Australia’s Scams Framework Criticized Over Major Exclusions

Australia’s proposed Scams Prevention Framework leaves key scam-enabling entities outside its initial scope, raising questions about whether the model can deliver the consumer protection it promises.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The Scams Prevention Framework is a regulatory regime designed to reduce scam-related harm by imposing mandatory prevention, detection and response obligations on banks, telecom providers and major digital platforms.

Treasury submissions show that stakeholders are calling for the inclusion of non-bank payment service providers, cryptocurrency platforms, email services and voice-over-Internet-protocol communications, among others under the regulations, arguing these channels form the backbone of how scams are initiated and monetized.

The National Anti-Scam Centre in its Q4 2024 report identified email as one of the most common points of contact for scammers. Despite being a major entry point for scam activity, email services are not currently covered under the proposed framework.

Submissions also highlight the growing role of VoIP services, with one commenter noting that 46% of fraudulent calls originate from VoIP-enabled devices. These systems allow fraudsters to spoof phone numbers and caller IDs, making it easier to impersonate banks and government agencies, but VoIP providers remain outside the framework’s scope.

The exclusion of cryptocurrency exchanges and crypto ATMs has drawn particular criticism, given their role in investment scams – Australia’s costliest scam category. Investment scams led to the highest overall losses at $34.9 million in just three months, with 523 Australians reporting financial losses, NASC found.

Cryptocurrency was the third-most common payment method for scam losses during the quarter. A total of 141 victims reported $10 million lost through cryptocurrency, representing 15% of all scam losses reported in Q4, despite crypto being used in far fewer transactions than bank transfers.

Investment scams consistently topped the loss charts across nearly all demographics tracked by the NASC, mirroring international trends. Treasury submissions argue that excluding cryptocurrency platforms from the framework creates a significant vulnerability in Australia’s approach to combating its most financially damaging scam category. Without regulatory oversight and liability requirements for crypto exchanges, victims who lose money through these platforms may have limited recourse for reimbursement.

Apart from the exclusions, critics have pointed to a lack of clarity on how reimbursement would work across different scam scenarios. While the framework introduces obligations and liability for receiving banks, the patchwork of inclusions and exclusions creates uncertainty, said Ken Palla, former director of MUFG Bank.

For instance, if a scam initiates via an email, passes through an excluded entity such as a non-bank payment service provider and ends at an excluded destination such as an international receiving bank, it is unclear how the liability would be split.

“The Treasury needs to provide clear guidance through either a comprehensive chart or detailed explanations showing potential recovery outcomes for different scam scenarios,” Palla wrote in his submission.

Proposed Intelligence-Sharing Requirement

Proposals before Treasury are pushing for a stronger intelligence-sharing regime aimed at cutting off scam proceeds before they move through layers of money mule accounts. Under one recommendation, banks would be required to share information on confirmed mule accounts from the framework’s launch date.

Palla said stricter action should apply to both sending and receiving banks if they are alerted to known mule activity but fail to take reasonable action. “The goal is to disrupt scam networks by stopping stolen funds from being rapidly transferred across multiple accounts, a common tactic used to obscure the trail and launder proceeds,” Palla said.