TL;DR: Federal Parliament passed the Scams Prevention Framework (SPF) on 13 February 2025. It puts legal duties on businesses expected to be designated first: banks, telcos and digital platforms (social media, paid search ads, messaging). They must prevent, detect, report, disrupt and respond to scams. Penalties go up to about $52.7 million. But unlike the UK, there’s no mandatory reimbursement; instead you get internal complaints, a single external scheme (likely AFCA) and the right to sue.
The basics
From Bird & Bird’s explainer:
- Passed: 13 February 2025, and has Royal Assent.
- Lead regulator: the ACCC.
- Sector codes: ASIC enforces the banking code; ACMA the telco code.
- First sectors expected: telecommunications, banking, and digital platforms (social media, paid search advertising, direct messaging). Designation still needs confirming.
The six principles
| Principle | What businesses must do |
|---|---|
| Governance | Written anti-scam policies, reviewed and certified yearly |
| Prevent | Reasonable steps to stop scams |
| Detect | Investigate scam intelligence; identify affected customers |
| Report | Share actionable scam intelligence with the ACCC |
| Disrupt | Act to stop scams and losses (with legal protection for good-faith action) |
| Respond | Easy scam reporting for customers, plus internal dispute resolution |
Penalties
- Tier 1 (prevent, detect, disrupt, respond): up to the greater of about $52.7 million, three times the benefit, or 30% of adjusted turnover.
- Tier 2 (codes, governance, reporting): up to about $10.5 million, three times the benefit, or 10% of turnover.
What it means if you’re scammed
Here’s the honest part. There’s no automatic refund. The UK made banks reimburse most push-payment scam victims; Australia chose a different path:
- Complain to the business through its internal dispute resolution.
- Escalate to a single external dispute resolution scheme, expected to be AFCA.
- You (or a regulator on your behalf) can sue a business that broke its SPF obligations to recover losses.
So the framework gives you leverage: if your bank ignored obvious red flags, or a platform kept running a reported scam ad, that’s now a legal failing, not just bad manners.
What’s still to come
The government still has to confirm designated sectors, consult on sector codes, and make the SPF Rules. Start dates for specific obligations depend on that.
2026 update: the detail arrives
The framework is moving from law to rules. Law firm Herbert Smith Freehills Kramer summarised Stage 1 in June 2026:
| Milestone | Date |
|---|---|
| SPF Act in force | 21 February 2025 |
| Designation instrument (banks, telcos, digital platforms) takes effect | 23 May 2026 |
| Treasury releases draft rules and sector codes | 28 May 2026 |
| Key bank obligations start | from 31 March 2027 |
| AFCA expected to handle SPF complaints | from 31 March 2027 |
| Scam intelligence sharing and reporting | by end of 2027 |
Two proposals stand out for consumers:
- Automatic reimbursement for verified losses under $3,000, through ministerial guidance in the SPF rules.
- Shared liability: where several businesses (say, a bank and a telco) breached their obligations, liability would generally be split equally.
AFCA has already changed its constitution (26 May 2026) so it can cover telcos and digital platforms, not just banks. These were still drafts when HSF wrote, so check the final rules before relying on them.
What to do in the meantime
- Use bank tools like Confirmation of Payee.
- Report scams fast: your bank first, then Scamwatch (how).
- Keep records of every report you make, which matters for later complaints.
A free exposure check shows if your contact details are in the breach data scammers use.
Frequently Asked Questions
When does the Scams Prevention Framework start protecting consumers?
Banks, telcos and digital platforms were designated from 23 May 2026. Key bank obligations and AFCA complaints are expected from 31 March 2027.
Will scam victims be reimbursed under the SPF?
Draft rules released in May 2026 propose automatic reimbursement for verified losses under $3,000. Check the final rules.
When was the Scams Prevention Framework passed?
Federal Parliament passed it on 13 February 2025.
Does the Scams Prevention Framework make banks refund scam victims?
No. Australia did not adopt mandatory reimbursement. Victims can use internal complaints, external dispute resolution and court action.
Which businesses does the SPF cover?
Banks, telcos and digital platforms are expected to be designated first.
What are the penalties under the SPF?
Up to about $52.7 million, three times the benefit, or 30% of adjusted turnover for the most serious breaches.
Sources
- HSF Kramer: Stage 1 of the Scams Prevention Framework (Jun 2026)
- Bird & Bird: Explainer, Australia's new Scam Prevention Framework