Under Australian consumer law, a dangerous product must be reported, recalled and fixed at the supplier’s cost. When a bank’s faulty account-keeping systems let criminals scam your bank account or credit card or home deposit, the victim pays, sometimes with interest. Our submission asks Treasury to close that gap.
Make it stand out
Our letter to Treasury
To the Director, Product Safety Unit, Competition and Consumer Policy Division, The Treasury
Scam Victim Alliance (SVA) welcomes Treasury’s Consultation Regulation Impact Statement, Strengthening post-market regulation of unsafe products in the Australian Consumer Law. Our community has lived experience with life-changing financial fraud. Most know that Australia protects people from faulty washing machines better than it does when they make financial decisions like transferring money into a term deposit, taking out a mortgage or switching superannuation.
Under the Australian Consumer Law, when a product causes danger, the supplier or manufacturer must report it, recall it and fix it at its own cost, restoring the purchaser to the position they would have been in without the purchase. When a bank, lawyer, accountant, auditor, superannuation fund or Australian Financial Services Licence holder enables fraudsters to create complex schemes to steal, misdirect a mortgage or move someone’s superannuation, that corporation or professional has no obligation to restore the victim’s financial loss.
Australians urgently need the same protections when purchasing financial products as they have when purchasing goods and services.
We would welcome the opportunity to meet Treasury’s Product Safety Unit and Financial System Division, and to connect them directly with victim-survivors whose cases are described here with consent.
Harriet Spring
President, Scam Victim Alliance
Executive summary: corporations that control risk should carry the cost of it
Financial products and the professional services that surround them (lawyers, auditors, accountants) must be regulated in the same way as cars, washing machines and even egg cartels are under the Australian Consumer Law. Organised fraud has migrated to the banking1, legal and accounting systems that move Australians’ money, because those systems carry no product safety duties and the cost of failure lands on the customer. That customer can lose everything, and so has no money to mount a civil case for justice.
Reported scam losses reached $2.18 billion in 20252. A retired couple seeking a “safe” bank term deposit for their retirement can lose $2.5 million in a matter of weeks. Yet the Australian Consumer Law’s product safety regime, the subject of this consultation, does not apply to financial, banking or mortgage services at all.
When an SVA member complained to the ACCC about a bank’s “safety” and anti-scam advertising after losing hundreds of thousands of dollars to mortgage fraud, the ACCC replied that its role “generally does not extend” to financial products and referred them to ASIC, which in turn says it cannot resolve disputes or investigate these types of matters. Compare that with what happens when ASIC can investigate: more than 1,000 HSBC customers reported being scammed by “men with British accents” who impersonated their bank and took over their banking app by demanding a verification code from the thread of SMS messages sent by the legitimate bank.
When Samsung washing machines caught fire3, regulators tracked down every one of more than 144,000 recalled machines4, and consumers were entitled to a refund or replacement. When the ACCC suspected egg producers of trying to cut supply, it litigated for more than three years. When criminals take a home deposit or a retirement nest egg through Australia’s financial system, no regulator recalls the money, and most victims carry the loss for the rest of their lives.
Australia will spend years in court to protect the price of eggs, but has no regulator whose job is to recover a stolen home deposit.
The RIS’s own diagnosis says government must act when suppliers hold the information, consumers carry the cost, and voluntary action is too slow (pp. 7–10). That describes payment misdirection fraud, failed super platforms and the HSBC “unauthorised payments” disaster more precisely than it describes most consumer goods. We recommend that Treasury:
Recognise in the Decision RIS that unaddressed post-market harm in Australia also comes from financial products and professional services, which fall mostly outside Part 3-3 of the ACL.
Legislate an equivalent safety regime for financial products and the professional services that handle client money (banking, payments, superannuation platforms, conveyancing, legal trust account and settlement services, mortgage broking and accounting): mandatory incident reporting, near-miss reporting, published data, funds recall and freeze duties, safety warning notices, intervention powers and real penalties.
Prohibit contracting out. Consumer guarantees cannot be excluded for goods. Banks, law practices and their insurers should not be able to shift cyber-fraud, impersonation and other scam risks onto customers through waiver forms, retainer releases and “customer’s responsibility” clauses.
