A charge you don't recognise on your card has two separate problems attached to it: the money has gone, and whoever took it may still have a working way to take more. Reporting fixes the second problem first. MoneySmart, ASIC's consumer money site, puts it plainly — the sooner you contact your bank, the more likely you are to get your money back, and the sooner the bank can stop any further transactions.
This guide covers what to do in the first hour, how to make the report so it is actually useful, what to write down, and what to do if the bank declines your claim.
First, work out which situation you're in
Banks handle these differently, and using the wrong word in your first message can slow things down.
| Situation | What happened | Where it usually goes |
|---|---|---|
| Unauthorised transaction | You did not authorise it. Card stolen, cloned, details used online, or a saved card used by someone else. | Card dispute with your bank |
| Mistaken transaction | You authorised a payment but the amount, payee or frequency is wrong — wrong BSB/account, double charge, wrong amount keyed in. | Mistaken payment process — MoneySmart notes different timeframes apply here |
| Scam | You were deceived into making a payment or handing over card details or codes. | Report to your bank and through scam reporting channels |
If someone talked you into reading out a card number, a one-time passcode or a verification code, treat it as a scam as well as a card dispute and say so in your first message. MoneySmart separates scam reporting from transaction disputes, and both can be running at once.
Step 1: Stop the bleeding before you start the paperwork
Do these before you fill in any form:
- Freeze or lock the card in your banking app if that option exists. Locking is usually instant and reversible if the charge later turns out to be legitimate.
- Check for other exposure. Look at recent transactions, pending authorisations, and any digital wallet (Apple Pay, Google Pay) on the account. If a tokenised card was added to a wallet you don't control, remove it.
- Look at your other cards. Card details compromised from one merchant are often used on a second card from the same household.
- If the physical card is missing, say so. Lost or stolen is a different report to "card in my possession but charged anyway," and it changes what gets reissued.
- Secure the login. Change your online banking password and turn on two-factor authentication if it is off. If your email account is the recovery path for your bank login, secure that too.
Do not cancel a recurring payment you dispute by simply closing the card if you still need the card for other bills — ask the bank how reissuing affects your direct debits, and re-establish them on the new number.
Step 2: Make the report
Most banks accept a disputed transaction report through the app, by phone, by secure message, or in a branch. Use whichever channel gives you a written record, or follow up a phone call with a secure message so the report exists in writing.
Have this ready before you start:
- card name and last four digits
- transaction date and amount exactly as shown
- the merchant or payee name as it appears on the statement (not the name you know the business by)
- whether the card is in your possession
- whether you have ever dealt with that merchant or given anyone the details
- any reference from the merchant, emails, receipts or delivery records you already have
When you report it, ask these questions directly and write down the answers:
- Is this being logged as an unauthorised transaction dispute?
- What is the reference number for the report? MoneySmart specifically advises getting one.
- Will the card be reissued, and when?
- Will any further transactions from that merchant be blocked while it's investigated?
- What will the bank need from me next, and by when?
- When can I expect an outcome or an update?
If the bank asks you to complete a form or a statutory declaration, complete it within the stated deadline. Missed deadlines are one of the most common reasons disputes stall.
Step 3: Understand why the report date matters
Timing is not a technicality. MoneySmart's guidance on bank transaction problems notes that the rules differ depending on when you report — within 10 business days, after 10 business days, or after seven months — alongside the expectation that you report as soon as possible.
Practical reading: don't wait for the monthly statement, don't wait to see whether the charge "falls off," and don't wait until you have gathered every piece of evidence. Report first and add evidence afterwards. If you are already past one of those markers, still report it and ask the bank which timeframe applies to your case.
Step 4: Keep a running record
Create one note — a document or an email to yourself — and add to it every time something happens.
| Record | Why you want it later |
|---|---|
| Report reference number and date/time of report | Proves when you reported, which drives which rules apply |
| Name of the person or team you spoke to | Avoids repeating your story from scratch |
| Screenshots of the transaction and your statement | Evidence, time-stamped |
| Copies of forms submitted, with dates | Shows you met deadlines |
| Any merchant correspondence | Helps distinguish dispute from scam |
| Bank's decisions and reasons, in writing | Needed before you can escalate |
Step 5: If it was a scam, report that too
An unauthorised charge is often the visible end of a scam. If you were contacted first — a text from your "bank," a fake delivery notice, a marketplace buyer, an investment offer — report the scam as well as the transaction. MoneySmart has separate guidance for checking and reporting scams, and for reporting investment scams. Reporting the scam does not replace telling your bank, and telling your bank does not replace reporting the scam. Do them in parallel, not in sequence.
Step 6: If the bank rejects your claim
You do not have to accept the first answer. Ask the bank for its reasons in writing and for its internal dispute resolution process, then use it. If the outcome is still unsatisfactory — or the bank takes too long — you can take the matter to the Australian Financial Complaints Authority (AFCA), which MoneySmart lists as the relevant external complaints body. AFCA is external to the bank; you will need the bank's final response and your own record of dates, references and reasons.
Your next step, concretely
- Freeze or lock the card now, in the app or by phone.
- Report the transaction to your bank today, using a channel that leaves a written record.
- Get the reference number before you end the conversation.
- If you were deceived into the payment, lodge a scam report as well.
- Start a single dated note with everything above in it.
- If the bank declines, request written reasons, use internal dispute resolution, then consider AFCA.
This article is general information only. It is not legal, financial or credit advice, and it does not account for your circumstances or your bank's specific terms and conditions. Timeframes, dispute processes and outcomes vary between institutions and depend on the facts of each case — confirm current details with your bank, with MoneySmart at moneysmart.gov.au, and with AFCA before relying on any of it. Australian Cash is not a bank, lender, broker, government body or regulator, and does not assess or decide disputes.