognise.

If you paid the wrong account, the ePayments Code establishes a regime for recovering mistaken internet payments. This is a process rather than a liability contest — your bank contacts the receiving institution, the receiving institution investigates whether the funds are still there, and the money is returned if the rules are satisfied. You do not have to prove anybody was at fault.

Two things determine whether it works, and Moneysmart names both: how quickly you report it, and whether the unintended recipient still has enough money in their account to cover the payment. The second is outside your control, which makes the first everything. Money in an ordinary account belonging to a person who mistyped a digit tends to stay put; money in an account controlled by a criminal does not.

The timing thresholds are the part most people never hear about. Under the ePayments Code, as Moneysmart summarises it, different rules apply depending on whether you make the report within 10 business days, after 10 business days, or after seven months. Reporting inside the first threshold gives you the strongest version of the process. After seven months the position weakens considerably. Ask your bank which threshold your report falls into and have the answer recorded.

Payment redirection sits on the boundary of this category and is worth arguing carefully. If an invoice arrived with a criminal's BSB and account number because the sender's email was compromised, you used the wrong bank details — which is the literal definition of a mistaken transaction — even though the details were wrong by design rather than by typing error. Whether your bank treats it as mistaken or as an authorised scam payment materially changes the process applied, so raise the point rather than letting it be decided silently.

Where the receiving bank identifies the account holder and the funds are still there, the process can be quick. Where the account holder disputes that the payment was mistaken, or the funds have been withdrawn, it stops — the Code's machinery does not compel a stranger to hand money back if it has already gone. At that point the question becomes whether you can pursue the recipient directly, which is dealt with further down this page.

Do not let the mistaken-payment process substitute for a complaint. If your bank declines to pursue a recovery, delays past a threshold, or cannot tell you what the receiving institution said, that is itself a complaint about the bank's conduct — separate from whether the money comes back — and Moneysmart specifically directs people to internal dispute resolution and then AFCA where their institution is not doing enough to help retrieve mistaken payments.

This is the category most scams fall into, and until recently it was close to a dead end. You approved the payment, the bank executed the instruction you gave, and the ePayments Code liability rules — built around transactions you did not authorise — have nothing direct to say. AFCA's own framing of the problem is stark: in 2023 Australians lost over $2.74 billion to scams and 65 per cent of victims received no refund or remedy.

The Scams Prevention Framework Act 2025 was the response. It amends the Competition and Consumer Act 2010 to create an economy-wide regime under which the Minister designates sectors — beginning with banks, telecommunications providers and digital platform services covering social media, paid search engine advertising and direct messaging — and requires participants in those sectors to have measures to prevent, detect, report, disrupt and respond to scams. Treasury describes the design as deliberately whole-of-ecosystem, with tough penalties for non-compliance and dispute resolution pathways for consumers to seek redress.

The redress pathway is AFCA, and its timing needs to be understood precisely because it is easy to misread. AFCA has been authorised as the single external dispute resolution scheme for scam complaints under the Framework from 1 July 2026. Designated organisations must be AFCA members from 1 September 2026. But consumers and small businesses can only make an SPF scam complaint to AFCA from 31 March 2027, and AFCA states plainly that it has no jurisdiction to consider SPF complaints about matters occurring before that date.

The change that helps a scam victim today is a different one. AFCA's Rules were amended with ASIC's approval and took effect on 12 March 2026, expanding AFCA's jurisdiction to consider complaints involving receiving banks and mule accounts in scam complaints. Before that, your complaint was effectively confined to your own bank. Now the institution that opened and operated the account the money landed in can be brought into the same case, and its account-opening and monitoring conduct examined.

That reframes how you should write the complaint. Rather than only asking whether your bank should have stopped you, ask whether the receiving bank should have allowed the account to exist and to receive the payment. Name the receiving institution if you know it — it appears on your transaction record and your bank's trace should confirm it. Moneysmart now says this in terms: you can make a complaint against your bank, or a receiving bank, if you think they contributed to your loss.

Build the case on conduct, not sympathy. The Scam-Safe Accord commitments give you a concrete standard to measure against: confirmation-of-payee name checking, biometric checks for new online account openings at major banks, increased warnings and payment delays and security questions on new payees and raised limits, shared intelligence through the AFCX and FRX, and limits on payments to high-risk channels. Set out which of those should have fired on your payment and did not, on either side of the transaction.

Expect the argument to be about apportionment rather than a binary. AFCA says it will only provide a remedy where it decides you incurred loss or harm caused by the financial firm's conduct, and that it seeks either to put you in the position you would have been in had that conduct not caused the loss, or to compensate you to the extent it holds the firm responsible. Partial outcomes are normal, and a partial recovery is still a recovery.

If you paid a scammer by credit or debit card, you have a second and independent route: a chargeback through the card scheme rules, raised by your bank against the merchant's bank. Moneysmart's instruction for card payments is the same as for transfers — contact your card provider immediately, ask them to stop any transactions and ask what other action to take — but the chargeback mechanism itself runs on scheme deadlines rather than the ePayments Code, so it has its own clock. Raise both claims, not one.

Cryptocurrency is the hardest rail. Moneysmart's guidance where you have paid a scammer in crypto is to report it to the platform, virtual asset service provider or digital currency exchange you used, and that is essentially the whole of the remedy — there is no scheme reversal and no code-based recovery regime. The Australian Banking Association's own description of why banks now limit payments to some crypto platforms is that once money has moved to these higher-risk channels it is virtually impossible to recover.

That does not make the report pointless. A registered Australian exchange holds identity records and can freeze a receiving wallet if it is still holding the funds and is told fast enough, and the report becomes evidence for the argument that your bank should have applied high-risk channel limits before the transfer left. Report it the same day, in writing, and keep the transaction hash.

