Help & support
Here are the most common ways card fraud can occur
A database breach is a violation of any personal/confidential information (including cards details) you may have disclosed to a company, organisation or another third party, through either theft or loss. It can occur as a result of an unintentional breach by, or via a deliberate attack on, a company, organisation, third party and/or website you may have used before.
Fraudsters take the first 6 digits of your card number and use software to generate the remaining sequence of numbers. Combinations of card numbers, expiration dates and CVCs are tested to see if they’re correct and active. When successful combinations are found, card details can be used to make unauthorised transactions.
When fraudsters get hold of your full card credentials, generally through the black market or through a database breach, they can use these details to make a large number of purchases without your knowledge.
ATMs or EFTPOS machines can be tampered with to copy the magnetic strip on your card and record the PIN you enter. Fraudsters can then create a counterfeit card and withdraw cash from your account.
Malicious software, like viruses, worms and spyware are designed to disrupt and invade computer systems, to acquire and distribute sensitive information such as credit card numbers. If your mobile phone or computer device becomes infected with malware, any sensitive information stored on the device (including your card numbers or banking passwords) can be stolen. Fraudsters can use your card details to process transactions online or attempt to gain unauthorised access to your online banking account(s).
You’ll never need to give your CVC number when making an in-store purchase. Even if the merchant tells you otherwise, you should only tap, swipe or insert your card into an EFTPOS machine to make a payment. Sometimes you might need to provide your CVC number when making a payment over the phone or online. When doing so, always make sure to check the receipt emailed to you and/or the amount debited from your account.
Mail from CommBank often includes private and important information for yourself only. If stolen, this information can be used to access your accounts, steal funds from your card, used in crime or sold. Contact us straight away if your mail has been stolen and report your cards stolen to help prevent any financial loss.
Always make sure your address and contact details are up to date and are correct.
As soon as you notice your card is missing, lost, misplaced or stolen, report your card lost or stolen to us to stop anyone else from using it. Contact us immediately if you notice any unauthorised transactions on your account(s) with us.
Never provide any login, password and PIN details, never allow remote access or share the details of your digital card/s (including screenshots). If you are worried that your details are compromised, lock your card and report any suspicious activity to us immediately.
Our CommBank app notifications offer security alerts about transactions that appear suspicious.
To turn this feature on, simply follow the below steps:
We’ll use your approximate location when you’re logged on to help identify suspicious account activity from unexpected places.
To turn on location-based security, simply follow the below steps:
Message us immediately if you're worried about the security of your account. Our virtual assistant Ceba can help you lock your card or securely connect you to a specialist.
If you (or someone you know) is a CommBank customer and has been targeted or lost money as a result of fraud that is believed to have occurred, contact us immediately. We’ll let you know if you need to lodge a dispute with us.
Report fraud via the Australian Cyber Security Centre. Reports may be referred to the police for possible investigation.
Change your passwords and PINs straight away if you suspect your security has been compromised. Change these regularly as a preventative measure.
Contact IDCARE on 1800 595 160. IDCARE is a free government-funded service that provides support to victims of identity crime.
We’ll try to resolve your issue as quickly as possible.
Once you’ve contacted us to raise a dispute, we'll either send you a letter or email confirming the outcome of our investigation.
The time it takes to resolve a dispute depends on how complex it is.
We can only start investigating once the transactions are fully processed.
If any disputed transactions are still pending, we need to wait for them to be fully processed before we can initiate a dispute on your behalf. It generally takes 3 to 5 business days to process a transaction, although it can take up to 10 business days.
Dispute investigations can take up to 21 days. We’ll contact you if the investigation is taking longer.
If your dispute is successful, your credit will appear as at the date the disputed transaction was processed. For example, if it was in pending and then processed on 5 February, your credit will appear as at 5 February, not the date you raised the dispute with us or the date your dispute was resolved.
Debit & credit card security
Security tips for using your credit or debit card when paying in-store, shopping online and travelling.
How to spot a hoax or scam
From strange looking emails and text messages, to suspicious phone calls.
Protect yourself from scams
Smarter ways to shop online
Ceba can help you lock your card or securely connect you to a specialist in the CommBank app.
Fast-track your call, see expected wait times and connect with a specialist in the CommBank app.
Send us a copy or screenshot if you receive a hoax email or SMS.
As this advice has been prepared without considering your objectives, financial situation or needs, you should, before acting on the advice, consider its appropriateness to your circumstances. The information provided on this page has been compiled by CommBank to educate you on ways to minimise the likelihood of being victim to fraud or experience unauthorised transactions on your accounts, and where to seek help if you believe either of these have occurred.
