Introduced by the Australian government in September, the Scam Prevention Framework (SPF) is the latest policy aimed at protecting scam victims. The framework places significant responsibility on the technology, banking, and telecommunications sectors to develop effective solutions.
Non-compliance could result in hefty penalties, including fines of up to AU$50 million. Additionally, companies that fail to comply may be required to compensate scam victims.
The codes will be mandatory and are expected to be introduced in late 2024.. Australians lost $2.74 billion to scams last year — and that figure is likely underestimated, as many victims do not report their losses. This has become a significant issue affecting society as a whole.
SEE: How Organizations Can Prevent Their Employees Falling for Cyber Scams
How will the Scam Prevention Framework work?
Australia won’t be the first to introduce laws to protect victims from scams.
In 2023, the U.K. passed legislation making the banking industry liable for losses from scams. These laws, which took effect on Oct. 7, 2024, have not yet been fully tested for their impact. However, they allow scammed individuals to claim up to £415,000 in lost money, with few exceptions.
What sets the Australian laws apart is that they also cover tech platforms like Google and Facebook, which frequently host scam ads and allow scammers to operate. Additionally, telecommunications companies are included, as they facilitate the data flow and communication between scammers and their victims.
The key components of the SPF
The SPF laws have been drafted up with five key objectives in mind:
Consumer Protection:
- Financial institutions and telecom operators play a key role in detecting and blocking scam activity before it reaches consumers.
- This also includes public awareness campaigns that educate consumers about the risks of scams and how to protect themselves.
Detection and Reporting:
- The framework supports the development of advanced tools and technologies that help in identifying scams in real time.
- A standardised reporting mechanism is established to ensure that scam incidents are consistently tracked and shared with relevant authorities and industry players.
Industry Collaboration:
- SPF promotes collaboration between financial institutions, telecom companies, and digital platforms to share information about scam trends and emerging threats.
- By creating a unified front, businesses and government can work together to reduce the success rate of scams and limit financial losses.
Government and Law Enforcement:
- Law enforcement agencies are given enhanced powers and resources to investigate and prosecute scammers, particularly those operating internationally.
- The government is also actively involved in policy development and coordination with international bodies to address scams that cross national borders.
Technological Solutions:
- Investments in AI, machine learning, and data analytics help to proactively detect scam patterns and stop them before they impact consumers.
- The SPF encourages innovation and the adoption of cutting-edge tools that can filter scam communications and transactions.
Not everyone is happy with the SPF
The Communications Alliance has raised concerns with the SPF, suggesting that there is a “quadruple jeopardy” liability within the draft legislation.
Luke Coleman, CEO of the Communications Alliance, highlighted that there were already three other government-controlled avenues available to people that telecommunications are liable to make reparations from scams: the Australian Communications and Media Authority, Australian Competition and Consumer Commission, and External Dispute Resolution Scheme. There is also the potential for civil action, including class action.
In a submission to the government in response to the proposed laws, the Communications Alliance made three “key” recommendations for refinement:
Move specific details into sector codes: They recommend shifting detailed provisions from the primary legislation to sector-specific codes, which would be registered and enforced by relevant regulators. This would allow for greater flexibility and ease of enforcement, as each sector, including telecommunications, banking, and digital platforms, faces unique challenges.
Establish a safe harbour from “quadruple jeopardy”: Telecommunications companies could face liability under four concurrent enforcement mechanisms, leading to legal uncertainty. The submission advocates for creating a “safe harbour” for telcos who comply with their sector-specific codes, protecting them from additional penalties by other regulators, dispute resolution bodies, or civil actions.
Accelerate implementation of practical scam-prevention measures: They call for the fast-tracking of initiatives such as the SMS Sender ID registry and reforms to the Numbering Plan. These measures would enhance the ability to prevent scams by improving how sender identities and phone numbers are managed and tracked across the telecommunications industry.
Meanwhile, a consortium of consumer advocates, including Choice and Consumer Action Law Centre, claimed in their own submission that the currently proposed laws would fail to adequately protect consumers. It claimed that the dispute resolution process is “unworkable,” and that “it is designed for businesses to take a minimum-standard compliance approach to obligations, rather than incentivising innovation to keep up with scammers who are always steps ahead.”
What should IT professionals do to prepare?
The SPF isn’t expected to go before parliament until November and, if it is passed, it won’t come into effect until 2025. But IT professionals should take proactive measures to ensure their organizations have a smooth transition into compliance, as the SPF will become a major source of risk, and technology will need to be the answer:
1. Review current security protocols
IT teams should conduct a comprehensive audit of their existing security infrastructure, identifying any gaps in the detection and prevention of scam-related activities. This includes assessing how effectively systems identify phishing attempts, fraudulent transactions, and other forms of cybercrime.
2. Collaborate with cross-industry stakeholders
A core objective of the SPF is to encourage collaboration between technology companies, financial institutions, and telecommunications operators. IT professionals should engage with these stakeholders to ensure that data-sharing protocols are robust and secure, and that the latest scam trends and emerging threats are communicated in real time. This collaborative approach will be essential to staying ahead of increasingly sophisticated scams.
3. Strengthen incident reporting and response
A standardized reporting system is key to ensuring consistent tracking of scams. IT departments should streamline their incident reporting processes to ensure that any scam attempt is documented and shared promptly with relevant authorities and industry players. An efficient response strategy will also mitigate the impact of any successful scams.
4. Enhance consumer education and support
As part of the broader SPF mandate, IT professionals should collaborate with marketing and communications teams to create consumer education programs. By finding ways to leverage technology to help individuals learn how to spot scams, organizations can reduce the likelihood of their customers falling victim to such attacks.
5. Monitor international developments
Given the global nature of scams, IT professionals should take notes from similar regulations in other countries — such as in the U.K. — are being implemented and enforced.
While the specifics of the SPF still need to be ironed out, and the final form of the legislation will no doubt look different than how it is currently presented, it seems likely that Australia will become a world leader in holding multiple sectors to account for consumer protection. This is a big opportunity for IT professionals to show leadership and continue to develop risk mitigation strategies for areas that will be very high on the board priority list.