The ePayments Code and unauthorised transactions: the seller's view

A customer tells their bank they did not make a purchase. The bank opens an investigation under a code you have probably never read, with its own timelines and its own proof rules. You are not a party to it, but it shapes your dispute.

The ePayments Code and unauthorised transactions matter to sellers because the Code governs how a customer's bank handles an unauthorised card claim, and many of those claims become chargebacks against you. The Code binds banks, not merchants, but it shapes the timelines and the proof a bank accepts.

This guide to the ePayments Code and unauthorised transactions is for you if:

• You sell online and get "fraudulent" or "unrecognized" disputes.
• You want to understand what the customer's bank must do, and by when.
• You want to know what proof of authorisation really counts, and what does not.

Last updated: 10 October 2026. Written by the ChargeFix team. Reviewed against sources on 10 October 2026.

The 30-second answer (TL;DR)

• The ePayments Code is an ASIC code of practice. The version we opened is dated 2 June 2022, and ASIC describes it as presently voluntary. Banks and other providers subscribe, and subscribers warrant compliance in their terms and conditions.
• It protects consumers who deal with a subscriber. It does not cover facilities designed primarily for business use, and it does not bind merchants.
• Chapter C applies in addition to card scheme chargeback rights. A holder cannot be held liable for more than would apply if the bank had used its chargeback rights, but the bank does not have to use them.
• Banks have 21 days to finish an investigation or say more time is needed, and 45 days to finish unless there are exceptional circumstances. Where a bank resolves through scheme rules, scheme timeframes apply instead.
• Correct card details are not by themselves proof of fraud or of authorisation, and information that need not be kept secret, such as an expiry date, is irrelevant to liability.
• A bank cannot refuse to investigate an unauthorised transaction merely because the chargeback time limit has expired.

Quick note: The Code is long and technical, and this post is not legal advice. We summarise the clauses that touch sellers, cite the clause numbers so you can check them, and flag where the Code is silent about merchants. Where something affects your Shopify dispute, we say how.

The ePayments Code at a glance

Question	Short answer	Clause or source
Who does the Code bind?	Subscribing banks, credit unions and other providers	About this Code; cl 4.2(c)
Is it compulsory?	ASIC describes it as presently voluntary	ASIC page
Which version is current?	2 June 2022, no planned change listed on 10 October 2026	ASIC page
Does it cover business facilities?	No, facilities designed primarily for business use are excluded	Cl 2.1(a)
How long to investigate?	21 days to finish or ask for more time; 45 days to finish	Cl 18.1 and 18.2
Does it replace chargebacks?	No, it applies in addition to scheme chargeback rights	Cl 9.1

What is the ePayments Code, and does it apply to sellers?

The ePayments Code is a voluntary ASIC code of practice that sets rules for electronic payments, including who is liable for unauthorised transactions. It applies to subscribing banks and providers, not to merchants. Sellers feel it indirectly, because it shapes how a customer's bank investigates a claim and how long it takes.

ASIC's page, which we opened on 10 October 2026, says the latest version is dated 2 June 2022 and lists no planned change. It describes the Code as presently a voluntary code of practice, subscribed to by most banks, credit unions and building societies, and says it protects only consumers dealing with a subscriber. The document itself says it replaces the 2011 version, amended in 2016, with subscribers required to comply by 2 June 2023. Subscribers warrant compliance in their terms and conditions, which makes it a contract term between the bank and its customer.

Merchants are not parties. The Code does mention merchants in a few places, which we cover below, but nothing in the clauses we read imposes duties on a seller. Our post on how chargebacks work in Australia sets out the merchant side of the same events.

Does the Code protect business customers?

No. Clause 2.1(a) excludes transactions on a facility designed primarily for business use and established primarily for business purposes. It also excludes facilities with no contractual relationship with the subscriber, and biller accounts. Clause 9.4 says Chapter C, the liability chapter, does not apply to low value facilities that can hold no more than $500 at any one time. If your customers are mostly businesses paying from business accounts, the Code may not protect them, though scheme chargeback rights and consumer law may still apply.

