Is PayID Safe for Everyday Payments and Online Casinos?

Few payment features have spread through Australian banking as quickly as PayID. It appears in marketplace adverts, invoices, sport club fee pages and casino cashiers, and its reputation for being safe sits beside a steady stream of warnings about PayID scams. Both things are true. The system is well built for the job it does, and its design leaves some gaps that fraudsters use. This page explains where the real protection lies and where it does not.

What PayID Is and Why It Exists

PayID is an alias for a bank account. Instead of sharing a BSB and account number, you register a mobile number, an email address, an ABN or an organisation identifier with your bank, and people who know the alias can pay you. The bank links the alias to a single account at a time and can move it to another account or institution if you ask.

It operates on the New Payments Platform, the real-time infrastructure that Australian banks and other institutions launched in February 2018. The platform processes payments one by one, around the clock, instead of in overnight batches, so money usually moves within a minute or so. Osko is the name of a payment service that runs on the platform, and some banks use it to label the faster transfer. Osko can also be used with a BSB and account number, so it does not depend on having a PayID.

What PayID Gets Right

A few design features really do improve safety compared with older transfer methods.

• Less sensitive information shared. A person paying you does not need your account number, which reduces the details floating around in messages, invoices and online adverts.
• A name check before payment. When you enter a PayID, your banking app shows the name registered to it. If the name does not match the person or business you expect, you can stop before sending anything.
• Ownership verification. Banks confirm that you control a mobile number or email address before it can be registered, using a one-time code.
• Real-time visibility. Payments settle quickly, so both sides can see the result at once, which removes the multi-day ambiguity of an old-style transfer.
• Bank fraud monitoring. Payments sit inside your bank's usual security systems, including holds on unusual transfers.

The name check is the feature most worth using. It turns a blind transfer into a verified one, but only if you actually read the name and compare it with what you expect.

What PayID Does Not Protect Against

The same real-time speed that makes PayID convenient also makes it unforgiving. A confirmed PayID payment is final. The sender cannot recall it, and the bank has no automatic way to take it back from the recipient. This is true of most account-to-account transfers, but the speed leaves little time to catch a mistake.

Reading across the table, PayID guards the address and not the decision. It cannot tell whether the payment is wise, whether the seller is honest or whether a message asking you to pay is genuine. Those judgements stay with the person holding the phone.

PayID Versus a BSB and Account Number

People sometimes ask whether PayID is safer than paying with a BSB and account number. The honest answer is that it is safer in some respects and the same in others. The table compares the two for an ordinary person-to-person payment.

The comparison favours PayID mainly because of the name check, which is a genuine reduction in misdirected payments. It does not change the fact that a payment, once sent, is hard to recover.

PayID Scams and How They Work

Most PayID losses come from social engineering and not from technical failure. Scammers rely on the trust attached to the name and on the speed of the payment.

The classic version targets people selling items online. A fake buyer says they have sent the payment but that something went wrong. A message arrives, often made to look like it comes from PayID or from the bank, saying the seller must upgrade to a business account or pay a fee before the money can be released. The seller sends the fee and the money never comes. In 2022, Scamwatch recorded losses of roughly A$260,000 to this kind of PayID impersonation, and the pattern has returned with new wording since.

If you think you have been targeted, contact your bank at once. Early reports sometimes give the bank a chance to freeze or trace a payment. Then report the incident to Scamwatch and to ReportCyber, and do not send further money in the hope of recovering what you lost.

What Other People Can See

When someone enters your PayID, their banking app shows a name that identifies the account holder. For a personal PayID this is generally the name on the account, and banks decide exactly how it appears, with some masking part of it. That is useful for confirming a payment is going to the right person, and it is also the reason to think about which alias you give out.

A mobile number or email address you use publicly, for example on a classified advertisement, lets any stranger find out the name linked to it by starting a payment. If privacy matters, consider registering an email address used only for payments. You can also move a PayID, so a changed alias is not a permanent decision. A business that wants to share a payment address openly can register an ABN or an organisation identifier instead of a personal mobile number.

How to Set Up PayID Safely

Registering a PayID is simple, and doing it carefully removes a few avoidable problems. Most banks follow the same pattern.

1. Open your banking app or online banking and find the PayID option, usually under profile, settings or payment settings.
2. Choose the alias type, most commonly a mobile number or an email address.
3. Pick the account that should receive payments sent to that alias.
4. Enter the verification code the bank sends to the number or address.
5. Confirm the registration and test it with a small payment from another account.

A few practical notes help. The alias must be one you control, because anyone with access to that phone or inbox can interfere with the registration. If you change your mobile number, update the PayID before the old number is recycled. And if you move your PayID to a different account or bank, it becomes unavailable for payments to the old one, which can cause confusion in the changeover.

Business PayIDs and ABNs

Businesses can register an ABN or an organisation identifier as a PayID, and that makes invoicing simpler because customers pay an address that is not tied to a personal phone. The name shown to the payer is the business name registered on the account. For customers, the business PayID is a reasonable reassurance, since the banking app displays the payee before the money leaves.

The practical rule for anyone receiving a payment request is to compare the PayID on an invoice with the details previously provided by the business through another channel. Invoice fraud works by altering a PayID or account detail on a genuine-looking document. A short phone call to a number you already trust is a better check than a reply to the email that contains the invoice.

