Realising you've just sent money to a scammer, or entered your identity details into a fake portal, feels paralysing. But panic is exactly what costs you the window where something can still be done. Speed genuinely matters here — the sooner you act, the better your odds.
Call your bank immediately — but be clear about what you're asking for
Don't frame this as an "unauthorised transaction" dispute under the ePayments Code — if you sent the money yourself, even though you were deceived, that Code generally doesn't apply to your situation. What you want instead is to trigger the bank's scam-response process: ask them to alert the receiving bank and attempt to freeze the funds before they're moved further. Australian banks now share scam intelligence rapidly through industry mechanisms like the Australian Financial Crimes Exchange, and there's a real, recent development worth knowing: since 12 March 2026, AFCA can consider complaints against the receiving bank too — including failures to freeze known mule accounts — which gives you a genuine avenue if a bank drags its feet.
If you handed over identity documents
If you gave up sensitive details — a driver's licence, passport, or Medicare number — you're exposed to longer-term identity theft. Contact IDCARE, Australia's government-supported national identity and cyber support service, to build a response plan specific to what was exposed.
Log it officially
Report the incident at cyber.gov.au (ReportCyber, run by the Australian Cyber Security Centre) to get a formal reference number — useful for police, insurers, and banks alike.
Contain the damage
Cut off all contact with the scammer. Change your online banking and primary email passwords immediately, from a device you're confident is clean.
Protect your credit file
If your identity details were exposed, contact all three Australian credit reporting bodies — Equifax, Experian, and illion — to request a credit report ban. This blocks lenders from accessing your credit report for an initial 21 days (extendable up to 12 months with a police or cyber report reference), which stops a scammer from opening credit in your name.