Excluded from the Code	Clause
Facilities designed primarily for business use and established primarily for business purposes	2.1(a)
Facilities with no contractual relationship with the subscriber	2.1(b)
Biller accounts	2.1(c)
Low value facilities holding no more than $500 at any time (for Chapter C)	9.4 and 2.6

What counts as an unauthorised transaction under the ePayments Code?

Under the Code, an unauthorised transaction is one not authorised by a user. It excludes transactions performed by the user, or by someone with the user's knowledge and consent. So a family member who used a card with the cardholder's consent is not an unauthorised transaction under the Code, while a stolen card used by a stranger is.

That definition, in clauses 9.2 and 9.3, matters for the grey cases sellers see. A parent whose teenager ordered with their knowledge is outside the definition. A parent who did not know is inside it. You cannot tell which from your side, which is why our post on friendly fraud in Australia recommends a neutral tone and a records-first response. The Code also says that correct use of a device or passcode is significant but is not, by itself, proof of fraud or of a breach of passcode rules (clause 11.8).

Does correct card information prove authorisation?

Not under the Code. Clause 11.8 says that when deciding whether a user contributed to losses, all reasonable evidence and explanations must be considered, that correct device or passcode use is not by itself proof of fraud or breach, and that information not required to be kept secret, such as an expiry date, is irrelevant to liability. For a seller, the lesson is that "the card number, expiry and security code were right" is a weak argument for authorisation. Billing and shipping match, account history, IP country, prior orders and delivery proof carry more weight, and they are the items Shopify lists for the fraudulent and unrecognized reasons.

Evidence	Weight under the Code's approach	Why
Correct card number and expiry	Low	Expiry is information not required to be kept secret (cl 11.8)
Correct security code	Not enough alone	Correct use is not itself proof (cl 11.8)
Billing and shipping match	Useful	Supports the story of who ordered
Prior orders from the same customer	Useful	Shows a history
Delivery to the billing address with proof	Useful	Shows the goods reached the cardholder's address
Messages from the customer	Strong	Shows knowledge and engagement

Note that clauses 10.4 and 10.5 say proof of delivery to the correct address is not enough when the dispute is whether a user received a device or passcode. That clause concerns cards and passcodes sent by a bank, not parcels sent by a seller, so do not read it as saying delivery proof is worthless for goods. Delivery proof is still one of the items Shopify suggests for product-not-received disputes.

When is the customer not liable, and what does that mean for you?

Clause 10.1 says the holder is not liable where the loss is caused by fraud or negligence of a subscriber's employee or agent, a third party in networking arrangements, or a merchant or its employee or agent, among other causes. The Code protects the customer first. Who bears the loss afterwards is decided by the scheme and your merchant agreements, which the Code does not cover.

The full list in clause 10.1 is: fraud or negligence by a subscriber's staff, a networking third party or a merchant; a forged, faulty, expired or cancelled device or passcode; a transaction before the user received the device or passcode; a transaction incorrectly debited more than once to the same facility; and a transaction after the subscriber was told the device was misused, lost or stolen. Clause 10.2 adds that the holder is not liable for transactions made with an identifier alone, with no passcode or device, and clause 10.3 says the holder is not liable where it is clear the user did not contribute to the loss.

We have not verified how the Code classifies online card details for the purpose of clause 10.2, because the Code defines "identifier" and "passcode" as terms, and an online payment may involve several data points. We therefore do not claim that online card-not-present payments fall inside or outside that clause. Ask your processor if it matters to you.

Clause	Customer not liable where	Seller takeaway
10.1(a)	Fraud or negligence by a merchant or its staff	Keep your own handling clean and documented
10.1(b)	Device or passcode forged, faulty, expired or cancelled	Not a seller issue
10.1(d)	A transaction incorrectly debited more than once	A genuine duplicate should be refunded at once
10.2	Transactions made with an identifier alone	Classification for online payments not verified
10.3	It is clear the user did not contribute to the loss	A strong claim is hard to answer

When the customer is liable, the Code sets caps: the least of $150 or a lower amount the subscriber sets, the facility balance, or the actual loss at the time of reporting (clause 11.7), with other rules for fraud, passcode breaches and unreasonable delay in reporting. Those rules decide what the customer bears, not what you bear.

