You open your banking app and there is a debit you do not recognise. Before you call anyone, there is one decision to make: what kind of transaction is this? The label changes who you contact first, which process your bank starts, and what questions you get asked.
ASIC's MoneySmart puts it plainly: if you find a transaction in your account that you do not recognise, it could be several different things. Only one of them is an unauthorised transaction. The others include a mistaken or incorrect charge, a legitimate fee you forgot about, and a payment you authorised yourself because someone misled you — a scam. This guide separates those categories using MoneySmart's own wording, then sets out what to do and what to verify.
What "unauthorised" actually means: permission, not suspicion
MoneySmart's definition is short: an unauthorised transaction "is when someone transfers money from your account without your permission." That single idea — permission — is the whole test. It is not a test of whether the payment looks odd, whether you remember it, or whether the business involved acted dishonestly.
Three practical readings follow from it:
- A stranger using your card number, account details or login to move money you never consented to is unauthorised.
- A direct debit or recurring payment set up against your account without your agreement is unauthorised.
- Where you agreed to one amount and a business took more, or took it again later, the extra amount was not authorised by you.
Sit with that last point, because cases are often mixed. You may have authorised one payment and nothing else. Since permission is assessed debit by debit, part of a merchant's activity can be authorised while the rest is not. Say that explicitly when you report it.
Warning signs MoneySmart points to — and one trap
MoneySmart flags transactions dated on a day you did not use your account, along with debits you simply cannot place with any purchase, subscription or bill.
The trap sits right beside that advice: "Transactions can take days to show up in your account" (MoneySmart). A debit appearing on Wednesday can be Sunday's fuel and coffee, and the name on your statement often differs from the shopfront name you recognise. Before you label anything unauthorised:
- check pending transactions, not just the settled balance
- search your email and messages for receipts, trial sign-ups or subscription confirmations from that week
- ask anyone else who holds a card linked to the account
- check whether the amount matches a bank charge — MoneySmart reminds people to look out for monthly account keeping fees their bank charges, if any
An unfamiliar debit is a question, not yet a conclusion. Working through that list first saves you a call that goes nowhere.
When it is not unauthorised: mistaken and incorrect transactions
MoneySmart treats mistaken and incorrect transactions as a separate category. Its clearest example is a seller incorrectly debiting your account more than once. You authorised a payment to that seller; being charged twice was not what you agreed to. The same logic covers being charged the wrong amount or having a direct debit duplicated.
The distinction changes your first move. A double charge is often something the business can see and reverse directly, faster than a formal bank dispute. MoneySmart's guidance is to raise the problem with the seller, then take it to your bank if it is not resolved.
There is a formal layer as well. MoneySmart explains that where an unauthorised or mistaken transaction occurs on your personal account and your bank has signed up to ASIC's code covering electronic payments, that code sets out how your report is handled. Ask your bank whether it has signed the code and what it means for your case; do not assume every bank gives the same answer. MoneySmart refers specifically to personal accounts, so joint or business accounts may follow a different path — worth confirming.
Scam payments you authorised — the hardest category
If you read out a one-time code, approved a payment in your app, transferred money yourself, or gave someone access to your device because a caller convinced you it was necessary, you authorised that payment. Under MoneySmart's definition it is not an unauthorised transaction, because permission existed — even though it was obtained by deception.
That is uncomfortable, but it is useful. It tells you to report the matter as a scam rather than as an unauthorised transaction, and to expect a different process and different questions. Nothing here guarantees a refund. Whether any money is recovered depends on the facts, how quickly the matter is reported, your bank's processes, and any code or scheme obligations that apply.
Mixed cases are common. Scammers holding your card details may take one agreed payment and then add recurring debits or higher amounts you never agreed to. Those additions may be genuinely unauthorised, so list every debit separately.
For scam cases, ask your bank:
- how the scam report is lodged, and what reference number you receive
- which other bodies you should notify — for example police, or the platform where the contact happened
- whether anything can be done about the receiving account
- whether you will get the outcome in writing
Classifying what you can see
| What you see | Most likely category | Your first move |
|---|---|---|
| Money moved from your account and you gave no permission at all | Unauthorised transaction (MoneySmart definition) | Call the bank on the number on your card or in its official app; ask for the card to be blocked |
| One purchase charged twice, or charged at the wrong amount | Mistaken or incorrect transaction | Contact the seller for a reversal; escalate to your bank if unresolved |
| Debit dated on a day you did not use the account, with no matching receipt | Possible unauthorised transaction | Check pending transactions and receipts first, then report it as unauthorised |
| Unrecognised debit that matches a monthly account keeping fee | Not a transaction error | Check your bank's fee schedule (MoneySmart) |
| You approved the payment yourself after pressure or a convincing story | Authorised payment — report as a scam | Report to your bank as a scam; ask about further notifications |
| Extra recurring debits after you authorised one payment | Mixed case | List each debit separately in your report |
What to do now, in order
- Classify before you call. The words you use — unauthorised, mistaken, scam — set the process in motion.
- Use the official channel. Ring the number on the back of your card, or use the bank's app or its own website. Never call a number contained in a text, email or direct message about the problem.
- Ask your questions. Has the bank signed ASIC's code for electronic payments? What is the deadline for reporting? Will the card need cancelling, and how does that affect scheduled debits? Is a provisional credit or hold available while it is investigated? What do you need from me in writing?
- Write everything down. Date and time of the call, who you spoke with, the reference number, exactly what you reported.
- Follow up. MoneySmart's standing advice is to check your account regularly. Check daily while the matter is open, and check the next statement cycle for repeat debits.
Reducing the chance next time
- Review recurring direct debits you no longer use and cancel the ones that serve no purpose.
- Treat any unexpected message about your account as unverified until you have opened the app or called the official number yourself.
- Keep your contact details current so your bank can reach you about activity it flags.
- When reviewing your everyday account, look at its fee structure. MoneySmart notes banks may charge monthly account keeping fees, and knowing yours explains debits you might otherwise query.
Questions worth confirming, because the details change
- Has my bank signed ASIC's code for electronic payments, what is it currently called, and what does it require after I report?
- What are the bank's deadlines, if any, for reporting unauthorised versus mistaken transactions? MoneySmart's summary does not state one fixed deadline, so confirm it for your account.
- What evidence helps — receipts, screenshots, correspondence, a police report?
- Are personal, joint and business accounts handled differently?
Your next step
Open your transaction list and work down it line by line. Next to every unfamiliar debit, write one of three words: unauthorised, mistaken, or scam. That single pass usually resolves half the list on its own, because you recognise the merchant behind a recent purchase or match the amount to a known monthly fee. For whatever remains, call your bank on its official number, use those same words when you report, ask for a reference number before you hang up, and check again tomorrow.
If sorting through this has you reconsidering which everyday account your money sits in, you can review options that suit the way you bank at /match/.
General information only
This article is general information about how Australian banking categories work. It is not legal, financial or tax advice and does not consider your personal objectives, circumstances or needs. Nothing here guarantees that a transaction will be reversed, that a claim will succeed, or that money will be recovered; outcomes depend on your bank's processes, any applicable code or scheme rules, and the facts of your case. Rules and code arrangements can change, so confirm current details with your bank and ASIC's MoneySmart (moneysmart.gov.au) before acting. Australian Cash is an independent publisher, not a lender, broker, government body, regulator or comparison panel, and does not make personal recommendations.