ePayments Code may Prevent Scams

18 September 2025 in Fraud and Internet Scams | 5 min read | skip to FAQs

This article examines the prevention of e-commerce scams via the ePayments Code, referred to in the article as the Code.

Background to the ePayments Code

The ePayments Code, formerly known as the Electronic Funds Transfer Code of Conduct, has been in effect since 1 July 2012. It is a voluntary framework designed to supplement consumer protections under ASIC administered legislation including the National Consumer Credit Protection Act 2009 (Cth), Chapter 7 of the Corporations Act 2001 (Cth)  and the Australian Securities and Investments Commission Act 2001 (Cth).      

For example, a misrepresentation of a consumer’s rights under the Code may breach section 12DA of the Australian Securities and Investments Commission Act 2001 (Cth), which prohibits misleading or deceptive conduct in the provision of financial services.

The Australian Securities and Investments Commission (ASIC) administers the Code, regularly reviewing and updating it to reflect advances in financial technology, including mobile banking, two-factor authentication, biometrics and contactless payments. ASIC’s oversight is critical given the rapid evolution of digital payments and the increasingly diverse range of entities involved in electronic payment systems.

Applicability of the ePayments Code

The ePayments Code regulates electronic payment facilities. The Code applies to electronic payment transactions by consumers. These include:

1. Online transactions;
2. Mobile and internet banking;
3. BPAY;
4. EFTPOS transactions;
5. Automatic teller machine (ATM) transactions; and
6. Credit card transactions

Is the ePayments Code compulsory?

The Code is currently a voluntary code of practice, however, most major Australian banks, building societies, and credit unions are subscribers to the Code and are therefore bound by the rules under the Code. This means that any breach of the Code becomes a breach of the subscribing financial institution’s contract with their customers. It may also constitute a breach of any ASIC administrated legislations, exposing the subscriber to further regulatory consequences. Information about whether the financial service provider is a subscriber to the Code is usually specified in the terms and conditions of any agreement or contract with consumers.

Subscribers to the Payments Code include the following:

1. American Express Australia Limited,
2. Citigroup Pty Ltd;
3. Commonwealth Bank of Australia;
4. HSBC Bank Australia;
5. National Australia Bank Limited;
6. Paypal Australia Pty Ltd;
7. Southern Cross Credit Union Ltd;
8. Westpac Banking Corporation; and
9. Woolworths Team Bank Limited.

Consumer Protections under the ePayments Code

Key consumer protections under the ePayments Code include requirements for:

1. Disclosure of terms and conditions to consumers, including notice of any changes (e.g., ATM fee increases), receipts and statements.
2. Allocation of liability rules for unauthorised transactions between consumers and subscribers. The general principle is that consumers will not be liable for any unauthorised transactions as long as reasonable precautions are taken by consumers to protect their accounts.
3. Procedures for consumers to seek recovery of any internet payments mistakenly transferred to the wrong recipients.
4. Complaints handling processes for consumers who are dissatisfied with the conduct of the subscribers, as well as dispute resolution procedures.

Key Provisions of the Code

The Code contains several provisions specifically addressing scam related transactions and unauthorised payments.

Unauthorised Transactions and Allocation of Liability

Chapter C of the Code establishes rules for determining liability for unauthorised transactions and recovery mechanisms for scams. Under the Code, “unauthorised transactions” exclude any transactions initiated by the consumer or with their knowledge or consent (Clause 9.3 of the Code). It is important that this is likely to include transactions performed by consumers as a result of falling victim to a scammer or fraudster.

Clause 10 holds a subscriber liable if the loss results from the fraud or negligence of the subscriber’s employee or agent, or if the unauthorised transaction occurred after the consumer reported misuse of their device or passcodes.

Clause 11.8(a) of the Code requires consideration of all reasonable evidence for any disputed transactions by a subscriber to prove that the user has contributed to the losses. Importantly, Clause 11.8(b) clarifies that third party access to the consumer’s mobile device or passcode does not by itself constitute proof, on the balance of probability, that the consumer contributed to the losses or was in contravention of any security requirements.

Passcode Security Requirements

Further to the above, in the event that one or more passcodes are required to authorise any disputed transactions, clause 12 of the Code mandates that consumers are obliged to not voluntarily disclose the passcodes to any third party, including their family members. A passcode is a password, or a code used to authenticate a transaction or a consumer, which may include a code generated by a security token, a personal identification number (“PIN”), or internet banking password, that the consumer is required to keep secret. This obligation is central to the Code’s allocation of liability; any breach of these security requirements could render a consumer liable for unauthorised transactions arising from such breaches.

Each consumer must make reasonable attempts to protect the security of a passcode (see clauses 12.2(b)-(c) and 12.3 of the Code). However, the security requirements under clause 12 may have little relevance and applicability with regard to biometric authentication methods, where fingerprint or voice recognition may be used.

Complaints and Dispute Resolution

Chapter F of the Code mandates that subscribers establish dispute resolution mechanisms, which may include:

1. Internal Dispute Resolution (IDR) procedures compliant with ASIC’s Regulatory Guide 165 (RG 165), providing consumers with a clear path to address grievances;

2. External Dispute Resolution (EDR) through membership in the Australian Financial Complaints Authority (AFCA), ensuring consumers have an independent avenue for redress.

It is worth noting that RG 165 applies scalable principles, meaning certain aspects may be applied with more or less stringency depending on the subscriber’s size and nature of the subscriber’s business.

Key Takeaways

The ePayments Code provides a framework for safeguarding consumers against e-commerce scams, setting a standard for liability and recovery across electronic payments. However, in light of the rapid development of financial technology, it is questionable whether the Code provides adequate protection for consumers, particularly in circumstances of scam and fraudulent transactions. Furthermore, the Code may not  adequately respond to the needs of consumers and electronic payment providers as the e-commerce environment continues to expand and develop.

How can BSM Sydney Lawyers assist you?

The experienced fraud lawyers at Brander Smith McKnight law firm Sydney are able to navigate the intricacies of the ePayments Code and explore all possible recovery avenues. Our experienced lawyers can assist in disputes involving unauthorised transactions, fraud and scams. We will fight for your rights, using all available legal avenues. The fraud lawyers at BSM Sydney Lawyer offer a free 20-minute consultation to assess your e-commerce scam and determine if we can help reclaim funds.

FAQs

BSM Lawyer Sydney has offices conveniently located in Sydney CBD, Sutherland, Parramatta, Shellharbour and Wollongong.