How do the ePayments Code and unauthorised transactions rules connect to chargebacks?

The Code applies in addition to card scheme chargeback rights, and a holder cannot be held liable for more than would apply if the bank had used those rights. The bank does not have to use them. In practice, a bank that investigates an unauthorised claim often routes it through a chargeback, which is how the claim reaches you as a Shopify dispute.

Three clauses do the work. Clause 9.1 says Chapter C applies in addition to any card scheme chargeback rights. Clause 11.10 says that for credit, debit and charge card unauthorised transactions, the holder cannot be held liable for more than they would be if the subscriber had used its card scheme rights, such as a chargeback, and that the subscriber does not have to use those rights. Clause 19 says that where a subscriber resolves a card scheme dispute under scheme rules, the scheme timeframes apply in place of the 21 and 45 day periods. Our post on chargeback time limits in Australia covers the scheme windows, and AFCA's side is in AFCA complaints and chargebacks.

Route	What happens	What you see
Bank uses a chargeback	The claim goes through the scheme	A dispute in Shopify, usually "fraudulent" or "unrecognized"
Bank investigates without one	It applies the Code's liability rules to the customer	Possibly nothing, or a request for information
Both	Chapter C applies alongside the scheme rights	Scheme timeframes govern the dispute clock

Can an old transaction still be investigated?

Yes, to a degree. Clause 17.3 says a subscriber must accept a report within six years of the user first becoming aware, or reasonably becoming aware, of the unauthorised transaction. The note to clause 17.3 says a subscriber cannot refuse to investigate merely because the chargeback time limit has expired, and that the chargeback limits are separate from the six year reporting period. What this means for a seller is not stated: the Code governs the bank and the customer, and we found no source on whether a late investigation can end with a debit to a merchant. Treat it as an open question for your acquirer or processor, and keep records for at least 12 months.

What timelines does the Code set?

The Code gives the bank 21 days to complete an investigation or tell the customer more time is needed, and 45 days to complete it unless there are exceptional circumstances. Where the bank resolves through scheme rules, the scheme timeframes apply instead, and if that is not resolved in 60 days the bank must explain the delay and update the customer every two months.

The detail comes from clauses 18 and 19. Clause 18.1 requires either the outcome in writing within 21 days or a written notice that more time is needed. Clause 18.2 requires completion within 45 days unless exceptional circumstances apply, and the note says delays caused by other subscribers or foreign merchants can count. Clause 19.1 says that if a card scheme dispute is not resolved within 60 days, the subscriber must give the reason for the delay, update the user every two months, give an expected decision date, and suspend the holder's obligation to pay the disputed amount and related charges until the dispute is resolved.

Clause	Period	What it requires
18.1	21 days	Finish and tell the customer in writing, or say more time is needed
18.2	45 days	Finish unless exceptional circumstances
19.1(b)	60 days	For scheme disputes: give reasons, update every two months, give an expected decision date
19.1(d)	Until resolved	The customer's obligation to pay the disputed amount is suspended
17.3	6 years	The bank must accept a report within this time

Illustration: the Code's clock beside Shopify's

A customer reports an unauthorised transaction to their bank on Monday 8 February 2027. The dispute reaches you in Shopify on Monday 15 February 2027, and you submit your response on Friday 26 February 2027.