Money transfer apps and remittance channels sit in between. Moneysmart directs you to report to the app provider — the seller or developer, not the app store — and the same speed logic applies, because these services settle quickly and the funds are collected at the other end. Where the transfer went overseas through a remittance provider, ask both your bank and the provider to attempt a recall and ask each of them to confirm in writing whether the payout has been collected.

Gift cards are reported to the company that issued the card, and cash sent by mail or courier is chased by asking Australia Post or the delivery service to intercept the package. Both are long odds, and both depend on the funds or the parcel not yet having been collected. Neither has any dispute mechanism behind it, which is the practical reason scammers ask for them.

Whatever the rail, put the request in writing and keep the timestamp. A refusal from a crypto exchange, remittance provider or gift card issuer is not the end of the matter — whether your bank should have intervened before the money reached that rail survives the refusal, and that question is one AFCA can decide.

Moneysmart sets the sequence out plainly for both unauthorised transactions and mistaken payments: if you feel your financial institution is not doing enough, or is unwilling to refund unauthorised transactions you believe should be refunded, your first step is a formal complaint through its internal dispute resolution process, and if you are unhappy with that you take the complaint to AFCA. Skipping the internal step tends to send the file straight back.

Write the internal complaint as a document, not a phone call. State the transaction date, amount, payee and receiving institution; state which of the three categories you say it falls into and why; set out what you asked the bank to do and when; identify the specific controls that did not operate; and state the outcome you want. Ask for a final response in writing. That document becomes the AFCA complaint almost unchanged.

AFCA is free, fair and independent, funded by financial firms rather than by complainants, and it covers banking deposits and payments among its complaint categories. Making a complaint online takes roughly 30 to 50 minutes and you can save your progress and return to it. You can also complain by phone on 1800 931 678, by email, or in writing, and you can appoint an authorised agent to act for you using AFCA's agent authority form.

Support is built in if you need it. AFCA publishes translated complaint forms and information in other languages, and you can reach it through the Translating and Interpreting Service on 131 450 by asking for your language and then for AFCA, or through the National Relay Service quoting 1800 931 678. None of that costs anything.

Know the limits before you lodge. AFCA states that it may not be able to help where a court has already decided the matter, where the complaint falls outside the issues its Rules allow it to consider, where it is outside the relevant time limits, or where the organisation is not an AFCA member. Time limits are the one that catches scam victims — Moneysmart's instruction is to complain to AFCA as soon as possible after your institution has finished considering your complaint, because time limits apply.

The remedies are broader than a refund. AFCA can order payment of a sum of money, the forgiveness or variation of a debt, the repayment or waiver of a fee, the variation or setting aside of a contract, and an apology, among others. It cannot impose punitive or exemplary damages. Where a scam payment was funded by a loan or a credit card the bank pushed through, the debt-side remedies can matter as much as the cash.

Determinations bind the financial firm, not you — if you reject the outcome, you keep whatever rights you had to go to court. Since the 12 March 2026 Rules changes AFCA can also publish the names of financial firms that fail to comply with its Determinations, which is a meaningful lever. If the loss has left you unable to meet repayments in the meantime, the National Debt Helpline on 1800 007 007 provides free, confidential financial counselling while the complaint runs.

Assemble one evidence file and reuse it for everything. The internal complaint, the AFCA complaint, a police report and any civil claim all draw on the same material — the transaction record, the reference numbers the bank gave you, the scam communications, and a timeline recorded in times rather than dates. A ReportCyber lodgement is worth making early because it produces the police reference number banks and credit reporting bodies ask for, and the Australian Cyber Security Hotline on 1300 292 371 operates around the clock if a device or account also needs cleaning up.

Sometimes the trace succeeds and the money is sitting in an identifiable Australian account whose holder will not give it back. This happens most often with mistaken payments and with payment redirection, and occasionally with a mule account holder who has been recruited rather than being the scammer. The banking recovery process cannot compel a stranger to return funds once they dispute it, but a court can.

The claim is an ordinary civil one for money the recipient has no right to keep. It is filed in the small claims or minor civil jurisdiction of the state or territory where the defendant lives, and each jurisdiction runs its own body with its own monetary ceiling and its own filing fee. These are designed to be used without a lawyer, and the filing fees are modest relative to the amounts usually at stake.

You need the recipient's name and an address for service, which is the practical obstacle. Your bank will not hand over another customer's details on request. The routes that do work are a court order for the information, or the receiving bank disclosing it as part of a mistaken payment recovery, or the recipient identifying themselves when contacted through their bank. Ask your bank in writing what it can lawfully tell you and what it needs to see before it will.

Be realistic about which cases are worth it. Pursuing a genuine mistaken recipient who has spent the money is usually a matter of an enforceable judgement and a payment plan. Pursuing a professional mule account is usually pursuing someone with no assets, an address that no longer exists, and often another victim of the same scam. A judgement you cannot enforce costs you the filing fee and months of effort.

Run the civil claim in parallel with the bank complaint, not instead of it. AFCA cannot consider a complaint a court has already decided, so sequencing matters — but a claim against a third-party recipient is a different matter from a complaint about your bank's conduct, and pursuing the recipient does not usually close off the AFCA route against the bank. If you are unsure, ask AFCA before you file.

Finally, guard against the second scam. Moneysmart's warning list is specific: after a loss you may be approached by someone offering to help recover what you lost, offering to swap your investment for another one, offering to buy your shares at a premium if you pay a fee to lift 'restrictions', or claiming they can recover your losses for a percentage or for a payment described as a tax, deposit, retainer or refundable insurance bond. These are strategies to take more money from you. No legitimate recovery route in Australia — not your bank, not AFCA, not the courts' filing process — is sold to you by someone who contacts you first.