Direct APRA and ASIC to treat customer scam losses as a prudential and conduct risk that regulated entities must report, measure and remediate, and for which boards are held accountable.
Support the ACL reforms themselves, particularly Options 3, 4, 5, 6 and 8, which set the benchmark financial services should meet.
Part 1: Where the danger now sits
The harm from financial products is comparable to, or greater than, unsafe goods and services
MeasureUnsafe consumer goodsScams and fraud through financial and professional servicesAnnual cost~$5 billion economy-wide, including medical and productivity costs (ACCC, 2019; RIS p. 7)$2.18 billion in reported direct losses in 2025 alone (National Anti-Scam Centre); peak of $3.1 billion in 2022. First Guardian and Shield lost $1.2 billion.People harmed~52,000 injuries and ~780 deaths a year (RIS p. 7)~514,300 Australians victimised in 2022–23 (ABS Personal Fraud). Suicides are not counted.Typical single lossA replaced product, or medical costs$48,925 to $749,637 in a single mortgage fraud eventUnder-reportingOnly 47% of consumers complain (RIS p. 35)Widespread; shame stops many victims reportingWho paysMostly the supplier, through recall, remedy and liabilityMostly the victim, who often keeps paying interest on the stolen funds
Scam figures count only reported cash losses. They exclude legal and forensic costs, lost homes, relationship breakdown, and the psychological harm our members describe as lasting years.
The legal gap: a hairdryer has more safety law than a home deposit
The ACL’s consumer protections are mirrored for financial services in the ASIC Act, covering misleading conduct, unfair terms and service guarantees. There is no mirror of Part 3-3, the product safety regime: no incident reporting, no recall, no safety warning notices, no bans. Legal and accounting services sit in a further gap, regulated by professional bodies whose focus is practitioner conduct, not consumer harm.
Safety dutyDodgy hairdryer (ACL Part 3-3)Bank payment or account (ASIC Act, Banking Code, SPF)Conveyancer, solicitor or accountant handling settlement fundsReport serious harm to a regulator within 2 daysYes (ss 131–132)No equivalentNoRegulator can order a recall or fixYes (s 122)No funds recall duty with set timeframesNoRegulator can publish a safety warningYes (s 129)No product-level warning powerNoPublished incident dataProposed (Option 6d)No losses or recoveries published by bankNoLiability can be contracted awayNo, guarantees cannot be excludedIn practice yes, through scam waiver forms and “customer’s responsibility” termsYes, through retainer releases and capped-liability schemes
The regulatory runaround, in the institutions’ own words
SVA members who seek accountability are passed between bodies that each disclaim responsibility. These responses all relate to one $109,350 property settlement fraud (Case 2, AFCA 12-24-116745).
DateInstitutionWhat it saidNovember 2024InsurersThe retainer contained a release in the law practice’s favour; the practice denied liability and flagged indemnity costs if the claim continuedFebruary 2025Commonwealth BankAdvertising cannot be removed; NameCheck only alerts the customer; checking payees is the customer’s responsibilityApril 2025AFCANot a regulator; would not assess the bank’s compliance with CPS 220 or CPS 230February 2026ACCCIts role generally does not extend to financial products; complain to ASIC, which cannot resolve disputes, or to AFCAMid-2026NSW Legal Services CommissionerDeclined to review; generic warnings to call before paying were treated as reasonable precautions
Every party in the fraud chain was a sophisticated, insured, regulated business. The only party left holding the loss was a first home buyer, who still pays $579 a month in interest to the bank on money he never received. CBA advertises that it is helping to protect Australians from scams, yet it also reported $1 billion of mortgage application fraud to NSW Police. Under the ACL, a goods supplier making safety claims its product could not support would face the full weight of product safety and misleading conduct law.
Accountants and lawyers: liability shields built for professionals, not consumers
Property fraud runs through the professional services that surround a bank. FOI 4410 records AUSTRAC’s view that false documents behind the CBA suspect-loan matter were generated by third parties, possibly including mortgage referrers and accountants. In settlement misdirection, the attack is almost always on a conveyancer’s or solicitor’s email thread.