PayID With CommBank

The Commonwealth Bank is the largest retail bank in the country, and many searches for PayID setup refer to it. In the CommBank app, the PayID option sits in the profile area under Manage PayID. In NetBank, the equivalent path runs through Settings, Payment Settings and PayID. You can register a mobile number or an email address, and the bank verifies each with a code.

The bank applies a few rules that are worth knowing. The mobile number generally has to be the primary mobile on the customer profile, so out-of-date contact details can block registration. A PayID links to one account at a time, though it can be moved between accounts or to another bank. Joint account holders can each link their own mobile number to the shared account. Transfers sent to a PayID are generally free for CommBank customers, and the bank treats a first payment to a new payee with caution, which can mean a hold of up to a day.

If You Have Paid the Wrong Person

Mistakes happen, and a quick response matters. A PayID payment cannot be recalled by the sender, yet there are steps that give you the best available chance of recovering the money.

1. Contact your bank immediately through its fraud line or in-app chat and give the amount, the time and the PayID used.
2. Ask the bank to contact the receiving institution, since banks can request the return of a mistaken payment.
3. Write down what happened while the details are fresh, including screenshots of the confirmation screen.
4. If a scam is involved, report it to Scamwatch and to ReportCyber, and tell the bank that you have done so.
5. Watch for follow-up messages from people offering to recover the money for a fee, since this is itself a common scam.

Whether the money comes back depends on whether the recipient still has it and agrees to return it. A mistaken payment to an honest person is often returned. A payment to a scammer usually is not, which is why the confirmation screen deserves a slow, deliberate look every time.

Limits and Holds That Protect You

Several features that can seem annoying are protective. The New Payments Platform has no limits of its own, but each bank sets daily limits that vary by account type and channel. Reducing your limit in the app is a deliberate safety step, because it caps the damage if your phone is stolen or you are talked into a payment.

Holds on first-time payments exist for the same reason. A hold on a large transfer to an unfamiliar recipient gives you a window to realise you have been deceived. If your bank holds a payment and calls you, answer questions honestly and do not dismiss the fraud team as an inconvenience.

Keeping the Phone and the App Secure

Because PayID payments start in the banking app, the safety of the phone is part of the safety of the payment. A device without a screen lock lets anyone who picks it up send money in seconds. Set a passcode or biometric lock, turn on the banking app's own login protection and enable remote lock features so that a lost phone can be disabled.

Keep software updated, install apps only from official stores and be wary of links sent in messages claiming to be from your bank. The bank will not ask you to move money to a safe account and will not request a code that it has just sent to you. If a call seems to come from the bank, hang up and ring the number printed on your card, because caller identification can be faked.

Using PayID at Online Casinos

When PayID is used to fund a casino account, the technical safety is the same, and the destination is what changes. A casino that supports PayID gives you an address or a reference, you check the payee name and confirm the transfer. The payment cannot be recalled afterwards, so any later dispute with the operator has to be settled with the operator.

Several other points apply. Some Australian banks block or limit payments to gambling merchants, which can cause a deposit to be declined. The payee name on the confirmation screen may be a payment company, not the casino brand. And withdrawals are a separate matter, since a casino may accept PayID deposits and pay out by another route. Treat each deposit as final, set the amount before opening the app and never share banking credentials with a casino or its support chat.

The Legal Position

Payment safety and legal status are separate questions. PayID can be perfectly secure while the service it pays is not authorised in Australia. The Interactive Gambling Act 2001 bans operators from providing online casino games, including pokies, to people in Australia, and it limits advertising of them. The offence belongs to the operator, so a customer paying an offshore site is not committing one, but the site is not licensed or supervised here either.

The Australian Communications and Media Authority blocks illegal gambling sites, and replacements appear after each block. Because there is no local licence, there is also no local regulator or ombudsman to approach about a frozen balance. A bank that declines a gambling payment is acting on its own risk rules, and the decision is worth respecting. For anyone worried about gambling, Gambling Help Online offers free, confidential support on 1800 858 858.

Fast Payments and Slow Decisions

Speed is the feature that makes PayID pleasant and the feature that scammers exploit. Urgency is the common thread in nearly every PayID fraud: the buyer who needs the refund now, the fake notice that threatens to cancel your account, the caller who says funds are at risk. A genuine payment problem rarely needs to be solved within five minutes. When a message creates pressure, that pressure is the warning sign. Put the phone down, check the banking app directly and speak to someone you trust before sending anything.

The same principle applies to spending on entertainment. A transfer that takes seconds to send removes the pause that used to exist between deciding and paying, so build the pause back in with limits and a fixed amount decided before you open the app.

A Short Safety Checklist

• Read the payee name and the amount before confirming any PayID payment.
• Treat any message that asks you to pay in order to receive money as a scam.
• Keep passwords, one-time codes and banking apps private and locked.
• Set a daily payment limit that fits your needs, not the maximum the bank offers.
• Register a PayID only to a phone number or email address you control.
• Check your banking app, not an email link, to see whether money has arrived.

With those habits in place, PayID is a sound way to make and receive payments. It will not rescue anyone from a bad decision, but it does remove several of the risks that older transfer methods carried.