Last Updated on 29/10/2025 by Damin Murdock
In response to a vast increase in online scams targeting individual consumers and small businesses, the Australian Government recently enacted the Scams Prevention Framework Act 2025 (Cth) (the “SPFA”).
Passed in February 2025, the SPFA endeavours to fundamentally alter the regulatory landscape of scam prevention across digital platforms. It aims to impose clear obligations on entities across a broad range of designated sectors (regulated sectors), such that responsibility and accountability associated with scam prevention is shifted away from vulnerable consumers and toward the powerful entities that operate online services.
A New Legal Framework
The SPFA strives to create a regulated framework that requires businesses that operate in ‘regulated sectors’ to take reasonable steps to prevent, detect, report, disrupt, and respond to scams. Regulated sectors could include a broad list of businesses or services including, ‘banking, insurance, telecommunications… [and] electronic services… such as social media services.
The entities who run these services (regulated entities), are subsequently obligated to comply with ‘Scam Prevention Principles’ set out in the SPFA and enforced by the Australian Competition and Consumer Commission (ACCC), who acts as the SPFA’s primary regulator.
The Scam Prevention Principles
Pursuant to section 58BA of the SPFA, ‘[e]ach regulated entity must comply with the overarching principles of the Scams Prevention Framework’ and they are obligated to document and implement governance policies and procedures for combatting scams, and to take responsible steps to:
- Prevent scams
- Detect scams
- Report to the ACCC any actionable intelligence (scam risks/incidents)
- Disrupt scams and prevent associated losses
- Provide an accessible scam reporting mechanism for its consumers, and an accessible and transparent internal dispute resolution mechanism for consumer complaints
Applicable Penalties
Where regulated entities fail to meet these obligations, they may be liable to civil penalties. Section 58FK of the SPFA specifies that entities could be required to pay fines up to the greater of approximately $17.5 million, three times the value of the benefit obtained directly or indirectly from the contravention, or 30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention, where there has been a failure to comply with the scam prevention principles to ‘prevent, detect, disrupt and respond.’
Section 58FL of the SPFA, conversely specifies the penalties associated with ‘governance’ and ‘reporting’ obligations, being the greater of approximately $3.5 million, three times the value of the benefit obtained directly or indirectly from the contravention, or 10% of the adjusted turnover of the body corporate.
Finally, sections 58FW and 58FX of the SPFA empowers the Courts to issue injunctions compelling companies to take corrective action or to prevent further harm.
Enforceability Issues
Though the SPFA allows the Minister to formally designate regulated sectors and entities, these have yet to be assigned. The Explanatory Memorandum of the Scam Prevention Framework Bill, which introduced the SPFA clarifies that ‘[t]he Commencement of the SPF[A] does not in itself impose any obligations on entities until a designation is made… and that designation instrument is in force.’ Thus, until these designations are made, the SPFA effectively lacks the practical enforceability to achieve its visions.
Conclusion
The SPFA aims to compel bigger corporations, such as tech giants, banks and telecommunication providers to exercise greater transparency, responsibility and accountability by appropriately detecting, managing, reporting and resolving scams that frequently occur on their platforms and/or services. While this may deeply benefit consumers and small businesses who are vulnerable to fraud, there exists an inertia in ensuring the SPFA is practically effective, as the required designations are yet to occur.
Feel free to contact Damin Murdock at Leo Lawyers via our website, on (02) 8201 0051 or at office@leolawyers.com.au. Further, if you liked this article, please subscribe to our newsletter via our Website, and subscribe to our YouTube , LinkedIn, Facebook and Instagram. If you liked this article or video, please also give us a favourable Google Review.
DISCLAIMER: This is not legal advice and is general information only. You should not rely upon the information contained in this article and if you require specific legal advice, please contact us.
Damin Murdock (J.D | LL.M | BACS - Finance) is a seasoned commercial lawyer with over 17 years of experience, recognised as a trusted legal advisor and courtroom advocate who has built a formidable reputation for delivering strategic legal solutions across corporate, commercial, construction, and technology law. He has held senior leadership positions, including director of a national Australian law firm, principal lawyer of MurdockCheng Legal Practice, and Chief Legal Officer of Lawpath, Australia's largest legal technology platform. Throughout his career, Damin has personally advised more than 2,000 startups and SMEs, earning over 300 five-star reviews from satisfied clients who value his clear communication, commercial pragmatism, and in-depth legal knowledge. As an established legal thought leader, he has hosted over 100 webinars and legal videos that have attracted tens of thousands of views, reinforcing his trusted authority in both legal and business communities."