These professions operate under protections no goods supplier has. Professional standards schemes, approved under state and territory legislation, cap practitioners’ civil liability in exchange for a promise of higher professional standards and self-regulated discipline. The schemes spread nationally after the insurance crisis of the early 2000s that followed the HIH and UMP collapses. Australia is unusual internationally in allowing professionals to cap liability for the damage they cause in this way.
Three features of the accounting scheme matter for scam and fraud victims:
The cap protects the largest firms most. A small practice will never cause damage at the scale of the cap, so the protection is worth most to firms whose work can cause losses in the tens or hundreds of millions.
The scope has widened well beyond audit. Partners who are not accountants can join as affiliate members, and a catch-all category covers services other than audit and insolvency, including consulting. Liability protection designed for a professional crisis now extends to commercial advice.
Self-regulation has not delivered the promised standards. The bargain was capped liability in return for effective internal discipline. Where audits that should detect fraud fall short, victims of that fraud bear losses the cap was never meant to shift onto them.
Former KPMG partner and whistleblower Professor Brendan Lyon is challenging the CA ANZ scheme in the NSW Supreme Court, arguing it undermines accountability and shifts risk onto clients and the public. In August 2026 the Court capped his adverse costs exposure at $25,000 so the challenge can proceed. Schemes must be reapproved periodically, which gives governments a regular opportunity to test whether the bargain has been kept.
Law practices add retainer releases for email risk on top of capped liability and insurer backing. In Case 2, the law practice’s insurer relied on exactly such a release.
The bank says the customer authorised the payment. The lawyer says the customer was warned. The insurer says the customer should have phoned. The regulators say it is someone else’s remit.
Treasury would not accept this for a product that injured a child. It should not accept it for a fraud that takes a family’s home.
Part 2: How to respond when products fail
Two well-known ACCC matters show how seriously Australia treats consumer goods and markets, even when the harm is modest or unproven.
Samsung washing machines: every unit tracked, every consumer remedied
In April 2013 Samsung recalled more than 144,000 top-loading washing machines across six models sold since February 2010, because moisture in electrical connectors could cause fires. More than two years later, the ACCC reported that 45,047 machines were still unaccounted for and that there had been 252 reports of fires or smoking incidents. The ACCC worked with Samsung and NSW Fair Trading to locate the remaining machines, and appealed to the public over the holidays to check the model numbers of family members’ machines.
When repaired machines continued to catch fire, Samsung was pressed to reassess about 32,000 repaired units in March 2016. The ACCC told consumers the machines failed the consumer guarantee of acceptable quality because they had a major safety failure, so owners had a choice of refund or replacement that the recall did not override.
We ask the ACCC, which oversees the National Anti-Scam Centre, to draw three lessons from that response:
Treat every case as a live hazard. The regulator kept searching for years. No regulator tracks a misdirected fraudulent payment or finds the other harmed customers in a fraud reported to the AFCX.
The supplier pays. Samsung paid for the recall, the repair and the remedy; no household paid for its defect. Who is paying for superannuation and bank impersonation fraud? HSBC paid a $35 million penalty in ASIC’s case, yet the bank failed to fully compensate at least 10 of its customers, despite them being mentioned in the court orders.
Make the remedy a right. Consumers should have a remedy as of right, not at a supplier’s discretion, after years of dispute resolution, or only if they can find hundreds of thousands of dollars to mount a legal case.
The egg cartel case: three years of litigation over a market risk
In May 2014 the ACCC sued the Australian Egg Corporation, two egg producers and two executives, alleging they had attempted to induce producers to limit the supply of eggs. The Federal Court dismissed the case in February 2016, and the Full Federal Court dismissed the ACCC’s appeal in September 2017. One former director, who admitted liability before trial, was ordered to pay a $120,000 penalty. In explaining the case, the ACCC noted that Australians spend over half a billion dollars a year on eggs.
SVA does not criticise the ACCC for bringing that case. Protecting a half-billion-dollar market from a possible price effect is a legitimate use of public resources. But no consumer loss was ever proven. The same agency told an SVA representative in February 2026 that the loss of $109,350 from a first home buyer’s settlement was outside its role.
