Australians lost $2 billion to scams – and are still waiting for new anti-scam measures to take effect
- Written by Mohiuddin Ahmed, Associate Professor in Cyber Security, Adelaide University
Australians lost more than A$2 billion to scams in 2025, new figures from the Australian Competition and Consumer Commission (ACCC) show.
This was a 7.8% increase compared to 2024. And it’s in spite of the fact the federal government passed legislation in February 2025 enforcing strict anti-scam obligations on banks, telcos and social media platforms.
Those obligations, however, aren’t yet in force. So what explains the delay? And what can Australians do to protect themselves from scams in the meantime?
Top tactics used by scammers
The National Anti-Scam Centre reported five major types of scam:
- Investment: victims are tricked into investing in fake opportunities. This was the top tactic used by scammers, responsible for more than A$837 million in losses last year.
- Payment redirection: scammers pose as a supplier or business owner and advise changes of bank account to redirect an invoice payment.
- Romance: victims fall for fake profiles and get emotionally manipulated to send money.
- Phishing: scammers try to collect sensitive information by impersonating legitimate organisations via calls, texts or email. 5.Remote Access: victims are tricked by scammers to allow access to their smart devices online.
The common aspect among all these different types of scams is the human factor – the scammers were successful because a human interaction was involved. It’s not only the sophistication of the scam tactics but also the human psychology that gets exploited. Scammers rely on victims’ emotion, trust, greed, urgency and fear to manipulate them into doing something they should not.
New anti-scam measures
The Scams Prevention Framework passed Australian parliament in February 2025 and reiterated its emphasis on banks, telcos and digital platforms including social media companies such as Meta (owner of Instagram and Facebook).
The framework aims to address scams by requiring regulated businesses to take reasonable steps to:
- prevent scams from reaching the victims
- detect scams as they are happening or already happened, and
- disrupt suspected activities to avoid potential losses.
Reasonable steps need to be treated with context and the type of organisations and scams.
For example, banks can incorporate advanced technologies to detect high-risk payments. Social media companies such as Meta can use algorithms to detect and disrupt fake investment opportunities. And telcos can prevent scam calls or texts reaching their customers.
Businesses must also have a transparent internal dispute resolution process to address their customer complaints. When this is unable to resolve a complaint, victims can go to an external dispute resolution body, such as the Australian Financial Complaints Authority.
Although this framework has already passed federal parliament, it is not yet active.
That’s because the federal government is still in the process of finalising the mandatory industry codes of conduct that will outline the obligations for each sector.
These sector codes are being developed in consultation with the industry and consumers.
The finer details of the internal and external dispute resolution processes are also expected to be included in further legislation.
The subtle difference between hacking and scamming also makes it really difficult to define the scope of the framework – and could lead to further delays in enforcement down the track.
According to the scam prevention framework, cybercrime such as gaining personal information via a data breach or hacking is not considered a scam.
But in reality, scamming and hacking both fall under the umbrella of cybercrime or technology-based crime. Hackers can collect mobile numbers from a data breach. They can then launch sophisticated scam campaigns via text messages or calls.
Take the following hypothetical example of an investment scam.
A group of hackers access the server of bank X and obtain the personal information of one of the bank’s former customers. They then use this information for a successful investment scam, leading to the victim losing thousands of dollars from their new account with bank Y.
Who has the obligation to protect the victim? Is it bank X or bank Y?
Such complexities can lead to significant delays in making the scam prevention framework an active law.
Know your scams
It is impossible to fully stop scammers as they are continuously evolving their tactics. Advances in artificial intelligence are making it even easier for scammers to deceive people.
While the scam prevention framework will likely help when it’s eventually operational, it’s also important we all improve our skills to better identify scams.
One way to do this is by taking “scam quizzes” which test your ability to detect scams.
Governments – both state and federal – could also establish initiatives to develop scam resilience tests to help people learn more and improve their scam-spotting skills, similar to driving theory tests.
Authors: Mohiuddin Ahmed, Associate Professor in Cyber Security, Adelaide University
