Travel scams and your bank: What NZ card protections cover

Author: Kevin McHugh, Head of Publishing at Banked.

Travel scams have become more convincing as fraudsters get hold of real booking data — your hotel name, your check-in dates, your booking reference — and use it to send messages that look exactly like genuine communications from your accommodation provider or booking platform. The pitch is usually a “problem” with your payment, a “verification” your reservation supposedly needs, or an “upgrade” offer that requires you to act on quickly.

If you fall for one — paying a “deposit” to a fake hotel address, or handing over card details on a spoofed payment page — what does your bank actually do? The answer depends on how you paid, what kind of fraud occurred, and when.

Was the payment authorised or unauthorised?

This is the single most important question, because it determines which set of rules applies.

The Banking Ombudsman Scheme defines an unauthorised payment as one made without your knowledge and consent — for example, a scammer steals your card details from a phishing site and runs a charge through. An authorised payment is one you made yourself, even if you were deceived about the purpose or who you were paying. Most travel booking scams produce authorised payments: you typed in the card number and clicked pay, believing it was your hotel.

Why this matters: New Zealand’s Code of Banking Practice has long required banks to reimburse customers for unauthorised use of their cards or internet banking, provided the customer wasn’t negligent. Authorised payments have historically been the customer’s problem — until late 2025.

What is a chargeback, and when does it apply?

A chargeback is a Visa or Mastercard process that lets your bank claw money back from the merchant’s bank when something has gone wrong with a card transaction. The rules sit with the card scheme, not your bank — so the same broad framework applies whether you’re with ASB, BNZ or any other Visa/Mastercard issuer in New Zealand.

You can typically lodge a chargeback for any of these:

• A charge you didn’t make or authorise (card-not-present fraud)
• Goods or services not delivered, or not as described
• A duplicate charge or an incorrect amount
• A refund that was promised but never arrived (you only need to wait 15 days after the promised refund date before lodging)
• A merchant that has gone out of business before delivering

The time limit is what trips travellers up. Visa and Mastercard generally allow 120 days from the date of the transaction — or, where you’ve paid for a future service like a flight or hotel stay, 120 days from the expected provision of that service. So if you booked a hotel six months ahead and the booking turned out to be fake, the clock starts from your check-in date, not your payment date.

The catch: if you only realise the booking was fake when you arrive at the hotel and it doesn’t exist, you may already be very close to the cut-off. Don’t sit on it.

How do I actually lodge a dispute?

Each NZ bank handles disputes slightly differently, but the general flow is the same: you provide evidence, the bank pursues the chargeback through the card scheme, the merchant gets a chance to respond, and you typically get a provisional credit while it’s investigated.

A few specifics from the major banks:

• ANZ lets you raise disputes through the ANZ App — tap the transaction, then “Something not right?”. They aim to update you within 35 calendar days.
• ASB asks you to call them — there’s no in-app dispute flow. 
• BNZ also requires a phone call to start a chargeback.
• All three banks (and most others) have a downloadable transaction dispute form for cases that need a paper trail.

What the bank will ask for: the transaction details, what you expected to receive, what actually happened, any correspondence with the merchant, and screenshots of the booking confirmation, the suspicious message, and the legitimate hotel’s contact details. Lodge first, gather more evidence as you go — the time limit is the constraint that bites hardest.

What card protections don’t cover: authorised push payment fraud

Chargebacks rely on a card transaction. If the scammer convinces you to do a bank transfer to a “hotel reservation team” instead — a common technique in travel booking scams — you have no card scheme to fall back on. Once the money lands in the recipient’s account, recovery depends entirely on how quickly the receiving bank can freeze it.

These transfers are what regulators and banks call authorised push payment (APP) fraud — you authorised the payment, even though you were lied to about who was receiving it. Until very recently, the Code of Banking Practice didn’t require banks to compensate APP losses at all.

That changed on 30 November 2025.

What’s covered under the new Code of Banking Practice?

The New Zealand Banking Association updated the Code with five new scam-protection commitments that apply to its voluntary signatories — ANZ, ASB, BNZ, Kiwibank and Westpac, plus a number of smaller banks:

1. A Confirmation of Payee service so customers can check the recipient’s name matches the account number before they send.
2. Pre-transaction warnings based on the payment purpose.
3. Identification of high-risk transactions and the ability to block or delay them.
4. A 24/7 reporting channel for customers who think they’ve been scammed.
5. Sharing scammer account information between banks to help freeze funds.