Part 3: How Australia responds when a financial product fails
Homebuyer settlement fraud: SVA’s cohort
SVA has worked directly with 16 Australian homebuyers defrauded at or around settlement: 13 property settlement misdirection frauds and 3 post-settlement follow-on frauds. Individual settlement losses range from $48,925 to $749,637.
Only 1 of 13 settlement cases resulted in full, publicly disclosed reimbursement.
5 of 13 recovered money only through confidential settlements, commonly with non-disclosure conditions.
2 of 13 received nothing, despite criminal investigations and arrests of mule account holders, and are still charged interest on the stolen funds.
NAB and CBA were the most common receiving banks for the mule accounts.
Property scam losses reported to the ACCC rose from $13 million in 2021 to $43.2 million in 2024, according to reported media figures. SVA knows of at least five further cases never reported to police or AFCA.
First Guardian and Shield: retirement savings lost through regulated platforms
The collapse of the First Guardian Master Fund and the Shield Master Fund shows the same failure at a far larger scale, inside the superannuation system. Around 11,800 investors lost more than $1 billion in retirement savings. Many were cold-called by lead generators and referred to financial advisers who used high-pressure tactics to roll their super onto platforms hosting the two funds. About 6,000 people invested in First Guardian, and liquidators found about $446 million remained outstanding. Another 5,800 people invested $480 million in Shield.
Some investors have had their capital returned. Macquarie repaid about $321 million to more than 3,000 Shield investors on its platform, and Netwealth paid about $101 million to more than 1,000 First Guardian investors on its platform. Those payments came only after ASIC action, and returned capital only, not the growth investors lost or the distress they suffered. Based on the reported figures, roughly $500 million of invested capital has not yet been repaid. ASIC’s proceedings against Equity Trustees and Diversa Trustees continue, and the Compensation Scheme of Last Resort caps claims at $150,000 while facing a cost blowout that leaves future victims exposed.
The outcome in these cases depended on which platform a retiree happened to be on. Investors on platforms with deep pockets were repaid their capital within months. Those on other platforms are still waiting, years from retirement or already in it.
Side by side
Samsung washing machinesEgg cartel caseHomebuyer settlement fraudFirst Guardian and ShieldHarm252 reported fires or smoking incidentsNo consumer loss proven~$4.42m lost by 16 households>$1bn lost by ~11,800 investorsRegulator responseNational recall; ACCC and NSW Fair Trading tracked units for yearsACCC litigated 2014–2017Referred between ACCC, ASIC, AFCA and professional bodiesASIC enforcement after collapse; 12 cases against 20 defendants by late 2025Who paidSamsungOne director, $120,000 penaltyThe victims; 1 of 13 fully and publicly reimbursedMacquarie ($321m) and Netwealth ($101m), capital only; ~$500m still unpaidConsumer remedyRefund or replacement as of rightNot applicableNone as of rightCapital only for some; others await courts or CSLR (max $150,000)
Losses that last a lifetime
A scam loss is not a one-off event. For most victims it is a debt or a gap in retirement savings that compounds for decades. Homebuyers who lose a deposit or settlement funds usually borrow to complete the purchase or replace the money, then repay it with interest for the life of the mortgage. Retirees who lose super lose not only the capital but the decades of growth it would have earned. The figures below are illustrative, not actuarial.
LossAmount lostIllustrative lifetime costFirst home buyer, Case 2 (zero reimbursement)$109,350About $245,000 repaid over a 30-year mortgage, including about $136,000 in interestSettlement fraud, Case 1 (zero reimbursement)$449,000About $1.0 million repaid over a 30-year mortgageLargest single settlement loss in SVA cohort$749,637About $1.68 million repaid over a 30-year mortgageAll 13 SVA property settlement cases combined~$2.85 millionAbout $6.4 million repaid if borrowed over 30-year termsFirst Guardian investor reported by the ABC~$370,000 of superAbout $728,000 in forgone retirement savings after 10 years of growthFirst Guardian and Shield capital not yet repaid~$500 millionEvery year unpaid compounds the loss to retirees with no time to rebuild
Assumptions: mortgage figures assume the lost amount is borrowed at 6.35% a year over 30 years, the rate implied by the $579 monthly interest charged in Case 2. The super figure assumes 7% annual growth over 10 years. Actual outcomes vary by loan terms, investment returns and age.
