Banking and shopping on your phone: what official guidance says

Many people now check balances, pay bills and buy things from their phone, and a common question is whether mobile banking is safe. Banking apps and online stores have their own protections, but most of the problems people run into come from scams that trick them into handing over codes or paying the wrong place. This guide explains how the main protections work, how scammers try to get around them, and the checks official guidance describes before paying. It doesn’t describe any particular bank; each bank’s own website explains its app and security features.

Why it matters

A phone that is used for banking holds the keys to your money: the banking app, the text messages carrying security codes, and often saved card details. Scammers know this. Scamwatch’s phishing scams page says: “Scammers can make their calls and text messages appear to come from your bank.” It lists “The communication requires urgent action from you” among the warning signs, and says that if a caller is “telling you to move quickly because you could lose your entire savings, stop and slow things down.”

How one-time codes work

When you log in or make a payment, many services send a one-time code, usually six digits, by text message or through the app. It’s a form of multi-factor authentication: proof that the person making the request also has your phone.

The code only protects you while it stays with you. That’s why scammers so often call pretending to be from the bank’s fraud team and ask you to “confirm” the code they say they’ve just sent. In a scam like this, the caller may be trying to sign in or approve a payment, and the code is the one piece they’re missing. Scamwatch says: “Never share your personal information, credit card details, passwords or one-time codes”.

A fictional example

Sam gets a text that appears in the same thread as earlier genuine messages from his bank: “Unusual payment of $1,840 detected. If this wasn’t you, call 1800 000 000.” He calls and a friendly “fraud officer” says they’ll block the payment, but first he must read out the code that’s about to arrive. Sam remembers that Scamwatch describes contacting organisations “using contact details you’ve found yourself”. He hangs up, opens his banking app, and calls the number listed there. The bank confirms there was no unusual payment.

Scamwatch’s phishing page explains that scammers “can even send you text messages that appear in the same chain as other genuine messages”, which is why the message appearing in the usual thread isn’t proof.

How to check a call or text claiming to be from your bank

Based on Scamwatch’s guidance (checked October 2026). Scamwatch’s phishing scams page and its page on how scammers use technology and AI have the full list of warning signs.

1. Don’t tap any link in the message. Scamwatch says: “Don’t click on links in text messages or emails.”
2. Don’t call a number given in the text or by the caller. Scamwatch describes contacting the organisation directly “using contact details you’ve found yourself”.
3. If someone calls or messages saying they’re from your bank, Scamwatch says to “stop before you provide them with any details.”
4. Check by calling the bank back “on a number you find yourself”, such as one on its official website or in its app.
5. Never read out a one-time code, password or PIN to a caller.

Scamwatch also says: “If they ask you to transfer your money to a secure account, it’s a scam.”

Getting the real banking app

Scamwatch explains that scammers can use AI tools to make “perfect copies of real websites”, and the same tricks can be used to point people to look-alike downloads. The ACSC’s mobile phone guidance describes getting apps only from an official app store.

How to install a banking app from an official source

Based on the ACSC’s Secure your mobile phone guidance (checked October 2026).

1. Open the phone’s official app store (the App Store on iPhone, Google Play on most Android phones). The ACSC says: “Only download apps from an official app store.”
2. Search for the bank by name, or follow the link from the bank’s own website, typed in yourself.
3. Before installing, check the developer name. The ACSC says: “Check that apps are made by a reputable company before downloading and installing on your phone.”
4. After installing, review the app’s permissions. The ACSC describes removing apps that ask for “excessive or suspicious permissions.”
5. Turn on automatic updates for apps and the phone itself.

How to check Google Play Protect is on (Android)

Based on Google’s instructions (checked October 2026). Google’s guide has the latest steps. Google describes Play Protect as checking apps for harmful behaviour, including a safety check before you download from Google Play.

1. Open the Google Play Store app.
2. Tap your profile icon at the top right.
3. Tap Play Protect, then Settings.
4. Check that Scan apps with Play Protect is turned on.

Google says Play Protect is on by default but can be turned off.

How to keep the phone itself secure

A banking app is only as safe as the phone it’s on. The ACSC’s mobile phone guidance describes:

• locking the phone with “a passphrase, password, PIN or biometrics”, and setting it “to automatically lock after a short time of inactivity, such as five minutes”
• turning on automatic updates, because updates fix security weaknesses
• not storing account passwords, PINs or identity documents on the phone “without additional protection”, such as a password manager (how password managers work explains the idea).

If a phone used for banking goes missing, the guide to what to do about a lost or stolen phone covers locking it and contacting the bank.

Be Connected, the eSafety Commissioner’s program for older Australians, makes a related point in its online banking tips: because a bank may text codes for transactions, a strong, private phone passcode matters.

Both the ACSC and Be Connected describe avoiding public Wi-Fi for banking. Be Connected says it “should never be used for online banking”, and the ACSC’s public Wi-Fi page describes waiting, if possible, until “using a secure home, office or mobile connection.” See whether public Wi-Fi is safe, and what the ACSC describes.

How to check a website address before paying

Based on the ACSC’s, Be Connected’s and Google’s guidance (checked October 2026). Google’s Chrome guide explains the address-bar icons in Chrome on Android in detail; other browsers show similar information.