Date	Code clock (customer and bank)	Shopify clock (you)
Monday 8 February 2027	Customer reports to the bank	Nothing yet
Monday 15 February 2027	Day 7	Dispute notice arrives
Monday 22 February to Monday 8 March 2027	Days 14 to 28	Response window, 7 to 21 days
Friday 26 February 2027	Day 18	You submit evidence, inside the window
Monday 1 March 2027	Day 21: bank finishes or says more time is needed	Waiting
Thursday 25 March 2027	Day 45: investigation to be complete unless exceptional	Waiting
Friday 9 April 2027	Day 60: scheme dispute updates required	Waiting
Wednesday 12 May 2027	Beyond the Code's periods	Latest bank decision, 75 days after submission

The two clocks do not match. The Code's 21 and 45 day periods govern what the customer is told. Shopify's 75 days describes how long the bank can take after your submission. Because scheme timeframes replace the Code's periods where the bank resolves through scheme rules, the Shopify clock is the one that matters to your cash, and the Code's 60 day clause is the one that keeps the customer informed.

What does this mean for the evidence you keep?

Keep the items that show who ordered and who received the goods, not just that the card details were right. Shopify lists fulfilment date and time, billing information, IP address and country, and shipping and tracking for fraudulent and unrecognized disputes. The Code's approach to proof suggests adding history and contact, which show more than card data.

Our posts on the evidence to save at fulfilment and chargeback response templates give the full routine and wording. Below is a template for the authorisation summary at the top of a fraudulent or unrecognized response.

AUTHORISATION SUMMARY (fraudulent / unrecognized)

Order [NUMBER], A$[AMOUNT], placed [DATE] at [TIME].

Who ordered:
- Account: [NEW / EXISTING CUSTOMER since DATE]; previous orders:
  [NUMBER], most recent [DATE], no earlier disputes.
- Billing name and address: [MATCH / DIFFER, with explanation].
- IP country at order: [COUNTRY], recorded by Shopify.

What was delivered, and where:
- Shipped [DATE] by [CARRIER], tracking [NUMBER].
- Delivered [DATE, TIME] to [ADDRESS], which is [the billing
  address / an address the customer entered at checkout].
- Delivery proof: [SIGNATURE / PHOTO / TRACKING CAPTURE].

Contact:
- [Customer emailed on DATE asking about DETAIL. / No contact
  before the dispute.]

We have not relied on the card number, expiry or security code as
proof of authorisation. We ask that the dispute be decided on the
attached records.

The last line is deliberate: it matches the Code's point that card details alone prove little, and it tells the reviewer you are not overstating your case. Use this checklist before you rely on a claim that a customer authorised an order.

AUTHORISATION EVIDENCE CHECK

[ ] Billing and shipping details compared and explained
[ ] Customer history checked: earlier orders, no disputes
[ ] IP country recorded and consistent (or explained)
[ ] Fraud analysis rating noted at the time of the order
[ ] If medium or high risk: customer contacted before shipping
[ ] Delivery proof saved (tracking, photo or signature)
[ ] Customer messages saved with dates
[ ] No reliance on card number, expiry or security code alone
[ ] Neutral wording; no accusation of fraud

Illustration: the value of checking before you ship

A customer orders A$499 of goods. The goods cost you A$310 and postage is A$20. Processing at 1.7% plus 30 cents, per Shopify's Australian pricing page checked on 10 October 2026, is A$8.78 (1.7% of A$499 is A$8.48, plus 30 cents). Fraud analysis rates the order medium risk, which means Shopify may recommend confirming with the customer first. The fee used is the reported A$25, which we could not find on Shopify's Australian pages.

Path	What happens	Net result
Confirm with the customer first, cancel and refund	No goods shipped; processing fee not returned	minus A$8.78
Ship, then lose a fraudulent dispute	Amount, fee and goods lost	minus A$363.78 (A$310, A$20, A$8.78 and A$25)
Ship, then win with the fee returned	Sale kept	plus A$160.22 (A$499 less A$310, A$20 and A$8.78)

The gap between cancelling and losing is A$355.00. Shopify says fraud analysis rates eligible orders low, medium or high risk of a fraud chargeback and that medium and high risk orders get a warning symbol, but also that it does not cover bank charge reversals. A rating is a prompt to check, not a promise. Our upcoming post on fraud prevention with fraud analysis and 3D Secure covers the checks, and we could not confirm from a current Shopify page how 3D Secure works for Australian stores.

