Scams Prevention Framework Bill 2024
Ms TINK (North Sydney) (20:26): It's not a stretch to say that literally everyone I know has received a scam phone call, email or text message in the last month and that almost once a week I find myself talking to my parents, my kids or my friends about a message they've received that they're just not sure should be opened. Whether it's banking, socialising, managing our health, shopping or communicating with government agencies, like the ATO, our everyday lives are increasingly being funnelled online.
In this context, it's untenable to try and avoid scams by simply following the advice that is, 'If you don't know, don't open it,' especially when the upshot of not opening something might mean missing an important appointment window or getting smacked with a late fee. Sadly, however, gone are the days of the dodgy kerbside charlatan urging us to 'watch the cup' as a strategy to fleece us of our money.
Scams these days are sophisticated, pervasive and almost entirely online. Even for the most diligent and informed of us, they are difficult to spot and avoid. As Australian citizens we're particularly susceptible, because our current industry-led protections are minimal, piecemeal and inconsistent.
As the minister has noted, an eye watering $2.74 billion was lost by Australians to scammers in 2023. While that is a huge sum, the truth is that it's likely even higher, as many people will not report the experience once they've been stung. Losses frequently also go far beyond financial pain, extending to a loss of security, confidence and, ultimately, wellbeing.
As a smart, compassionate and innovative society, this vulnerability cannot be allowed to continue. While I would much prefer industry self-regulation to have been the answer, that has not worked. As such, we're left with no choice but for the government to step in.
In this context, I welcome this debate on the proposed Scams Prevention Framework Bill 2024, as I believe legislative reform is now necessary to modernise consumer protections for the digital age. This legislation has at least started a conversation around responsibility and accountability that is well past due. Unfortunately, I think there are still serious shortcomings in this bill that need to be addressed.
The principles based obligations being applied through the legislation to regulated entities offering regulated services in regulated sectors provides clarity to sectors, in terms of minimum expectations for preventing, detecting, reporting, disrupting and responding to scams. The requirement that regulated entities not only maintain records and share information across the scam's ecosystem but also implement internal dispute resolution processes for consumers subject to scams is a great place to start.
Yet both my community and I believe this legislation should have gone forward, and, unlike the member who we just heard speak, my community believes that we should have been brought into line with other jurisdictions like the UK where these entities are not just responsible for tackling the problem but ultimately also liable for compensation. If there's one thing we know to be true, it is that money is an extraordinary motivator.
Similarly, while the bill accounts for the ever-evolving scams landscape by giving the minister the ability to designate new 'regulated sectors' and develop sector-specific codes as required, I note a general concern, echoed by the scrutiny committee, that this government is increasingly relying on the provision of ministerial discretion in its legislation and placing matters integral to the operation of the bills in delegated legislation.
This worries me for two reasons: firstly, while it may make sense in the short term, it also creates potential problems as ministers and government and ambitions change; and, secondly, it sends a signal that the government isn't certain it has gotten the legislation right in the first place, so it's providing itself with a 'just in case' card that could enable future decisions that are inconsistent with this parliament's ambitions.
In terms of oversight, the bill establishes civil penalties for regulated entities and identifies the ACCC as the Scams Prevention Framework general regulator, giving the ACCC the overarching responsibility of providing oversight and acting as a repository for scams information. It may be that the ACCC is the agency best placed to manage this, but with several other responsibilities recently passed to this body, including oversight of all measures and acquisitions in this country, I'm honestly worried it will be swamped.
I therefore urge the government in the strongest possible terms to ensure the ACCC is adequately funded and resourced and for my colleagues in this place to be diligent when it comes to scrutinising future budgets to ensure this resource commitment is maintained. We cannot afford for this government to make these steps and decisions now only to allow future government to come in and gut the undertaking.
I would also like to make the additional comment that the Australian Financial Complaints Authority has been identified as the external dispute regulator—an entity that already has lengthy wait times and, in my constituents' personal experience, a frustrating lack of effectiveness given the disappointingly narrow remit in the types of disputes it will resolve.
Again, this needs to be adequately scoped and resourced. Finally and most critically, the bill provides a redress mechanism for scam victims where a regulated entity is found to have contravened a civil penalty provision, a provision that for many really cuts to the heart of the current weakness in our domestic environment—that being a complete lack of clarity around who is responsible for losses incurred via third-party platforms.
As I've said previously, while I welcome the clarity, we need greater responsibility for compensation being passed to the channels that most frequently allow the abuse. As this legislation seeks to clarify obligations, responsibilities and pathways for dispute resolution, it has failed to transfer enough of the burden of combating scams and absorbing the financial losses to those best placed to address them.
All too frequently, people will share their heartbreaking stories of being scammed with me, and, every time they do, I'm left frustrated and angry. One person recently contacted me because their elderly parents had lost $250,000 to an investment scam that was presented as an opportunity with two well-known financial institutions. Once discovered, neither institution accepted any responsibility for the counterfeiting of their brand or their response.
Quite frankly, they were completely heartless. Another person told me about their experience of signing up for a recurrent monthly charge to join what was eventually proven to be a fake dating site. Shockingly, in this case, the bank refused to help the person affected recover their payments because the bank argued the customer had given their details freely.
