A bank dragging its feet on a fraud claim doesn't get the final word on who's liable — the ePayments Code sets specific rules for exactly this situation.
An Important Nuance: This Code Is Voluntary, But Nearly Universal in Practice
The ePayments Code, administered by ASIC, is technically a voluntary code of practice — but the large majority of Australian banks, building societies, and credit unions have subscribed to it. Once a financial institution subscribes, complying with the Code becomes part of its contract with you, so a breach of the Code is a breach of your agreement with them, not just a voluntary guideline they can ignore. The Code covers ATM, EFTPOS, and credit card transactions, online payments, internet and mobile banking, and BPAY.
How Liability Is Actually Decided
The Code sets out specific rules for allocating loss from an unauthorized transaction. Broadly: you're not liable for losses caused by fraud or negligence on the part of the institution or its staff, for losses from a forged, faulty, expired, or cancelled device, or for losses that happen before you receive your card/access device. You generally are liable, up to a limited amount, for losses where you contributed through unreasonable carelessness — the clearest example being writing your PIN on your card itself or keeping it in a way that's obviously easy for someone else to find alongside the card. Simply having your card physically stolen is not, by itself, evidence you were careless with your PIN.
The Recovery Process for Mistaken Payments
The Code also establishes a specific process for recovering a mistaken payment — for example, a transfer accidentally sent to the wrong BSB/account number. Your institution is required to investigate a reported mistaken payment and attempt recovery from the receiving institution within set timeframes, rather than simply telling you the money is gone.
What This Means for You
- Confirm your bank is a subscriber to the ePayments Code — most major institutions are, and this makes the Code's rules part of your contract with them.
- Don't accept a blanket denial without a specific explanation of which carelessness rule the bank believes applies to your situation.
- Report unauthorized transactions and mistaken payments as soon as possible — prompt reporting strengthens your position under the Code's recovery process.
- If your bank isn't following the Code's rules or timelines, you can escalate the matter to AFCA.
Related Kibbo Tools
- Unauthorized Transaction & Fraud Tracker (Template) →
- Unauthorised Transaction Dispute Letter (Australia) Generator →
Sources
- ASIC — ePayments Code. asic.gov.au
- Brander Smith McKnight — Understanding the ePayments Code. bsmlaw.com.au