Why Australia’s whole-of-scam-chain approach is key to winning the war against scammers

One of the most alarming consequences of the recent CrowdStrike technical outage was how quickly scammers moved to take advantage of it. Within 24 hours, the Australian Cyber Security Centre had issued a warning to Australians about the potential risk of scams.

Scammers pounced, impersonating CrowdStrike and Microsoft employees to trick people into providing remote access to their computers or downloading illegitimate software patches.

This is a scary example of the pace at which scammers can evolve their tactics to take advantage of people. It is the reality of what Australia is up against in the war against scammers. It’s not a war against a few keyboard warriors in a basement; it’s a fight against highly sophisticated international criminal gangs who orchestrate these scams.

While some inroads have been made, with losses from scams in Australia last year falling by 13 per cent, they are still way too high. And behind every lost dollar is an Australian with a heartbreaking story.

Winning the war against these international criminal gangs can only be achieved through a collective show of strength from all parts of the scams chain. This includes banks, telecommunication companies, social media giants, government, consumers and crypto exchanges.

Banks have been on the front foot, announcing a Scam-Safe Accord last year, setting out comprehensive anti-scam measures. The accord includes a $100 million investment in a new confirmation-of-payee system and better intelligence sharing between banks, biometric checks and more payment delays and warnings. This builds on the record investments already being made by Australian banks in scam-fighting technology, which has seen a major focus on blocking payments to high-risk crypto exchanges or stopping transfers to dodgy scam accounts.

However, contact by a scammer isn’t usually made through your bank. It often comes via a telecommunications network (SMS or phone call) or on a social media platform or an online marketplace. One tactic involves SMS spoofing, where fraudsters mimic legitimate businesses to send fraudulent text messages urging recipients to click on malicious links or provide sensitive personal information.

Social media platforms are also now rife with fake videos and impersonations of prominent figures such as Twiggy Forrest, Elon Musk, Gina Rinehart and Richard Branson peddling dodgy investment scams. Buying and selling scams, such as fraudsters offering non-existent puppies for sale, are also flooding online marketplaces.

The federal government has committed to introducing legislation in the form of mandatory industry codes, which will set out clear obligations for banks, telcos and social media platforms to protect the community from scams.

While draft legislation is yet to be released, banks support this mandatory code framework that will establish responsibilities for each sector: for telcos to block known scam phone numbers, for the platforms to ensure they don’t advertise scams and take them down when they know customers have been harmed, and for banks to ensure they are blocking transfers to known scam accounts.

It will mean, if a bank, telco or social media platform falls short, there will be consequences, including the potential for penalties and a requirement to compensate scam victims.

Disappointingly, tech companies such as Meta and Google have been coy about their support for these mandatory codes. They need to get onboard.

These codes must focus on proportionate liability across the entire scams chain, where obligations have not been met. This is a much better approach than a UK-style bank reimbursement model, which focuses liability solely on one industry, and would ultimately risk undermining the success of this whole-of-scam-chain approach.

The fundamental flaw with the UK model is that it doesn’t address the core issue – stopping people from being scammed in the first place. This could be why no other country in the world has gone down the same path.

Australia’s whole-of-scam-chain approach and focus on prevention is already starting to work. Last year, scam losses in Britain fell by only 5 per cent, compared with our 13 per cent.

There has also been significant controversy with the UK model. The head of the UK Payment Systems Regulator was recently forced to resign due to a tsunami of criticism over the rollout of its scheme, while TSB, the bank with the highest reimbursement rate in the UK, now receives the highest value of scams of all British banks.

I want to be clear: where Australian banks are at fault, they reimburse victims, and that will continue. However, if the international criminal gangs who run most scams knew money would be simply refunded by the bank, Australia would be putting an even larger target on our back. We would be underwriting criminals and giving a free pass to Silicon Valley.

We need to go the other way and drive these international criminal gangs out of our country, not incentivise them to set up shop here. That’s why our focus on prevention and a united effort across our entire economy will allow us to stay one step ahead of scammers and win this war.

Words: Anna Bligh

Anna BlighScams