Your rights, and where to take a problem
Which Australian body handles which kind of problem, what your consumer guarantees cover on a software purchase, and how to make a complaint that gets somewhere.
Quick answer
Start with the business itself, in writing, with a clear description of the problem and the outcome you want. If that fails, the body you approach depends on the problem: the ACCC for misleading conduct and consumer guarantee issues, your state or territory consumer affairs office for individual disputes, the OAIC for privacy, Scamwatch to report a scam, ReportCyber for cybercrime, and the eSafety Commissioner for online abuse. Your bank comes first whenever money has moved.
Who handles what
| Problem | Where to go | What they do |
|---|---|---|
| Software does not do what was advertised | The vendor first, then the ACCC and your state or territory consumer affairs office | The ACCC administers Australian Consumer Law and acts on misleading conduct; state and territory offices assist with individual disputes. |
| Charged for a renewal you did not expect | The vendor, then your bank or card issuer | The vendor can refund; the card issuer may be able to dispute the transaction depending on the circumstances and timing. |
| Cannot cancel a subscription | The vendor in writing, then consumer affairs in your state or territory | A written record of the attempt is what any later step is built on. |
| Personal information mishandled or exposed | The organisation first, then the OAIC | The OAIC regulates the Privacy Act 1988 (Cth), handles privacy complaints and administers the Notifiable Data Breaches scheme. |
| Money lost to a scam | Your bank immediately, then Scamwatch | Banks can attempt to halt or recall recent transfers; Scamwatch collects reports and issues public warnings. |
| Device compromised or account taken over | ReportCyber, operated via the Australian Cyber Security Centre | Routes cybercrime reports to the relevant police jurisdiction and informs national guidance. |
| Online abuse, image-based abuse, cyberbullying | eSafety Commissioner | Operates complaint schemes and can seek removal of material from services. |
Consumer guarantees on software
Australian Consumer Law attaches guarantees automatically to goods and services supplied to consumers, including software sold as a subscription. The ACCC's site is the authoritative description, and it is worth reading directly rather than through a summary. In broad terms, what is supplied must match the description given, be fit for any purpose the seller said it was fit for, and be supplied with due care and skill.
Three practical points follow.
Guarantees cannot be contracted away
A term in a vendor's agreement disclaiming all warranties does not remove guarantees the law gives you as a consumer in Australia. Agreements in this industry are written for many markets simultaneously, and a clause that is effective elsewhere may simply be ineffective here. A vendor telling you that the terms exclude a remedy is not the end of the matter.
The remedy depends on how serious the failure is
For a minor problem, a business is generally entitled to choose between repairing, replacing or refunding. For a major failure — where the product is substantially unfit for its purpose, or you would not have bought it had you known — the choice is generally yours. Which category a given problem falls into is a judgement, and the ACCC's guidance sets out how the distinction works.
Changing your mind is not a failure
Deciding a subscription was unnecessary does not engage the guarantees. In that situation you are relying on the vendor's own refund policy, which is why the refund window is worth checking before purchase rather than after. Choosing security software covers where to find it.
Subscriptions and automatic renewal
Most complaints about security software are billing complaints rather than software complaints, and the pattern is familiar: a low first term, an automatic renewal at a higher rate, and a charge that arrives when the purchase has been forgotten.
What to do, in order:
Find the original terms
Retrieve the confirmation email from the purchase. It normally states the term, the renewal behaviour and the renewal price, and it is the document any later discussion refers back to.
Contact the vendor in writing
Email or a support ticket, not a phone call, so that the request and its date exist in a form you can produce later. State the outcome you want — cancellation, a refund, or both.
Cancel the renewal itself
Cancelling the subscription in the account area and requesting a refund are two separate actions. Doing one does not do the other.
Give a reasonable time, then escalate
If there is no substantive response, raise it with consumer affairs in your state or territory, and with the ACCC where the conduct looks systemic rather than a one-off error.
Talk to your card issuer
A card issuer may be able to dispute a transaction, and can usually stop a recurring authority from being charged again. The available options and time limits depend on the card scheme and your bank.
Keep the subscription running until a refund is settled if you can. Cancelling first sometimes removes access to the account records you need.
Misleading advertising
Australian Consumer Law prohibits misleading or deceptive conduct in trade or commerce. The prohibition is broad: it covers what a claim implies as well as what it literally says, and it does not require anyone to have intended to mislead.
In this category the claims worth noticing are absolute ones — complete protection, total anonymity, guaranteed removal — and manufactured urgency, such as a discount presented as expiring that is in fact permanent. It also covers affiliate sites. A page paid to promote a product, presenting itself as an independent review or as the vendor's official site, is engaging in exactly the conduct the law addresses. That is why the paid arrangement behind this site appears on its own page, in the footer of every page, and beside every paid link.
Complaints about advertising go to the ACCC. The ACCC does not resolve individual disputes or obtain refunds — that is the role of state and territory consumer affairs offices — but reports inform which conduct it pursues.
Privacy complaints
The Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how covered organisations handle personal information. The Office of the Australian Information Commissioner regulates this and explains on its site which organisations are covered, since some small businesses fall outside the Act.
The usual sequence is to complain to the organisation first and allow it a reasonable period to respond, then to take the complaint to the OAIC if it is not resolved. You can generally ask an organisation what personal information it holds about you and ask for corrections to be made.
The Notifiable Data Breaches scheme requires covered organisations to notify affected individuals and the Commissioner when a data breach is likely to result in serious harm. If you receive such a notification, the practical response is to change the password on the affected service and on anything sharing it, and to turn on multi-factor authentication where it is offered.
Making a complaint that works
- Put it in writing, and keep a copy. A phone call leaves you with nothing to show.
- State the facts in order, with dates. What was bought, when, what was expected, what happened.
- Say what outcome you want. A complaint without a requested remedy invites an apology and nothing else.
- Attach the evidence: the confirmation email, the statement entry, screenshots of the advertised claim.
- Set a reasonable deadline for a response, and say what you will do if it passes.
- Keep the tone factual. The person reading it usually did not cause the problem and can often fix it.
- Escalate in order — the business, then the regulator or consumer affairs office — because most bodies ask whether you contacted the business first.
Related reading
- Choosing security softwareSettling the terms before purchase, which prevents most of the above.
- Fake alerts and scam callsWhat to do immediately if money or access has already been handed over.
- Product coverageWhat is and is not known about the product covered on this site.
- Questions answeredShort answers, including several on refunds and renewals.