Victims rarely recover from these losses. Unlike a faulty washing machine, there is no refund as of right, no regulator tracking the money, and for many, no prospect of rebuilding savings before retirement. A first home buyer who loses a deposit in their twenties can carry that debt into their fifties. A retiree who loses their super in their sixties has no working life left to replace it.
Part 4: Our evidence and the RIS’s three problems
About Scam Victim Alliance and our evidence
Scam Victim Alliance is a survivor-led advocacy community supporting victims through internal dispute resolution and AFCA. Our evidence comes from victims who are willing to come forward, so it understates the scale of harm. Documents released under FOI 4410 show CBA identified around $1 billion in suspect home loans by February 2026, and AUSTRAC’s Fintel Alliance engaged the ten largest lenders on coordinated mortgage fraud. Property fraud is a systemic problem, not a run of isolated incidents.
Property settlement misdirection fraud follows the same four stages
Lead. Criminals obtain settlement details (amount, address, date, solicitor or conveyancer) through breaches in banking, broking, accounting or conveyancing channels. The buyer does not know this has happened.
Deceive. Criminals take over or imitate the genuine email thread of the solicitor, conveyancer or PEXA, increasingly from inside an authenticated mailbox, so standard email security checks pass. A forged bank statement or invoice replaces the trust account details.
Bleed. The buyer pays, often in a branch or after phoning the bank to lift a transfer limit. Staff rely on generic scam warnings or in-branch “waiver” forms that never explain that solicitor emails can be hijacked.
Clean. Funds land in a mule account at a major receiving bank and are laundered within hours through ATM cash, gold bullion or foreign currency.
Problem 1: the cost falls on the consumer, not the party that controls the risk
The RIS notes that the costs of unsafe products are borne by consumers, governments and health systems rather than suppliers (p. 10). In our cohort, the parties who controlled the risk were the sending bank (payment controls), the receiving bank (account opening and mule detection) and the professional firm (email security). The person who carried the loss was the homebuyer, who in two cases is still paying interest on money they never received.
Problem 2: safety information is incomplete, delayed or withheld
The RIS is concerned that regulators depend on suppliers to report risks and that reporting is too narrow (pp. 8, 34). For scam victims the gap is far worse. Receiving banks do not disclose mule account opening or KYC records to victims. Professional firms do not release mailbox audit logs. AFCA has no power to compel third-party evidence, and has said it is not its role to assess a bank’s compliance with CPS 220 or CPS 230 (AFCA 12-24-116745). No regulator publishes losses or recovery rates by bank.
Problem 3: incentives reward delay and downplay risk
The RIS observes that when corrective action is voluntary and costly, suppliers may delay, limit scope or downplay risk (p. 9). That describes bank scam warnings: templated, generic and designed to transfer liability rather than inform. It also describes outcomes: five of our 13 settlement victims recovered funds only by signing confidential settlements, which keeps the pattern out of public view.
What fair treatment looks like
In AFCA 12-00-1045764 a couple sent $250,715 via an in-branch RTGS form after a fake solicitor email with a forged bank statement. An AFCA panel found matters known to the bank put it on inquiry and its questions were not appropriate. That is the standard banks should meet without victims needing a panel review to get there. New regulatory frameworks and systems are needed to prevent harm.
Part 5: Responses to focus questions
A. Are there problems, and are there emerging issues to consider?
Yes. SVA agrees with the three problems the RIS identifies. The emerging issue we ask Treasury to record is that financial harm from digital systems now rivals physical harm from goods, yet sits outside any equivalent post-market safety regime. The ACCC estimated unsafe products cost about $5 billion a year in 2019 (p. 7). Scam losses run into billions annually, with individual property victims losing close to $1 million in a single transaction.
