Scams Prevention Framework Draft Rules and Codes released. Is your business ready?

Sector 

Covered services 

Exceptions

Banking

Services by an authorised deposit-taking institution (ADI) in carrying on its banking business in Australia, and the provision of purchased payment facilities (PPFs) by ADIs.

The SPF Rules exclude:

• standalone PPF providers; and
• business-to-business banking services not provided to retail customers.

Digital platforms

Any of the following:

• Designated instant messaging services: an electronic service that is an instant messaging service (including real-time non-text communication), is not ancillary to another service, does not have a significant purpose of facilitating internal business communication, and is not a designated social media service or covered telecommunications service. 
• Designated internet search services: the provision of advertising material to users of an internet search engine that enables searches of the internet broadly (not limited databases or price comparisons), where that advertising is provided for consideration. 
• Designated social media services: an electronic service with a sole or significant purpose of enabling online social interaction between 2 or more end-users, where users can link to or interact with other users and post material, and the service is not ancillary to another electronic service.

The SPF Rules crucially provide that an entity is only captured if it meets both: 

• the Active Australian User Test (200,000 or more average monthly active Australian users); and 
• the Revenue Test ($1 billion AUD or more global gross revenue). 

Both tests are assessed as at 1 January each year.

Telecommunications

Voice call services and message services where the service is provided: 

• by a carrier and a public carriage service provider; and 
• using a listed carriage service.

This structure means that entities operating only private lines (i.e. closed, controlled networks not using listed carriage services) are not captured.  It also excludes those services delivered wholly over the internet.

Issue

November 2025

May 2026 

Automatic reimbursement for low-value losses up to $3,000

Not foreshadowed.

While an IDR mechanism has been a long-anticipated feature of the SPF, the IDR Position Paper released as part of the exposure draft states that "Ministerial Guidance will make it clear that entities should reimburse consumers for scam losses under $3,000". See below for further analysis on this proposed reimbursement scheme. 

Commencement date

SPF was intended to commence on 1 July 2026, with the foundations of the SPF in place by no later than 30 June 2026.

SPF Rules: commence 1 September 2026.  Parts 2 and 7 (which deal with statements of compliance and record keeping) are not operational until at least 31 March 2027.

SPF Codes: at least 31 March 2027 (approximately 9 months later than the 1 July 2026 commencement date that was set out in the November 2025 position paper).

Timeframe to lodge an IDR Statement of compliance (SOC) 

30 calendar days.

21 calendar days.

Fast-tracked statement for complaints

Treasury indicated that no SOC would be required if the complaint was resolved to a consumer's satisfaction within 5 calendar days.

The new exposure draft package includes a 'fast-track' SOC mechanism: if an entity is satisfied on reasonable grounds that a complaint is resolved to a consumer's satisfaction within 5 business days, it may issue a brief explanation of how the complaint was resolved, instead of the full SOC.  However, the consumer retains the right to request the full SOC, and must be told that they remain entitled to do so.

Consumer contribution ('excess')

Not foreshadowed.

In the Guide to the SPF Rules and Codes, Treasury has specifically requested feedback on whether the IDR guidance in the SPF Rules should allow regulated entities to apply a consumer contribution or excess to scam reimbursements.  

This echoes the UK's APP fraud scheme, which allows (but doesn’t enforce) the application of an 'excess' of up to £100 to encourage consumer caution while minimising harm. 

SPF Principle 

Obligations 

Principle 1: Governance

• Policies and procedures: Regulated entities must develop governance policies and procedures that account for scam risks, consumer vulnerability, service delivery methods, emerging threats, and recent major scam events, and must document how those risks were assessed.  
• Staff training: Staff must be trained upon commencement and annually thereafter to identify scams, support affected consumers, and handle reports and complaints.

Principle 6: Respond

• Systems: Entities must offer a free, accessible, multi-channel scam reporting mechanism which is available at all times.
• Acknowledge and assist: Entities must acknowledge reports within 24 hours, and provide timely assistance.
• IDR and complaints: Entities must maintain a parallel IDR mechanism, acknowledge complaints as soon as practicable, and notify complainants of External Dispute Resolution rights if a complaint is unresolved after 30 days.  Entities must cooperate across sectors on complaints, may decline frivolous or vexatious complaints (with written notice within five business days), and must keep analysable complaints records.

