Credit card fraud, chargebacks and the ePayments Code in Australia

If there is a transaction on your Australian credit card that you did not make, or you paid for goods or services that never arrived or were not as described, contact your card issuer straight away. For disputed purchases, the issuer can raise a chargeback under the card scheme's rules (Visa, Mastercard, eftpos and others each have their own), which lets it reverse a transaction in defined circumstances and within time limits. For unauthorised transactions, the ePayments Code, a voluntary code administered by ASIC that most banks, credit unions and building societies subscribe to, sets out when you are liable and when the institution must bear the loss. Scams where you authorised the payment yourself are treated differently, so report them quickly too. If you are not satisfied with the issuer's response, you can complain free to the Australian Financial Complaints Authority (AFCA).

This guide belongs to the pitfalls, protections and official sources section. It is general information, not legal advice.

Three different problems, three different paths

Chargebacks: how they work

A chargeback is a process between your card issuer and the merchant's bank under the card network's rules. It is not a law, so the rules and deadlines are set by the scheme, and the issuer decides whether a dispute fits a valid reason code.

Common grounds:

• Goods or services not received.
• Goods significantly not as described, or faulty and the merchant refuses to deal with it.
• Duplicate charges or an incorrect amount.
• A subscription charged after you cancelled.
• A refund promised but not processed.
• A merchant that has stopped trading before delivering, in some circumstances.

Steps:

1. Contact the merchant first where safe to do so, and keep the correspondence. Many schemes expect you to have tried.
2. Contact your issuer as soon as possible, ideally within weeks. Scheme time limits are set in the card networks' own rules, are commonly counted from the transaction or expected delivery date and are often around 120 days (Visa's consumer guidance says you usually have up to 120 days), but they vary by reason and can be shorter, so do not wait.
3. Provide evidence: order confirmation, delivery tracking, cancellation emails, photos.
4. The issuer may give a temporary credit while the dispute runs, which can be reversed if the merchant successfully disputes it.
5. If the issuer declines or handles it poorly, use its internal complaint process, then AFCA.

Chargebacks are also available on debit cards that run on card networks, but the experience can differ. Credit cards have the advantage that you are disputing the bank's money, not losing your own while the dispute runs.

The ePayments Code and unauthorised transactions

The ePayments Code, last updated by ASIC in 2022, applies to institutions that subscribe to it. It covers electronic transactions including card transactions. In broad terms:

• You are not liable for losses caused by unauthorised transactions where it is clear you did not contribute to the loss, for example where fraud happened without your passcode being compromised, or after you reported the card lost or stolen.
• You may be liable if you contributed to the loss, for example by voluntarily disclosing your PIN or passcode, recording it with the card, or unreasonably delaying a report after becoming aware of the misuse. Liability rules include limits, and the institution has to prove contribution on the balance of probability.
• The Code also requires subscribers to have clear terms and complaint handling, and sets a regime for mistaken internet payments.

Card scheme "zero liability" policies may give additional protection under the card terms. Check your card's conditions of use.

Scams

If you authorised a payment because of a scam, such as a fake invoice, an impersonation of your bank or a fake investment, the ePayments Code's unauthorised transaction rules may not apply. Act fast:

1. Call your issuer using the number on the back of your card or in the app, not a number from a message.
2. Ask them to stop or recall the payment and block the card.
3. Report to Scamwatch and, for cybercrime, to ReportCyber via cyber.gov.au.
4. Contact IDCARE if personal information was compromised.
5. Consider a ban on your credit report with Equifax and Experian if identity theft is possible.

The Scams Prevention Framework Act 2025 (assent 20 February 2025) sets obligations for designated sectors. Banks, telecommunications providers and certain digital platforms were designated in 2026; ASIC says they had to be AFCA members by 1 September 2026, that most obligations commence on 31 March 2027, and that the sector codes and rules are still being finalised after Treasury consulted on drafts in mid-2026. ASIC regulates banks under the framework. Check ASIC, the ACCC and Treasury for what is in force.

Protecting a rewards card

• Turn on transaction alerts and check the app weekly.
• Use card controls to block overseas online or cash advance use when not needed.
• Use a digital wallet or virtual card number for online shopping where offered.
• Keep the limit modest; see reducing your limit.
• Never share one-time passcodes. Banks will not ask you to read one out.

If fraudulent transactions earned points, the issuer may reverse those points along with the transactions.

Frequently asked questions

Can I get a chargeback if I just changed my mind?

Usually not. A chargeback needs a valid reason under scheme rules. Change of mind is handled by the merchant's refund policy.

What if the merchant is overseas?

Chargebacks work internationally through the card network. Australian Consumer Law may not help against an overseas business, which makes the chargeback route more important.

Do I have to pay interest on a disputed amount?

Ask your issuer. Many put disputed amounts on hold or credit them temporarily during the investigation, but terms differ.

How long does an AFCA complaint take?

It depends on complexity. You must first complain to the issuer; AFCA can then consider it if you are unhappy with the outcome or the issuer did not respond in time.

Sources and where to check

• ASIC — ePayments Code and its subscribers
• Scamwatch — reporting and recognising scams
• Australian Cyber Security Centre — ReportCyber
• IDCARE — identity theft support
• Australian Financial Complaints Authority — free complaints, 1800 931 678