The Government has staged this reform and flagged general safety protections as a later priority (p. 5). We ask that the later stage expressly consider security defects in consumer devices and digital services that expose consumers to financial harm, coordinated with smart device security standards under the Cyber Security Act 2024. Option 3’s proposal to treat software and firmware updates as recall actions (p. 19) is a sensible first step.
B. Is government intervention warranted?
Yes. The RIS’s case for intervention is that suppliers hold the information, consumers bear the cost, and markets alone will not fix that (p. 10). The same reasoning applies to scam risk in banking, where it is stronger still: a consumer can choose not to buy a product, but cannot choose which bank a criminal opens a mule account with.
C. Which options should be prioritised?
SVA supports a combination, prioritised as follows:
Option 6 (mandatory reporting), especially 6(d), publication of de-identified data. Information is the precondition for every other reform.
Option 5 (targeted intervention powers), because the gap between voluntary action and a compulsory recall is where harm accumulates.
Option 8 (penalties), because a $16,500 maximum for failing to report makes non-compliance a rational business choice.
Option 4(d) (cost recovery), as a statement of principle that the party creating the risk pays.
Option 3, with the liability safeguard in 3(d) strengthened as set out below.
Option 2 alone is insufficient. The RIS itself concludes that non-legislative measures will not address structural limitations (p. 17). Our members have heard “more education” for years while losses rose.
D. What evidence can help?
SVA offers its case files, forensic annexes and AFCA outcome data. We also ask Treasury to note one measurement lesson from scams: losses alone mislead. The framework should measure harm, time to intervention, recovery rates and who ultimately bore the cost. Scam statistics that report losses but not recoveries or reimbursements hide where the cost lands.
Part 6: Responses to option-specific questions
Option 3: voluntary recall processes (Q3.1–3.3)
SVA supports Option 3. We prefer the term “supplier-initiated safety recall”, which names the purpose rather than the supplier’s discretion (3b). We support the broad ISO 10393 definition of recall, including software and firmware updates (3a).
On 3(d), SVA supports clarifying that a recall notice is not an admission of liability, but only if the law states expressly that recall communications remain admissible and that consumer guarantee and Part 3-5 rights are unaffected (p. 21). Our experience with banks is that “no admission” language becomes a shield. Victims are routinely offered money only under confidentiality and non-admission terms that bury the pattern. Any liability protection must not permit confidentiality conditions on consumer remedies.
On 3(c), information sharing for recall purposes should include a matching right for consumers to obtain records about their own harm. Scam victims cannot obtain receiving-bank account records or a professional firm’s mailbox logs, even though these determine liability.
Option 4: compulsory recalls and cost recovery (Q4.1–4.2)
SVA supports 4(b): a regulator should be able to specify the remedy, rather than leaving it to what the supplier thinks appropriate (p. 24). We support cost recovery under 4(d), allocated by capacity to influence or control the risk, and recovered only after consumer remediation is complete (p. 26). Consumers must never be worse off because a cost recovery dispute is running between supply chain parties. This is the same principle SVA asks APRA to apply to sending and receiving banks.
Option 5: targeted intervention powers (Q5.1–5.6)
SVA strongly supports Option 5, including the interim measures in Table 7(b). The RIS cites ASIC’s product intervention power as a model (p. 28). We note that this power has not been used against the payment and account-opening features that enable scams, even though the statutory test of “significant detriment to consumers” is plainly met. Treasury should ask why, and whether ASIC needs clearer direction.
On Q5.6, SVA does not support lower penalties for breaching an intervention direction than for breaching a compulsory recall. A direction is issued because harm is live. A weak sanction invites suppliers to ignore directions and wait for the slower compulsory process.
Option 6: mandatory reporting (Q6.1–6.4)
SVA supports the broadest option: reporting of any injury or illness, with near misses included (6a, 6b). The Consumer Policy Research Centre finding that only 47 per cent of consumers complain (p. 35) matches scam reporting, where shame keeps many victims silent. Supplier-side reporting is the only way to see the full picture.
SVA supports retaining the two-day timeframe (Q6.3). The RIS confirms suppliers need only report what they know and can update later (p. 36). Delay helps no one but the supplier.
