Card added to a digital wallet without permission? What to do

Need the short version? Use our first-hour checklist. If your bank says fraudulent charges came from a digital wallet, the usual story is that a criminal added your card to Apple Pay or Google Wallet on their phone, using a one-time code you were tricked into handing over. Your own phone often wasn't touched. Act fast: cancel the card and its wallet tokens, ask the bank when and to which device the token was added, and dispute the charges as unauthorised.

What happened to one of us

A member of our team found card charges they didn't recognise. Their bank's answer was short: the transactions came from a "digital card wallet". Their phone was fine, their Google account showed no strange sign-ins, and nobody had their physical card. What had almost certainly happened is the scam below: the card was registered to a wallet on someone else's phone. We wrote this guide from the checklist we wish we'd had that day.

How the one-time-code wallet scam works

A text lure. A message says you owe a toll, a parcel fee or a fine. Linkt, Australia Post and the ACMA have all warned about these impersonation texts.
A fake payment page. You type in your card details to pay a small amount. Behind the scenes the phishing kit immediately tries to add your card to a wallet on the criminal's phone. Your bank sends you a genuine one-time code, and the fake page asks you to enter it "to verify the payment" (Krebs on Security).
The wallet goes live on their phone. Criminals often load several stolen cards onto one phone and wait 7–10 days before using or selling it (Krebs on Security). That's why fraud can appear days after you've forgotten the text.
Cash-out. They tap to pay in shops, often for electronics or jewellery, or relay the card to accomplices elsewhere (Krebs; ThreatFabric).

A variation skips the text: someone phones claiming to be your bank's fraud team and asks you to read out "the code". Scamwatch has warned about bank impersonators doing exactly this.

How big is it?

Industrial phishing kits. Google sued 25 unnamed defendants on 12 November 2025 over the "Lighthouse" phishing-as-a-service kit linked to the "Smishing Triad". Google says it harmed more than 1 million victims in 120 countries, with 600+ templates impersonating 400+ brands, and around 25,000 phishing domains active in any 8-day period (Krebs on Security).
UK, where wallet fraud is measured. UK Finance names one-time codes socially engineered "to register digital wallets" as a leading cause of card fraud. Remote-purchase fraud cases hit a record 3.2 million in 2025, up 13% (UK Finance press release; Annual Fraud Report 2026).
Australia. Combined reported scam losses were $2.18 billion in 2025, up 7.8%, and phishing losses were $97.6 million (National Anti-Scam Centre). Card fraud on Australian-issued cards was $854 million in FY25, down from $868 million (AusPayNet). Australia doesn't publish a separate figure for digital wallet fraud.
Wallets themselves are safer. Visa says tokenised credentials have a 39.4% lower fraud rate than non-tokenised ones (Visa). The weak point is the moment a card is added, when the scammer gets you to hand over the code.

The full response checklist

Call the bank on a number you trust and lock the card.
Cancel the card and all wallet tokens. Ask for a new card number, and ask them to revoke the token on the criminal's device (Bitdefender). Some banks let you see linked wallets yourself; CommBank's "Review digital wallets" feature does this (CommBank).
Ask two questions and write down the answers: which device (or device type) the token was added to, and the date and time it was added. If it isn't your phone, that's strong evidence of unauthorised tokenisation.
Lodge a written dispute for every transaction you didn't make. Describe it as "unauthorised transactions made through a digital wallet token I did not add or authorise".
Be precise about codes. If you never shared a code, say so plainly: "I did not give any one-time code to anyone." If you typed a code into a page you thought was a toll, parcel or bank payment, say exactly that, including that you were told it was to verify a payment. Don't guess or exaggerate; the wording matters under the ePayments Code (see below).
Report the cybercrime to ReportCyber at cyber.gov.au and keep the reference number.
Report the scam to Scamwatch so the lure and fake site can be tracked.
Get free recovery help from IDCARE, Australia's free identity and cyber support service, especially if you also typed in other personal details.
Check your own phone and accounts. Remove any card you don't recognise from your wallet, change your Google or Apple account password, and review signed-in devices.
Keep everything: the scam text, screenshots of the fake page, the bank's reference number and notes from every call.

Your refund rights

ePayments Code

If a transaction was unauthorised, your bank is liable unless it proves you contributed to the loss, for example by voluntarily disclosing a passcode. An SMS one-time code counts as a passcode (AFCA fact sheet: unauthorised transactions). AFCA looks at whether your "will was overborne" by the scammer. In determination 12-00-1039082 (March 2025), a customer who read out codes was held liable for $43,246.50, with only $2,000 awarded for the bank's slow handling (AFCA determination). AFCA has also found for customers where the bank couldn't prove voluntary disclosure (AFCA). The Code is currently voluntary; Treasury is legislating to make a revised Code mandatory (Treasury).

AFCA

If your bank's internal dispute process doesn't resolve it, you can complain to AFCA. Have your dispute reference, timeline and evidence ready.

Scams Prevention Framework: not yet

The Scams Prevention Framework puts obligations on banks, telcos and digital platforms to prevent, detect, report, disrupt and respond to scams. But AFCA's Australian Scams Ombudsman only covers scams that happen on or after 31 March 2027, and the detailed rules on who pays are still being finalised (AFCA: Scams Prevention Framework). For a scam today, the ePayments Code and AFCA's usual process are what apply.

How to stop it happening

A wallet code is never for "verifying a payment". If a code message mentions adding a card to a wallet or device, and you aren't doing that, stop. Never read a code to a caller, even one who sounds like your bank (ANZ; CommBank).
Don't pay tolls, fines or parcel fees from a text link. Open the official app or type the website address yourself.
Turn on wallet alerts and in-app approvals. CommBank alerts you when a card is added to a new wallet and verifies some online transactions in its app instead of by SMS (CommBank 2024; CommBank 2025). NAB recommends app notifications over SMS (NAB).
Check linked wallets now and then in your banking app, if it offers it.
Protect your number. Telcos must run stronger identity checks before porting numbers and for SIM swaps (ACMA); set a PIN or password on your mobile account.

Wondering whether insurance would have paid? See does cyber insurance cover scams?

Related guides

Sources (checked 20 Oct 2026)

Questions

Can someone add my card to their Apple Pay or Google Wallet without my phone?

Yes. Adding a card to a wallet usually needs the card details plus a one-time code your bank sends you. Scam pages collect both, so the card ends up on the criminal's phone while your phone is untouched.

Is cancelling my card enough?

Not always. The wallet copy of your card (a token) can keep working separately. Ask your bank to cancel the card and every digital wallet token linked to it, and to issue a new card number.

Will my bank refund a digital wallet fraud?

Under the ePayments Code the bank is liable for unauthorised transactions unless it proves you contributed, for example by voluntarily sharing a passcode such as an SMS one-time code. AFCA has decided cases both ways, so outcomes depend on the facts.

Why did the charges appear days after the scam text?

Criminals often load several stolen cards onto one phone and wait 7 to 10 days before using or selling it, according to reporting on Google's lawsuit against the Lighthouse phishing kit.

Where do I complain if my bank says no?

Use your bank's internal dispute process first. If you're unhappy with the outcome, you can complain to the Australian Financial Complaints Authority (AFCA), which is free for consumers.

Markdown version

Someone added your card to their phone wallet: what to do

Do this in the next hour

Call your bank

Kill the card and the tokens

Dispute in writing