1. Look at the full web address in the address bar. Be Connected says to “Carefully check the web address at the top of the page to make sure it matches the store name.” Google describes checking the site name in the address bar to confirm it’s the site you meant to visit. Look-alike addresses often add a word or swap a letter, such as bestshop-sale.example instead of bestshop.example.
2. Check the address starts with “https” and shows the lock or security symbol. The ACSC and Be Connected both describe this.
3. Tap the security status icon to the left of the address. Google explains that Chrome shows “Not secure” or “Dangerous” for sites whose connection isn’t private or that Safe Browsing has flagged as unsafe.
4. If the browser shows a warning page, stop. The ACSC says: “If your browser displays a warning message when you try to visit a website, do not continue.”
5. If you arrived from a link in a message or ad, close the page and type the store’s address yourself. Scamwatch says: “Always type web addresses directly into your browser”.

A lock symbol means the connection is encrypted, not that the business is genuine. Google’s page says: “Even when connected to a site securely, always be careful when you share sensitive or personal information.”

What the ACSC says about paying online

The ACSC’s online shopping guidance and its shopping checklist describe:

• Payment methods. The ACSC says: “Never pay by direct bank deposits, money transfers or digital currencies such as Bitcoin,” because that money is hard to get back. It describes paying with a credit card or an established online payment service, and considering a separate low-limit card just for online shopping.
• Saved card details. The ACSC describes being careful about saving payment information in shopping accounts, and turning on multi-factor authentication where details are saved.
• Sharing less. The checklist describes giving a website only the details it needs for the purchase.

PayID

PayID lets people receive money using a mobile number or email address instead of a BSB and account number. Be Connected’s PayID explainer notes that the payee’s name appears before a transfer is confirmed, which gives a chance to check it. It explains that PayID is set up through your bank and is free, says to “Ignore any text messages, calls or emails claiming to be from PayID”, and says nobody can legitimately ask you to pay for an “upgrade” before receiving money.

Things to watch for

• Urgency. Scamwatch lists “The communication requires urgent action from you” as a warning sign.
• Requests for codes, PINs or passwords by phone, text or email.
• Being asked to move money to a “secure account”. Scamwatch says this is a scam.
• Payment by direct bank deposit, money transfer or cryptocurrency for online purchases. The ACSC warns these are hard to recover.
• Stores that seem too good to be true. The ACSC lists very low prices, requests for direct deposit, and new sites with little information about delivery, returns and privacy.
• Fake delivery texts. The ACSC says “do not click on the link” and to check with the seller or courier through their official website.

Common questions

Is mobile banking safe?

Official guidance doesn’t rate mobile banking as safe or unsafe; it focuses on the phone’s own protections and on scams that try to get codes or payments. The ACSC’s mobile phone guidance describes a screen lock, automatic updates and apps only from an official app store. Scamwatch warns that scammers can make calls and texts appear to come from your bank, and says never to share one-time codes. See how to keep the phone itself secure.

Should I give a one-time code to someone who says they’re from my bank?

Scamwatch says: “Never share your personal information, credit card details, passwords or one-time codes”. A one-time code is proof that the person making a request also has your phone, so a caller asking for it may be trying to sign in or approve a payment. Scamwatch describes calling the bank back “on a number you find yourself”, such as one on its official website or in its app. See how one-time codes work.

How can I tell if a text from my bank is a scam?

A message in the bank’s usual thread isn’t proof: Scamwatch says scammers “can even send you text messages that appear in the same chain as other genuine messages.” Scamwatch lists urgent requests as a warning sign, says not to click links in texts, and describes contacting the bank using details you’ve found yourself. It also says: “If they ask you to transfer your money to a secure account, it’s a scam.” The checking steps are above.

What do I do if I’ve given my bank details to a scammer?

Scamwatch’s first step is to “Contact your bank or card provider immediately to report the scam.” It also describes getting help from IDCARE, Australia and New Zealand’s national identity and cyber support service, on 1800 595 160, and reporting the scam to Scamwatch. If a complaint with a bank isn’t resolved, AFCA describes providing “fair, free and independent dispute resolution for financial complaints”. See what to do first after a scam.

Is it safe to do online banking on public Wi-Fi?

Both the ACSC and Be Connected describe avoiding public Wi-Fi for banking. Be Connected, the eSafety Commissioner’s program for older Australians, says public Wi-Fi “should never be used for online banking”. The ACSC’s public Wi-Fi page describes waiting, if possible, until “using a secure home, office or mobile connection.” The guide to public Wi-Fi and travel explains what the ACSC describes in more detail.

Does the padlock mean a shopping website is genuine?

No. A lock symbol means the connection is encrypted, not that the business is genuine. Google’s Chrome help says: “Even when connected to a site securely, always be careful when you share sensitive or personal information.” Be Connected says to check the web address matches the store name, and the ACSC describes researching stores and sticking to “well-known, trusted businesses”. See how to check a website address before paying.

Where to get official help

If money or details have been handed over, Scamwatch’s phishing page says to “Contact your bank or card provider immediately to report the scam.” It also describes getting help from IDCARE, “Australia and New Zealand’s national identity and cyber support service”, on 1800 595 160, and reporting the scam to Scamwatch. If a complaint with a bank isn’t resolved, AFCA describes providing “fair, free and independent dispute resolution for financial complaints”, usually after contacting the firm first. The guide to what to do first after a scam brings together what official sources say to do.

These guides explain common scams in more detail:

• Online shopping scams
• Marketplace scams
• Impersonation scams
• Phishing, smishing and vishing