If a bank fails to meet these commitments and a customer suffers an APP scam loss as a result, the bank can be required to compensate the customer up to NZ$500,000. The Banking Ombudsman holds banks to account against the Code and can determine compensation if the customer disagrees with the bank’s decision.

This is a meaningful shift — but the limits matter.

When the new Code won’t help you

The compensation scheme has several significant exclusions that are especially relevant for travel-related scams:

• Marketplace purchases. If you bought through Facebook Marketplace, Trade Me, or a similar online marketplace, you’re not eligible. 
• The $500,000 cap. Compensation above this — or for customers who suffer more than three scam losses in their banking relationship — is at the bank’s discretion.
• Negligence. Banks can decline to compensate customers they consider were dishonest or didn’t take reasonable steps to protect themselves. Ignoring a Confirmation of Payee “no match” warning, for example, may count.
• International transfers. The Code is a domestic framework. Recovering money sent overseas — common in travel scams, where the “hotel” is in another country — depends on cooperation from the receiving bank, and chances of recovery drop sharply once funds leave New Zealand.
• Voluntary scheme. The Code only binds NZBA member banks. Non-members aren’t required to participate.

Does Confirmation of Payee actually catch travel scams?

Sometimes — but not the offshore ones. Confirmation of Payee was rolled out across NZ banks from November 2024, with full implementation by Easter 2025. When you set up a new payee or edit an existing one, the system tells you whether the name you’ve entered matches the account holder’s name on file with their bank.

It’s a useful guardrail when a scammer is using a New Zealand mule account — you’ll see “No Match” before you send. But Confirmation of Payee does not check overseas accounts, businesses with registered bill payee details, or previously saved payees. Travel scams that route funds to a foreign account — which is most of them — won’t trigger the warning.

What should you do if you think you’ve been scammed?

Speed matters. The 120-day chargeback clock and the bank’s ability to freeze a domestic recipient account both shrink the longer you wait. Practical sequence:

1. Contact your bank immediately. Use the new 24/7 scam reporting channel if available. Ask them to flag the transaction, freeze the card, and start a dispute.
2. Lodge a chargeback if you paid by Visa or Mastercard credit or debit card. Don’t wait for the merchant to respond first — your bank can chase the merchant during the dispute process.
3. Report it. CERT NZ collects scam reports and can advise on next steps. For losses from a financial scam, the Financial Markets Authority maintains scam warnings and can refer cases.
4. Escalate to the Banking Ombudsman if your bank declines or you’re unhappy with the outcome. The Ombudsman service is free for consumers and can review cases against the Code.

Frequently asked questions

Will my credit card travel insurance cover a scam?

Probably not in the way you’d hope. Complimentary travel insurance bundled with rewards credit cards typically covers trip cancellation due to illness or accident, lost luggage, and medical events — not scam losses on a fake booking. If you’ve already paid the scammer, your route to recovery is through a chargeback or the Code of Banking Practice, not the insurance attached to your card. See our guide to credit cards with travel insurance for what those policies actually cover.

What if I paid with a debit card instead of a credit card?

Debit cards on the Visa or Mastercard rails are still eligible for chargebacks under the same 120-day rules. The practical difference: the money has already left your account, so any provisional credit during the dispute investigation is genuinely useful — a credit-card dispute pauses billing for that charge, while a debit-card dispute is recovering money you’ve already lost from your day-to-day balance.

What about a multi-currency travel card?

Travel money cards — including pre-paid multi-currency cards from providers like Wise, Revolut and Air NZ Onesmart — vary in their dispute processes, and not all are issued by NZBA member banks. Read the terms before you load funds; recovery options on a non-bank-issued prepaid card can be substantially weaker than on a credit card.

How long does a dispute take?

ANZ aims to update customers within 35 calendar days. The full process — including the merchant’s right to respond and any escalation through the Visa or Mastercard dispute system — can take 60 to 120 days end-to-end. The Banking Ombudsman process adds further time on top if you escalate.

Can I escalate above the Banking Ombudsman?

The Banking Ombudsman is the final point of dispute resolution for most NZ retail banking complaints. Customers can take banks to court instead, but the Ombudsman scheme is free and binding on the bank up to a defined limit, which most consumer cases sit comfortably within.

Travel scams won’t disappear — they run on the urgency and trust travellers naturally extend to their booking platforms, and they’ve grown more convincing as scammers get better at sourcing real booking data. The card-scheme rules and the new Code of Banking Practice are real protections, but they only work if you act fast and pay through a channel that gives you somewhere to escalate. Compare other travel credit cards to see which ones come with the strongest fraud and chargeback support before your next trip.