SVA strongly supports 6(d), publication of de-identified data, including by product category and by supplier where a pattern is established. Published data changes behaviour. The absence of published scam data by bank is one reason the same banks keep appearing as receiving institutions for mule accounts.
Option 8: penalties (Q8.1–8.4)
SVA supports Option 8. The RIS accepts that for large businesses, compliance can cost more than non-compliance (p. 43). A $16,500 maximum for failing to report a death or serious injury is not a deterrent. SVA supports the proposed $1 million corporate maximum as a floor, and supports expressing penalties in penalty units (Q8.4) so they do not erode again.
Option 9: technical amendments (Q9.1, 9.3)
SVA supports Option 9(e), extending corrective action powers to product-related services. The underlying principle matters well beyond the ACL: a safety risk should be addressed consistently whether it comes from a good or a service. In property fraud, the risk sits in services (conveyancing email systems, bank payment processing), which is exactly where Australia’s corrective action tools are weakest.
Part 7: Applying these principles to APRA and scam risk
Treasury is the portfolio department for both the ACL and APRA. It should not accept a system in which a supplier of goods must report, recall and pay, while an ADI whose controls enable a $449,000 fraud may report nothing, recover nothing and charge the victim interest. SVA asks Treasury to direct, through the Statement of Expectations and its own policy advice, that APRA treat customer scam and fraud losses as a prudential risk, particularly as AI scales the harm of “rogue agents” and other unknowns.
Why financial fraud is a product regulator’s business
Scam and fraud losses reflect failures in the controls regulators already supervise: payment processing, account opening, identity verification, information security and third-party risk. CPS 230 (operational risk) and CPS 234 (information security) bind ADIs on exactly these matters. Yet when a victim raised CPS 220 and CPS 230 compliance, AFCA confirmed it is not a regulator and would not assess it (12-24-116745). No one else does so on a victim’s behalf. The gap is structural.
There is also a prudential case. Losses shifted onto customers do not appear in an ADI’s own operational loss records. Boards and APRA therefore see a smaller fraud problem than actually exists, and the incentive to invest in controls is weakened. FOI 4410 shows how quickly this can scale: one bank identified around $1 billion in suspect home loans, and AUSTRAC is examining whether AML/CTF control failures increased its exposure. In April 2026 APRA itself called for a step change in AI-related risk management, warning banks that AI tools will change the nature of attacks. Property settlement fraud is where that warning is already landing on households.
First Guardian and Shield show the same lesson for APRA-regulated superannuation trustees. Members were protected only where their platform trustee could afford to repay them. Prudential supervision should ensure that outcome does not depend on luck.
What policymakers and regulators could do
Each measure below mirrors a reform Treasury has proposed for unsafe products.
ACL reform proposedEquivalent measure for scam riskMandatory reporting within 2 days (Option 6)Require ADIs to report scam and fraud losses borne by customers as operational risk incidents, and to police, so that statistics are captured by state police and not only through confidential AFCX processesNear-miss reporting (6b)Report interrupted or blocked high-value payments and identified mule accounts, so APRA can see control effectiveness, not just failuresPublish de-identified data (6d)Publish annual industry data by ADI: losses, recovery rates, reimbursement rates, time to freeze, and frequency as a receiving institution for mule accountsRecall of unsafe goods (Options 3–4)A funds recall standard: maximum times for sending banks to request recall and receiving banks to freeze, with recovery outcomes reportedRegulator can specify the remedy (4b)Suspend interest and fees on loan balances attributable to a reported fraud while the dispute is openCost recovery from the party in control (4d)A supervisory expectation that losses are allocated between sending and receiving ADIs by control of the risk, not left with the customerIntervention powers where action is inadequate (Option 5)A thematic review of property settlement payment flows, in-branch “scam waiver” forms and high-value RTGS processes, with remediation directions where controls fall shortPenalties that deter (Option 8)Capital overlays or licence conditions where an ADI’s scam controls are found deficient, as APRA already uses for governance failures
Board accountability
SVA asks that the final CPS 510, and accountability maps under the Financial Accountability Regime, name customer fraud, cyber attacks and impersonation harm as matters boards must set appetite for, monitor and declare on annually. A board that never sees the losses its customers carry cannot govern them.
