Fraud Management & Cybercrime
,
Fraud Risk Management
Treasury Yet to Release Sector-Specific Controls and Reimbursement Mechanisms
Australia introduced the world to the first-ever scam prevention law that promised to make the country the hardest place on earth for fraudsters. Eight months later, it’s trapped in bureaucratic limbo – passed, praised and still waiting to work.
See Also: Tokenization, Authentication, and the Future of Machine-Led Transactions
Australia introduced the Scam Prevention Framework law in February, which was hailed as a ground-breaking legislation by experts across the globe. This was probably the first time a framework focused not only on the banks but also brought in other stakeholders, including technology companies and telcos.
Nearly nine months on, the bubble has burst. The initial euphoria has given way to a long, frustrating wait. The Australian Treasury is yet to release the sector-specific controls and reimbursement mechanisms defining how compliance would be measured and when consumers would be entitled to compensation – fundamentals to the framework’s implementation. Touted as the “world’s toughest anti-scam laws” earlier this year, the legislation is essentially lying dormant.
Australia’s federal election, held in May, was expected to cause only a brief pause. But even with the Albanese government returned, policy momentum never quite recovered. Instead, the frameworks fell into a post-election log-jam – made worse by the exit of Australia’s Assistant Treasurer and Minister for Financial Services Stephen Jones, the key minister who had driven the scam prevention agenda and chose not to recontest his seat.
Control-Based Reimbursement
The Australian experience highlights how tough it is to define what compliance actually means when controls are tied to reimbursement obligations. “When you look at countries that have controls tied into reimbursement, it becomes really difficult to see what is going to really happen there. It sounds much better to the consumer than it may ever be,” Ken Palla, retired director with MUFG Bank told Information Security Media Group.
For example, if a telecommunications provider blocks 95% of scam messages, it demonstrates strong performance, since 100% protection was never guaranteed in the first place. “In this case, if a customer falls victim to a romance scam from the remaining 5%, the telco may still be considered compliant due to its reasonable efforts,” said Palla.
In contrast, if a bank’s system detected a mismatch between the payee name and account details but failed to notify the customer, the liability is clearer. The bank had a functioning control that identified the risk but failed to act, making it harder to argue compliance.
The first scenario covers probabilistic controls – those that reduce risk but can never eliminate it entirely. The second involves absolute, binary failures. Most scam-prevention measures fall into the first category, Palla said.
The Silver Lining
Despite the Treasury’s inaction, banks in Australia have taken the lead to roll out controls for scams prevention. The top banks have taken various steps including confirmation of payee, written scam prevention strategy and information sharing through the Australian Financial Crimes Exchange. Early indications suggest these efforts are having an impact. Scam losses in 2024 were lower than in 2023. The National Anti‑Scam Centre reported that financial losses fell 33.1% to AUD 318.8 million – $210.3 million – in 2024 compared with 2023. For 2025, data is not yet available.
Australia has been here before. The Privacy Act reforms, first proposed after the 2020 review, spent years inching through consultations and exposure drafts, slowed by the same policy machinery now holding back the Scams Prevention Framework. The law exists, but its power remains theoretical – another file waiting to move off the Treasury’s desk.