SPF Principle

Common Code

Banking Code

Digital Platforms Code

Telco Code 

Principle 2: Prevent

• Systems: Entities must have and maintain reasonable and secure systems to protect consumer information and accounts, including regular vulnerability assessments and software patching.  
• Supervise: Entities must supervise agents and third-party service providers for compliance with scam-prevention obligations.  
• Monitor: Entities must prevent their brands from being used in brand impersonation scams by monitoring the internet and seeking removal of infringing material.
• Inform: Entities must publish accessible, up-to-date scam awareness information.

• Confirm payee details: Banks must enable payee confirmation before electronic funds transfers, warn consumers if the payee details do not match and offer the option not to proceed.  
• Verify identity: Banks must also verify consumers' identity.
• Systems: Banks must maintain systems to identify high-risk transactions.
• Warnings and action: Banks must issue targeted warnings, and take proportionate action to identify and limit suspect transactions.

• Verify identity: Digital platforms must verify new users' identity, confirm users have not been previously banned, and verify authorised representative status for business accounts.  In addition, platforms must conduct licence and charity registration checks for advertisers.
• Review: Platforms must review advertisements for scam activity before publication.
• Warnings: Platforms must issue targeted warnings to high-risk consumers about specific scam types.

• Verify identity and rights of use: Telcos must verify customer identity before supplying services, and for high-risk services must also confirm rights of use and establish a legitimate use case.  
• Disallow and block: Telcos must not carry calls without a caller ID (CLI), and must block calls or messages using Do Not Originate List numbers or bearing incorrect trust markings.  
• Verify inbound calls: Inbound international calls with an Australian CLI must be verified or flagged, and unverified calls must have their CLI blocked or over-stamped.
• Provide trust info: Originating providers must attach network trust information to legitimate traffic.
• Secure: Telcos must secure their infrastructure against scam use.
• Limit bulk messaging: Prepaid mobile services must impose message volume limits calibrated to scam traffic indicators.
• Assist: Telcos must assist at-risk consumers by activating available tools and providing accessible scam information.

The above proposed obligations complement the introduction of the SMS Sender ID Register from 1 July 2026, which aims to prevent scammers using branded text messages to impersonate well-known brands.

Principle 3: Detect

• Systems and processes: Entities must have reasonable systems, processes, and resources for scam detection.
• Identify and record: Upon receiving actionable scam intelligence (ASI), entities must assess whether the activity is a scam, record investigation details, and maintain systems to identify affected consumers as soon as practicable.

• Monitor: Banks must monitor transactions for unusual activity, and monitor accounts for suspicious changes to credentials or contact details.
• Identify: On receiving ASI, Banks must identify relevant transactions, accounts, and affected consumers.

• Monitor: Platforms must monitor for suspicious user behaviour, content, and messages, though they need not decrypt encrypted messages on designated instant messaging services.  Digital platforms must also monitor and assess advertisements, including re-verifying advertisers if details change, and monitor for suspicious content.

• Monitor: Telcos must monitor networks in real time to validate traffic and identify scam indicators (e.g., high-volume calls, CLI spoofing, routing irregularities). 
• Filter: Originating carriers and message aggregators must use automated filtering to detect scam material in messages.
• Notify: Telcos that identify ASI must notify the originating or interconnected provider within five business days, with acknowledgment from that entity due within two business days.

Principle 5: Disrupt

• Notify: Regulated entities must notify affected consumers promptly and proportionately.
• Assess, act, and reverse where necessary: Entities other than telecommunications providers must also conduct a risk assessment before taking disruptive action, and must reverse that action if the activity turns out not to be a scam.

• Request recalls: Banks must issue payment recall requests when they reasonably believe a transaction is facilitating a scam, and receiving banks must assist.  
• Block, and reverse where necessary: Banks must also freeze, block or otherwise restrict accounts associated with scams.  The restriction used must be proportionate to the risk, and access must be restored if the account holder is demonstrated not to be carrying on scams.

• Warn and suppress: During investigations, digital platforms must warn consumers about, and suppress, suspect content.  
• Remove and block: Once a scam is confirmed, digital platforms must remove the content, block similar material, and disable associated accounts.
• Limit scam ads: Platforms must also prevent scam advertisements by suspending suspect ads pending investigation, and permanently removing confirmed scam ads.

• Block or warn: During investigations, telcos must block the CLI or attach a warning before delivering suspect calls or messages.  
• Interrupt and warn: Once a scam is confirmed, telcos must interrupt traffic from the associated number, and originating providers must warn consumers before carrying calls to that number.
• Seek assistance: Providers must use contractual arrangements to seek international service providers' help blocking material volumes of offshore scam traffic.
• Reverse if necessary: If an activity is not a scam, disruptive action must be reversed within five business days.