Alignment with the Scams Prevention Framework
These measures complement the Scams Prevention Framework rather than duplicate it. The SPF sets conduct obligations and AFCA’s role. Regulators’ role is to ensure ADIs have the controls, data and governance to meet them. Without supervision, the SPF depends on victims proving control failures they have no power to see.
Summary of our 21 recommendations
1Record in the Decision RIS that financial products and professional services cause post-market harm comparable to or exceeding unsafe goods, and sit outside ACL Part 3-3TreasuryQ A, B2Legislate a safety regime for financial products and client-money professional services equivalent to Part 3-3: incident reporting, near misses, published data, funds recall and freeze, safety warnings, intervention powers, penaltiesTreasury, ASIC, APRAQ A, C3Prohibit contracting out of liability for cyber-enabled payment fraud through scam waiver forms, retainer releases and “customer’s responsibility” terms, mirroring ACL s 64Treasury, statesQ A4End the referral loop: one regulator accountable for each harm, with a duty to investigate rather than redirectTreasury, ACCC, ASICQ 2.45Refer the regulation of accounting and professional services firms, including professional standards schemes, to the Australian Law Reform Commission; at each scheme reapproval, exclude from caps any client money lost through a practitioner’s compromised systems or through fraud their work should have detectedTreasury, Attorney-General, Standing Council of Attorneys-GeneralQ A6Designate conveyancing, legal trust account, e-conveyancing, mortgage broking and accounting services under the Scams Prevention FrameworkTreasuryQ A7Guarantee full remediation for First Guardian and Shield investors regardless of which platform they used, including lost growth, not capital aloneTreasury, ASIC, APRAQ A, 4.1 (by analogy)8Adopt Options 3, 4, 5, 6 and 8 as a package; Option 2 alone is insufficientTreasuryQ C, Q2.29Liability protection for recalls only with express preservation of consumer rights and no confidentiality conditions on remediesTreasuryQ3.2–3.310Give consumers a right to records about their own harm, matching supplier information-sharing rightsTreasuryQ3.311Allocate cost recovery by control of the risk, only after consumers are remediatedTreasuryQ4.212No lower penalty for breaching an intervention direction than a compulsory recallTreasuryQ5.613Broadest mandatory reporting, including near misses; keep the two-day timeframeTreasuryQ6.1–6.314Publish de-identified incident data, including by supplier where a pattern existsTreasury, ACCCQ6.415Set penalties in penalty units, with $1 million as a corporate floor for reporting failuresTreasuryQ8.1, 8.416Include digital security defects causing financial harm in the next-stage general safety reformsTreasuryQ A17Direct APRA to treat customer scam losses as CPS 230 operational risk incidents, reported by sending and receiving ADITreasury, APRAQ A, B18Require annual publication of scam loss, recovery and mule-account data by ADIAPRAQ6.4 (by analogy)19Set a funds recall and freeze standard, and suspend interest on fraud-related loan balances during disputesAPRA, ASICQ4.1 (by analogy)20Conduct a thematic review of property settlement payment controls and in-branch scam waiver formsAPRAQ5.1 (by analogy)21Name customer scam harm in final CPS 510 and FAR accountability mapsAPRAQ A
Have you lost money through a hacked email, a mule account or a failed super platform?
Contact Scam Victim Alliance or visit scamvictimalliance.org.au.
Bharadwaj, Angira. “More than 500 Bankers Sacked for Code of Conduct Breaches in 2025.” Australian Financial Review, 30 November 2025. afr.com
ACCC. “Continued Action Critical to Combat Fraud as Annual Scam Losses Exceed $2 Billion.” 30 March 2026. accc.gov.au
ABC News. “Thousands of Recalled Samsung Washing Machines Still in Use, Pose ‘urgent’ Fire Danger.” 29 May 2015. abc.net.au
ACCC. “Consumer Guarantee Rights Following Samsung Washing Machine Recall.” 28 August 2015. accc.gov.au