Australia’s Scams Prevention Framework: What Your Business Needs to Know

Let’s be honest – scams are more than pop-ups or an occasional suspicious email. They are indeed a billion-dollar nuisance right across Australia, putting ordinary people in financial trouble and making all of us more wary of doing business online.

And that’s where the Scams Prevention Framework (SPF) of the Australian Government comes in. It’s a game changer, in every sense of the word, and if you are in business – especially banking, telcos, or online platforms – you need to know how this is going to impact you.

So, then, what is this framework?

In effect, the SPF transfers part of responsibility from consumers to business. Instead of telling consumers “Be careful online,” now companies are being told by the government “you need to do your part to protect your customers.”

This system targets scams where an individual tries to trick consumers to release money or personal information. Look at those bank phish texts asking you to “validate your information” or those investment proposals that sound too good to be true that you are sent through your social media.

The SPF does not include old-fashioned credit card scams where someone’s card is stolen, or defective product issues (there is other law to handle those). It’s to help everyday Australians and small business operators from being caught out by scams that exploit online facilities.

What will your business need to do?

If you are in a regulated sector, you will need to take reasonable measures in three respects:

1. Prevent scams from even reaching your customers. It is as simple as screening out suspicious communication or removing bogus ads from your site. It’s similar to putting in place security fencing before anything happens.
2. Catch scam activity early when it does happen. You might need to have systems flagging suspicious behaviour or suspect transactions. The sooner you catch something suspicious, the more likely that you will be able to bring it down.
3. Disrupt active scams to minimise harm. This includes freezing suspicious transactions, reaching out to customers who might already be victimised by them, or adding extra steps to verify when something seems off.

Banks, telcos, and online platforms are first in line for these new obligations. To clarify this, you will shortly see mandatory sectoral codes of practice that explain in detail what “reasonable steps” are for your sector.

You need to share your knowledge.

One of the truly smart things about this system is recognising that no one business receives the full picture. It will then be your responsibility to report instances of scams that you detect to the ACCC, who will share information with other businesses as well as with law enforcement.

This collective system makes sure that when one business learns about a novel scam technique, all the rest are able to update their defence in good time. It’s neighbourhood watch, but in cyberspace – and makes Australia very much more difficult to scam from other parts of the globe.

What if you don’t keep up?

Penalties are severe – up to $50 million in fines. In addition, if your business owes money to a customer as a result of failing to fulfill an order, then they are entitled to redress through existing redress arrangements.

The framework also makes complaint processes more transparent. Your business will need to have transparent internal processes for dealing with disputes, and customers have the ability to escalate outstanding complaints to an independent body such as the Australian Financial Complaints Authority. There is also a “no wrong door” principle – customers are able to report to whatever business engaged in their scam experience, and businesses will need to work together to sort out the issue.

The bottom line

This is not another box to check in terms of compliance. This is about actively being involved in combating scams that victimise your customers and undermine confidence in doing business online.

In fact, to do so will mean reviewing your processes, possibly making an investment in technology, and training your staff to identify and respond to attempted scams. There is also, however, an opportunity to demonstrate that you are concerned with keeping customers secure, and with how to improve relationships in the process. Ditch “buyer beware” and passing the bucket of responsibility. We are all in this together now – and probably always have been. By doing things correctly in the spirit of the SPF, you are not only keeping to the letter of the law; you are also assisting in keeping communities online safer where your customers can interact in confidence.