You reported a transaction you say you never made or never authorised, and your bank has come back with a no. That decision is rarely the end of the road, but the next step matters. Australian banks must run an internal dispute resolution process, and if you are unhappy with how that process ends, you can take the complaint to the Australian Financial Complaints Authority (AFCA).
This guide covers three things in order: what the bank's decision actually says, how to use internal dispute resolution properly, and how to escalate to AFCA with the right documents ready.
Start with what the decision actually says
Before you escalate, get the reason in writing. A phone message or an app notification saying "claim declined" is not enough to build a case on.
Ask the bank to confirm in writing:
- which transactions were declined and why
- what evidence it relied on (for example, whether the payment passed 3-D Secure or a one-time passcode was used)
- whether it considers the transaction authorised, mistaken, or the result of a scam
- what your review options are, and by when
Practical interpretation: banks usually rely on one of a handful of arguments — that the payment was in fact authorised, that you contributed to the loss by sharing a code or credential, that your device or account was compromised in a way they say you enabled, or that the report was made too late. That is an interpretation of how these disputes tend to run, not a rule. Check which argument your bank is actually making, because it tells you what evidence you need next.
If money is still leaving the account, do not wait for the dispute to play out. MoneySmart (ASIC's consumer guidance site) advises that the sooner you contact your bank, the more likely you are to get your money back, and the sooner the bank can stop any further transactions. Secure your accounts at the same time: change passwords, reissue cards, review payee lists and check two-factor settings.
Step 1: make it a formal complaint through internal dispute resolution
MoneySmart is explicit about the order of operations: "Your first step is to make a formal complaint to your financial institution via their internal dispute resolution process."
Many people never actually complete this step. They report the transaction through chat or over the phone, get a decline, and then argue about it in the same channel. That usually does not count as a formal complaint, and it can stall an escalation later.
So do the following:
- Ask for the matter to be logged as a formal complaint, not just an enquiry or a dispute case. Get the reference number.
- Put your complaint in writing. Set out what happened, when you noticed it, when you reported it, and the outcome you want (for example, a refund of the disputed amount).
- Request a written final response. This is sometimes called an IDR response or a final decision letter. You will need it for AFCA.
- Ask whether your bank has signed up to ASIC's electronic payments code (commonly referred to as the ePayments Code) and how the bank says that code applies to your claim. Confirm the code's name, current version and your bank's membership yourself — do not assume it covers your account type.
- Keep everything. Dates, names, reference numbers, screenshots, emails, call times.
While the complaint runs, respond to any request for information quickly. Delays on your side give the bank grounds to say it could not complete its investigation.
Step 2: escalate to AFCA
If the internal process finishes and you are unhappy with it — or the bank has not dealt with it in a way you consider reasonable — MoneySmart directs you to the next step: "If you're unhappy with that process, you can take your complaint to the Australian Financial Complaints Authority (AFCA)."
AFCA is the external dispute resolution scheme for financial complaints. It is independent of your bank and looks at what is fair in the circumstances, rather than only what the contract says.
Two practical points:
- Finish IDR first. AFCA generally expects the bank to have had the chance to resolve the complaint, and may refer a matter back if it has not. There are exceptions, and you should confirm AFCA's current approach directly with it rather than assuming.
- Mind the clock. MoneySmart warns: "You should complain to AFCA as soon as possible after your financial institution has finished considering your complaint, as time limits apply." Do not sit on the final response letter for months. Note the date you received it.
When you lodge, describe the outcome you are seeking in concrete terms — a specific refund, a correction to your record, or both — and attach your evidence in one go rather than in scattered emails.
Documents to prepare before you lodge
| What to gather | Why it matters |
|---|---|
| The disputed transactions: dates, amounts, merchant or payee names, reference numbers | Lets AFCA and the bank identify exactly what is in dispute |
| Your timeline: when the transaction occurred, when you noticed it, when you reported it | Timing is often central to who bears the loss |
| The bank's decline letter and any earlier correspondence | Shows the reason given and whether it changed |
| Your formal complaint reference number and the final IDR response | Evidence you completed the internal process |
| Security evidence: device details, login alerts, when and how you secured the account | Supports the argument that the payment was unauthorised |
| Any fraud or identity reports (for example, a police or cybercrime report reference) | Independent corroboration that you reported the matter |
| Merchant or platform correspondence, and any refund already received | Avoids disputing an amount that has been partly fixed |
| Statements showing the impact on you, including any overdraft or hardship | Establishes the actual loss being claimed |
Make copies, keep the originals, and write a one-page summary at the front. A decision-maker reading your file for the first time should be able to understand the whole dispute from that page.
Questions you should verify yourself
Rules, codes and time limits change, and they can differ between account types and institutions. Before you rely on any of this, check with the responsible official sources:
- AFCA's current time limits for lodging a complaint, and whether any exceptions apply to your situation. Do not guess at a deadline.
- Whether AFCA covers your product and your bank. Confirm its current scope and membership rules directly.
- Whether your bank is a signatory to ASIC's electronic payments code, which version applies, and what it says about unauthorised transactions, mistaken payments and your responsibilities as a user.
- Any current AFCA process details — how to lodge, what it costs (if anything), how long a complaint may take, and what review options exist if you disagree with the outcome. These are all matters to confirm on AFCA's own material, not to assume from this article.
Your next steps
- Secure the account today: new passwords, reissued card, reviewed payees, two-factor authentication on.
- Request the written decline reason if you do not already have it.
- Ask the bank to open a formal complaint and give you the reference number.
- Send a written complaint with your timeline, your evidence and the specific outcome you want.
- Diarise a follow-up date, and chase the final written response.
- As soon as IDR finishes, prepare your document bundle and lodge with AFCA.
- Keep a single folder with every date, reference number and attachment.
This article is general information only. It is not legal, financial, credit or migration advice, and it does not predict or promise any outcome for your complaint. Your entitlement to a refund depends on your account terms, any applicable code, and the facts of your case. Guidance and scheme rules can change — verify current details with MoneySmart (ASIC), your bank, and AFCA before acting. If money is still leaving your account, contact your bank immediately.