What should you ask your acquirer or processor about the ePayments Code and unauthorised transactions?

Ask in writing, because the Code does not answer the merchant questions. The most useful ones are how late claims are handled, whether a report after the chargeback window can be debited to you, and how your processor treats unauthorised claims on business cards. The answers come from your merchant agreement and the scheme rules.

We could not find public sources for these points, so the questions below are the gap list we would take to Shopify Support, or to a bank acquirer if you have a separate merchant facility.

QUESTIONS FOR YOUR PROCESSOR OR ACQUIRER

1. If a customer reports an unauthorised transaction after the
   chargeback time limit has passed, can the bank still investigate,
   and can any amount be debited to my account?
2. How long after a sale can a dispute reach me, for each card
   scheme I accept (Visa, Mastercard, eftpos)?
3. What is the dispute fee for my account in Australia, and is it
   returned if I win or if the customer withdraws?
4. How does my processor treat unauthorised claims on business
   cards, which the ePayments Code excludes?
5. Does 3D Secure apply to my store, and does it shift liability
   for fraudulent disputes when authentication succeeds?
6. If a bank re-disputes a win, will a second fee apply?
7. Which team handles complaints about the processor, and is an
   external complaints body available to me?

Question five matters because NAB's merchant guide says 3D Secure shifts liability for fraud chargebacks to the card issuer when authentication succeeds, and that manual key entry is card-not-present with liability for fraud-related chargebacks falling on the merchant. We could not confirm from a current Shopify page how 3D Secure works for Australian stores. Our post on debit vs credit card chargebacks covers the scheme limits in the same guide.

Question	Why it matters	Where the answer lives
Late claims	The Code allows six years; chargeback limits are shorter	Merchant agreement, scheme rules
Fees	Shopify's Australian pricing page lists none	Shopify Support
Business cards	The Code excludes business-purpose facilities	Processor terms
3D Secure	May shift fraud liability	Processor, current Shopify documentation
Re-disputes	Winning does not guarantee you keep the amount	Shopify's resolution page, processor

What's different for Australian merchants?

Everything in this post is Australian, so the differences are about what is missing. The Code is voluntary and aimed at consumers, it excludes business facilities, and it does not describe any merchant process. The sources on merchant exposure are your acquirer, your processor and the card scheme rules.

• The Code binds banks, not sellers. Subscribers warrant compliance in their terms and conditions.
• It is voluntary and consumer-focused. ASIC says it protects only consumers dealing with a subscriber.
• Business accounts are excluded. Clause 2.1(a) excludes facilities designed primarily for business use.
• Scheme timeframes replace the Code's periods where the bank resolves a dispute through scheme rules (cl 19).
• Late claims are possible. The Code allows reports for six years and says a bank cannot refuse to investigate merely because the chargeback limit has expired. The effect on merchants is unconfirmed.
• Merchant acquirers have a reporting duty. Clause 15.3 says an acquirer must report incorrectly debited or credited transactions to the subscriber providing the facility.
• Passcodes are off limits. Clause 22.1 requires merchant agreements to prohibit merchants from holding a user's passcode under book-up arrangements.
• The fee is unconfirmed. Shopify's Australian pricing page lists no dispute fee. Third parties report A$25, and NAB charges its own merchants A$25.
• Other payment methods differ. Afterpay and PayPal use separate systems. See Afterpay and Zip disputes and PayPal disputes.

What mistakes do sellers make about the ePayments Code and unauthorised transactions?

The most common mistake with the ePayments Code and unauthorised transactions is treating correct card details as proof that the customer authorised the order. Others are assuming the Code binds the seller, ignoring old claims, accusing the customer and letting a medium risk order ship unchecked.

