Most of us barely think about it anymore. Tap your phone for a coffee on Darby Street, tap again at Coles or Woolies, then check out online with a card that’s saved in your digital wallet. It’s quick, it’s convenient, and for plenty of people it’s now the default way to pay.
The good news is that digital wallets like Apple Pay and Google Pay are well protected. Your actual card number isn’t shared with the shop, and each payment needs your face, fingerprint or passcode. In many ways they’re safer than carrying a physical card. The catch? A digital wallet is only as safe as the phone it lives on, and the logins attached to it.
A few simple habits go a long way. Here’s how to keep your digital wallet, and the money behind it, safe.
Know where the real risk is
Scammers rarely try to break into a digital wallet directly. It’s far easier to trick the person holding the phone. Phishing, where a fake text, email or call tries to get your login details or a one-time code, was the most reported scam in Australia in 2025, with 65,361 reports, according to the National Anti-Scam Centre. Across all scam types, Australians lost $2.18 billion.
That’s why most of the steps below are about habits rather than technology. If you’d like to know how digital wallets keep your card details secure in the first place, our earlier article on digital wallet security covers it.
Lock down your phone
Keep it updated. Phone and app updates often fix security holes that scammers already know how to use. Turning on automatic updates means you don’t have to remember.
Use your face or fingerprint. Biometric unlock is much harder to get around than a short code. If your phone supports it, use it both to unlock the phone and to approve payments.
Set a proper passcode. Your passcode is the backup when biometrics don’t work, so make it six digits or more, and not your birthday.
Protect your logins
Use a different password for every account. If one password leaks in a data breach, it can’t then be used to get into anything else. A reputable password manager makes this manageable, because it creates and remembers strong passwords for you.
Switch to a passkey where it’s offered. Some apps and banks now let you sign in with a passkey, which uses your phone’s face or fingerprint check instead of a password. There’s nothing to steal or to type into a fake website, which is exactly the point.
Never share a one-time code. Codes sent by text or app are there to prove it’s really you. Your bank, myGov or a delivery company will never ask you to read one out. If someone does, hang up.
Be sensible on public Wi-Fi
Most banking apps and websites now encrypt your connection, so free Wi-Fi at the airport or the library is less risky than it once was. Even so, it’s worth using mobile data for anything involving your money, and steering clear of public networks that ask you to sign in through an unfamiliar page.
Use the checks your bank gives you
Turn on transaction alerts. Most banking apps can notify you of every purchase, or of anything over an amount you choose. It’s the quickest way to spot a payment you didn’t make.
Pay attention to the name check. Since July 2025, Australian banks have been rolling out Confirmation of Payee. When you pay someone new using a BSB and account number, your bank checks the name you’ve entered and tells you whether it’s a match, a close match or no match. PayID payments also show you a name before you pay. If what you see doesn’t look right, stop and check before sending anything.
Check your statements anyway. Alerts can be switched off by accident, so a quick look over your statements each month is still worth the few minutes.
Act quickly if your phone is lost or stolen
Lock or erase it remotely. Use Find My on an iPhone, or Google’s Find Hub on Android, to lock the phone or wipe it.
Call your bank. They can suspend the cards in your digital wallet and keep an eye out for unusual activity.
Change your passwords. Start with your email and banking, since those are the keys to everything else.
It’s better to lock your phone and then find it down the side of the couch than to wait and wish you hadn’t.
Know where to get help
If you think you’ve been scammed, contact your bank straight away. Speed matters, and they may be able to stop a payment. Then report it to Scamwatch, which helps authorities track and disrupt scams. If your personal details have been stolen, IDCARE, Australia’s national identity and cyber support service, can help you make a free plan to limit the damage. Call them on 1800 595 160.
For more on how scammers target older Australians, and how to protect your family, read our article on scams and elder financial abuse.
Keep a trusted adviser in the loop
Good security habits protect your day-to-day spending. Protecting the bigger picture, your savings, super and investments, is where an adviser can help. A second opinion before you move a large sum is one of the simplest protections there is.
This is the sort of thing we cover with clients across Newcastle and the Hunter as part of our financial planning and wealth creation conversations.
Talk to Virtuous Wealth
If you’d like a hand making sure the money you’ve worked hard for stays protected, we’d love to have a chat. Get in touch with our Newcastle team to book a no-obligation conversation.
This article provides general information only and does not take into account your personal objectives, financial situation or needs. Before acting on any information, you should consider its appropriateness, having regard to your own circumstances, and seek personal financial advice from a licensed adviser.
