Card added to a scammer's Apple Pay or Google Wallet? First hour checklist

If your bank says the fraud came from a digital wallet you didn't set up, the clock matters. In the first hour: lock the card, get the bank to cancel the card and every wallet token, write down what the bank tells you, and start a written dispute. Then report it and get free help from IDCARE. This page is the short, timed checklist; our full guide explains how the scam works and your refund rights.

Minute 0–5: stop more charges

Lock the card in your app. Most banking apps have a lock or freeze switch. It's instant and reversible.
Don't call numbers from texts or emails. Scammers pose as bank fraud teams and ask for codes. Scamwatch has warned about this.
Check your own wallet app. If you see a card you don't recognise in your own Apple Wallet or Google Wallet, remove it. The fraud usually happens on the criminal's phone, though, so your app may look normal.

Minute 5–20: the call to your bank

Say clearly: "There are transactions I didn't make. I think my card was added to a digital wallet I didn't set up. Please cancel the card and every digital wallet token linked to it, and issue a new card number."

A replacement plastic card alone may not stop a wallet copy, because the wallet holds its own token (why that matters; Bitdefender). Some banks show linked wallets in the app: CommBank's "Review digital wallets" feature lets you see and remove them (CommBank). ANZ and CommBank both publish digital wallet scam guidance (ANZ; CommBank).

Ask and write down:

Your reference or case number, and the name of the person you spoke to.
When the wallet token was added, and to what type of device.
Which transactions came through that token.
Whether any other cards or accounts with the bank need to be replaced.
How and by when to lodge the written dispute.

Minute 20–40: dispute in writing

Lodge a written dispute (in the app, by secure message or by email) for every transaction you didn't make. Describe them as "unauthorised transactions made through a digital wallet token I did not add or authorise."

Be exact about one-time codes. Under the ePayments Code your bank is liable for unauthorised transactions unless it proves you contributed, for example by voluntarily disclosing a passcode, and an SMS one-time code counts as a passcode (AFCA fact sheet). If you never shared a code, say so. If you typed a code into a page you thought was a toll, parcel or bank payment, say exactly that. Don't guess. AFCA has decided these cases both ways depending on the facts (AFCA determination 12-00-1039082).

Minute 40–60: report and get help

ReportCyber (cyber.gov.au): report the cybercrime and keep the reference number. Your bank or insurer may ask for it.
Scamwatch: report the scam text, call or website so it can be tracked and disrupted. ASIC's Moneysmart also explains how to check and report scams.
IDCARE: free identity and cyber support. Contact them especially if you also typed in your name, address, date of birth or ID details.

Later today

Change your Apple ID or Google account password and review signed-in devices.
Update the new card number with any genuine subscriptions.
Keep the scam text, screenshots of the fake page and transaction screenshots in one folder.
If you have home, contents or cyber insurance, check whether it has an identity theft or card fraud benefit and any deadline for telling your bank (see insurance options compared).

If the bank says no: AFCA

Use the bank's internal dispute process first. If you're not satisfied with the outcome, you can complain to AFCA, which is free for consumers. Have your reference numbers, timeline and evidence ready. AFCA's new Scams Ombudsman role only applies to scams on or after 31 March 2027 (AFCA), so for a scam today the normal AFCA process applies.

Related guides

Someone added your card to their phone wallet: what to do (how the scam works and your refund rights)
How to stop scammers adding your card to a digital wallet
Cyber and scam insurance in Australia compared
Does cyber insurance cover scams?

Sources (checked 20 Oct 2026)

Questions

Should I call my bank or use the app first?

Do whichever is fastest. Locking the card in the app takes seconds, then call the bank on the number on your card or in the app to cancel the card and its digital wallet tokens.

What is a digital wallet token?

When a card is added to Apple Pay or Google Wallet, the wallet stores a separate device-specific card number called a token. It can keep working on the criminal's phone unless your bank cancels it, which is why you ask for the card and all wallet tokens to be cancelled.

How long do I have to dispute?

Dispute as soon as you can. Banks and card schemes have time limits for chargebacks and disputes, and some insurance policies require you to tell your bank within 24 hours. Ask your bank for its deadline and a reference number.

Is IDCARE free?

Yes. IDCARE is Australia's not-for-profit identity and cyber support service and is free for individuals.

Can I go to AFCA straight away?

AFCA usually expects you to complain to your bank first. If the bank's response is unsatisfactory or slow, you can lodge a free complaint with AFCA.

Markdown version

Card added to a scammer's Apple Pay or Google Wallet? Your first hour

Minute 0–5: lock it

Minute 5–20: call the bank

Minute 20–60: dispute and report