For most of the past decade, fighting scams in Australia meant pointing fingers. A victim’s bank blamed the platform where the ad ran; the platform blamed the telco that carried the text; the telco blamed the bank that sent the money. Everyone was a little responsible, so no one was fully accountable. Australia’s Scams Prevention Framework was built to end that game — and this month it started showing its teeth.
What the framework actually does
The Scams Prevention Framework (SPF), which commenced on 21 February 2025, is a genuinely world-first piece of law: rather than regulating one industry, it places binding, enforceable anti-scam obligations across three designated sectors at once — banks, telecommunications providers, and digital platforms such as social media, search and messaging services.
The logic is simple and, in hindsight, obvious. A scam is almost never just a banking failure. It typically begins with a message or an ad, travels across a telco’s network or a platform’s feed, and ends with a bank transfer. Regulate only the bank and you harden the last step while leaving the first two wide open. The SPF instead imposes a shared duty to prevent, detect, disrupt and respond to scams right across that chain.
By the numbers
- Australians reported $2.18 billion in scam losses in 2025 — up 7.8% on 2024, but still down 29.7% from the 2022 peak of $3.1 billion.
- 481,523 scam reports were filed in 2025, of which 274,577 involved direct financial harm.
- Investment scams remained the costliest category at $837.7 million, followed by payment-redirection scams at $166.8 million.
- Top-tier breaches of the SPF carry civil penalties of up to roughly $50 million — or three times the benefit gained, or 30% of turnover during the breach period.
The enforcement architecture takes shape
A framework is only as strong as the machinery behind it, and that machinery is now being assembled. Three moving parts stand out.
1. A single door at AFCA
The Australian Financial Complaints Authority has been designated as the single external dispute-resolution body for scam complaints across all three sectors. That is a quietly radical change: a victim scammed via a social-media ad, a spoofed phone number and a bank transfer no longer has to chase three separate complaints processes. AFCA membership applications for designated entities opened in July 2026, and joining that scheme is now part of the cost of operating in a designated sector.
2. Real penalties
The SPF is backed by serious money. Tier-one contraventions — failures against the core prevent, detect, disrupt and respond principles — attract penalties of around $50 million, or three times the benefit gained, or 30% of adjusted turnover, whichever is greatest. Governance and reporting breaches sit at a still-substantial ceiling near $10 million. These are not parking-fine numbers; they are designed to make board-level risk committees pay attention.
3. A private right of action
Crucially, consumers gain a private right of action — the ability to seek direct compensation from a regulated entity that breaches its obligations. Alongside it, draft rules under consultation have floated mechanisms such as a low-value automatic-reimbursement threshold (a figure around $3,000 has been discussed) to resolve smaller claims quickly without a fight. The direction of travel is unmistakable: if a bank, telco or platform failed to meet its duty and a customer lost money as a result, the customer should be able to recover it.
Who watches whom
The oversight is deliberately distributed to match the sectors. The ACCC acts as the general regulator and framework coordinator; ASIC oversees the banks; and the ACMA supervises the telcos. It is a joined-up model for a joined-up problem, and it mirrors the way scams themselves refuse to respect industry boundaries.
A dose of realism on the numbers
It would be a mistake to read the loss figures as an unbroken victory. Yes, losses are well below the 2022 peak — a real achievement that reflects the intelligence-sharing, the industry Scam-Safe Accord and tools like Confirmation of Payee. But 2025 losses rose 7.8% year on year to $2.18 billion, a reminder that scammers adapt at least as fast as defences are built. As bank-transfer routes are hardened, pressure shifts toward channels with weaker friction. A framework that puts telcos and platforms on the hook is precisely a response to that displacement — closing the seams rather than reinforcing a single wall.
It is worth placing Australia’s approach in global context. The United Kingdom went a different route, mandating that banks reimburse most authorised-push-payment victims up to a fixed cap — a blunt, powerful instrument aimed squarely at one sector. Australia’s model is broader but subtler: instead of a single reimbursement rule directed at banks, it spreads enforceable duties across banks, telcos and platforms and lets liability follow fault along the whole chain. The trade-off is complexity for coverage — harder to administer, but far harder for a scam to slip through by exploiting the gaps between industries. Intelligence-sharing obligations and the full sweep of sector codes are still phasing in toward the 31 March 2027 compliance horizon, so the framework’s real teeth will keep sharpening well into next year.
What businesses should do now
For any organisation in or near a designated sector, the practical work is threefold: confirm your AFCA membership pathway, map your obligations against the prevent-detect-disrupt-respond principles, and stress-test your scam response and reporting before the full compliance obligations bite. Superannuation funds, crypto exchanges, marketplaces and dating platforms are already flagged as candidates for future designation — so businesses adjacent to the current three sectors should treat this as a preview, not someone else’s problem.
For consumers, the change is empowering. For the first time, the law says the responsibility for stopping scams is shared by the powerful institutions that sit along the path your money travels — and if they drop the ball, you have a real avenue to be made whole.
Share this with the person in your life most likely to be targeted. Knowing that banks, telcos and platforms now share the duty to protect you — and that AFCA is a single place to complain — is worth more than any warning label. Send it on.