1. Relying on card details alone. Clause 11.8 says correct use is not by itself proof, and an expiry date is irrelevant.
2. Assuming the Code protects you. It binds banks, and it protects consumers.
3. Assuming the Code binds you. We found no clause imposing duties on a seller.
4. Ignoring medium and high risk flags. Shopify says the warning symbol is there to prompt a check.
5. Treating a won dispute as final. A bank can dispute again, with a new deadline.
6. Accusing the customer. The Code distinguishes consent from unauthorised use, and you cannot see which applies.
7. Reading clause 10.4 as saying delivery proof is worthless. It concerns devices and passcodes sent by banks.
8. Deleting records early. The Code allows reports for six years, though chargeback limits are shorter.

Frequently asked questions

What are the ePayments Code and unauthorised transactions?

It is an ASIC code of practice for electronic payments, including who is liable for unauthorised transactions. The version we opened is dated 2 June 2022. ASIC describes it as presently voluntary, and most banks, credit unions and building societies subscribe. It protects consumers dealing with a subscriber and does not cover business-purpose facilities.

Does the ePayments Code apply to my Shopify store?

Not directly. It binds subscribing banks and providers, not merchants. It shapes how a customer's bank investigates an unauthorised claim, which can end as a chargeback against you. We found no clause that places duties on a seller, so treat it as background to your disputes.

What is an unauthorised transaction under the ePayments Code?

Under the ePayments Code, an unauthorised transaction is one not authorised by a user. Transactions performed by the user, or by someone with the user's knowledge and consent, are excluded. A stolen card used by a stranger is inside the definition, while a family member who used a card with consent is outside it.

How long does a bank have to investigate?

The Code gives 21 days to finish and tell the customer in writing, or to say more time is needed, and 45 days to finish unless exceptional circumstances apply. Where the bank resolves a card scheme dispute under scheme rules, the scheme timeframes replace those periods, with updates required if it is unresolved after 60 days.

Does a correct security code prove the customer authorised the order?

No. Clause 11.8 says correct device or passcode use is significant but is not by itself proof of fraud or breach, and information not required to be kept secret, such as an expiry date, is irrelevant to liability. Billing and delivery match, history and contact carry more weight.

Can a customer report an unauthorised transaction years later?

The Code requires a bank to accept a report within six years of the customer becoming aware of it. Its note says a bank cannot refuse to investigate merely because the chargeback time limit has expired. How a late report affects a merchant is not stated, so ask your acquirer or processor.

Who bears the loss when a transaction is unauthorised?

The Code decides the customer's liability, with caps such as the least of $150, the facility balance or the actual loss in some cases. It does not decide what a merchant bears. That depends on the card scheme and your merchant agreement, and the customer's bank may use a chargeback.

Is the Code the same as the chargeback rules?

No. Clause 9.1 says the Code's liability chapter applies in addition to card scheme chargeback rights. A holder cannot be liable for more than if the bank had used its scheme rights, but the bank is not required to use them. Chargeback time limits are separate from the six year reporting period.

What should I do when a dispute says the transaction was not authorised?

Read the stated reason, then respond by the due date with evidence of who ordered and where the goods went: billing match, history, IP country, tracking and delivery proof, and customer messages. Stay neutral. Our post on friendly fraud in Australia and the response templates show the wording.

Start free trial with ChargeFix

ChargeFix helps Australian Shopify merchants turn their order, delivery, message and policy records into a ready response. You review and file it, or let Auto mode handle them. If you want your evidence organised for disputes where the ePayments Code and unauthorised transactions are in play, you can try it on a free trial first.

Start free trial

Sources

• ePayments Code, ASIC
• ePayments Code, June 2022, ASIC
• Chargebacks factsheet, Australian Financial Complaints Authority
• Chargebacks, Consumer Affairs Victoria
• Merchant chargebacks quick reference guide, NAB
• Chargeback reasons, Shopify Help Center
• Responding to chargebacks and inquiries, Shopify Help Center
• Resolving a chargeback or inquiry, Shopify Help Center
• Fraud analysis, Shopify Help Center
• Shopify pricing, Australia