The HSBC impersonation scam impacted several people in my community. I can't help but feel strongly that scams involving banks are particularly egregious. In a digital economy, where branches are being closed every day and speaking to a real person on the ground in Australia can be such a challenge, many of us have no choice but to rely on internet banking.
Surely, then, aside from the transactional convenience, banks should be ultimately responsible for ensuring they provide us with a safe place to keep our money and processes that ensure fraudulent transactions cannot be progressed without complete certainty that our money is going to a legitimate purpose. It used to take 10 days for a cheque to clear and three days or more for funds to transfer between banks.
How is it not possible then to institute some sort of airlock function that creates opportunities for transactions to be scrutinised before they're finalised? In almost all cases, the frustrating reality is that people who are scammed are not clear about who they should contact or how to pursue a remedy, and, whilst trying to deal with what is often a significant personal loss, they are left feeling angry, embarrassed and helpless.
Concerningly, a recent investigation by the Sydney Morning Herald suggests Google's search algorithms are in fact routing us to fraudsters, with fake websites and investment platforms and fake reviews, including AI generated celebrity endorsements, proliferating online. Yet there is little to no accountability. In trying to search the internet to determine what to do about a potential scam, we're being unwittingly delivered into the hands of the scammers themselves, and the catch-22 situation continues, with the boundaries between real and fake becoming increasingly sophisticated and the pathways for help harder to find.
The data tells us scams disproportionately impact older, more vulnerable Australians including those from non-English-speaking backgrounds, while social media scams took over $200,000 from kids under 18 in 2024 alone. Yet, as platforms like Meta and Google and banks like CBA and Westpac post eye-watering profits, those fleeced of money via their channels are left holding the can.
Helping vulnerable individuals navigate the complicated complaints and dispute resolution process is absolutely a priority. Victims of scams reeling from the sick feeling of having been duped out of their hard earned savings should not have to prove that the multiple organisations involved, from telcos to banks and from social media platforms to search engines themselves, have not complied with their own antiscam processes.
To do so would be impossible, given it would require consumers to have access to documents and evidence held by the regulated entity who themselves would be incentivised to delay or fail to disclose that information. The cost, time and difficulty in seeking compensation could discourage claims even when there is a notional dispute resolution process in place.
It's clear that the burden of proof should be on industry participants to show compliance with the Scams Prevention Framework in defence of claims. I support the amendments proposed by the member for Mackellar and the member for Warringah that seek to level the playing field through additional, reasonable steps regulated entities must take to protect vulnerable community members and a presumption of disclosure of relevant documents to assist victims in pursuing their complaints.
I also agree with ASIC's recommendation that broadly states that, where compensation has been paid to a victim of a particular scam, all victims of the scam should be automatically eligible for reimbursement without having to undertake their own complaints processes. To me, it's just logical, efficient and fair. As more and more services push consumers to transact entirely online, surely those services have a responsibility to foot the bill when scammers successfully hack or mimic their processes.
Instead, while this legislation provides scam victims with a mechanism for the recovery of damages, it stopped short of following the UK in implementing mandatory compensation. As of October last year, people in the UK who fall foul of a scam can claim up to 85,000 pounds compensation, and it will be given to them within five days. It's possible because the cost of that compensation is now split between the banks of both the victim and the fraudster.
Interestingly, the UK already had a robust voluntary code for reimbursement which covered about 90 per cent of scam losses, but we have no such code in Australia, with the data instead suggesting that just four per cent of scam losses are recovered by victims. This is perhaps the most crucial shortcoming of this bill. A presumption of reimbursement, except in the case of negligence, seems obvious to me if we are to truly incentivise financial institutions, telcos and other entities to do more than just meet the minimum obligations and to avoid placing the onus on scams victims to fight for compensation.
I support the recommendation of Senator Pocock and the Consumer Action Law Centre that compensation be presumed when a regulated entity is found not to have complied with their obligations under the framework and codes. Again, this just seems logical and fair to me. Consumers should not have to jump through hoops to be reimbursed following negligence from their bank or telco.
Without a direct bottom-line incentive, I don't believe there's enough in this legislation to ensure industry invests sufficiently to keep pace with AI and the sophistication of scammers more broadly. I'm also left wondering whether the multiregulator model and proposed information-sharing protocols will result in efficient, real-time intelligence sharing or if the system will simply be too unwieldy.
With many regulators in the mix and the overlay of privacy obligations, I hope the extra regulatory and compliance costs are warranted, but this is yet to be seen. Finally, I was really pleased to see recent government investment in a broader public education campaign about scams and identification. Scamwatch is a fantastic resource, and I have personally seen it in action twice, during two community seminars that my team and I hosted with Scamwatch in North Sydney.
The Scamwatch presenters were articulate and compassionate and patiently taught people how to not only recognise but also respond to scams. Our second session was bilingual, presented in both English and Mandarin, and the response to it was incredible, proving that people armed with the information they need are more confident. For this reason, I believe any education in this space that ensures the phrase 'Stop, check, protect' becomes as iconic as 'Slip, slop, slap' is worthwhile.
In closing, while I stand by my statement at the outset that this bill takes some steps in the right direction, it's yet another piece of legislation from this government that falls short of how far it could have gone. Instead of rushing through a legislative program with cursory scrutiny, the government would do to well to pick a few key pieces of legislation that the community wants and needs, like this one, and focus on getting it completely right.