Banks and telcos have had to join AFCA since 1 September but scam complaints do not start until 2027

Since 1 September 2026, every designated bank, telco and digital platform in Australia must be a member of the Australian Financial Complaints Authority for the purposes of scams.

If you are scammed today, you cannot take that complaint to AFCA.

The membership obligation started on 1 September 2026. The right to complain starts on 31 March 2027. In between sits a seven month window in which the obligation exists and the remedy does not, and almost nothing written about this framework has said so.

Australians reported losing $2.18 billion to scams in 2025. For culturally and linguistically diverse communities, the median reported loss was $750, nearly double the $400 median across all reporters.

What the law is, and what commenced when

The Scams Prevention Framework Act 2025, Act No. 15 of 2025, received assent on 20 February 2025 and commenced the following day. It amends the Competition and Consumer Act 2010, inserting a new Part IVF.

That is the trap in most coverage. The Act commenced in February 2025. The dates people are quoting for 2026 and 2027 come from a separate instrument made more than a year later.

That instrument is the Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026, made by the Assistant Treasurer and Minister for Financial Services, Dr Daniel Mulino, on 22 May 2026 and commencing on 29 May 2026. It is the instrument that decides who is covered and from when.

It phases the obligations in three stages, in identical terms for each sector. Until 1 September 2026, only the code-making provisions and the authorisation of an external dispute resolution scheme apply. From 1 September 2026 until 31 March 2027, the requirement to be a member of a scams external dispute resolution scheme is added. From 31 March 2027, the whole of Part IVF applies.

A second instrument, made on 2 June 2026 and commencing 1 July 2026, authorises AFCA as the external dispute resolution scheme for all three sectors.

Who is actually covered

The designation names three sectors, and each is drawn more narrowly than the shorthand suggests.

Banking means a service provided by an authorised deposit-taking institution in the course of its banking business in Australia, plus purchased payment facilities where those are provided by such an institution. So the major banks, the mutuals and the credit unions are in. Non-bank payment providers, fintechs that are not authorised deposit-taking institutions and cryptocurrency exchanges are not. The sector regulator is ASIC.

Telecommunications means a voice call service or a message service provided by a carrier and a public carriage service provider using a listed carriage service. That definition excludes voice calls and messages carried wholly over the internet. So a scam call over the mobile network is inside the framework and the same conversation over an internet messaging app is not, unless it is caught by the third sector. The sector regulator is ACMA.

Digital platforms means a designated instant messaging service, a designated internet search service or a designated social media service, and the definitions carry careful exclusions. Search covers paid advertising material on general purpose search engines. Social media excludes instant messaging, voice and video calling, email, gaming, review sites, education, health and, notably, dating and matrimonial services. The instrument names no sector regulator for digital platforms, and the ACCC has said it fills that role as well as being the general regulator.

No individual businesses are named anywhere. Capture works by service definition, so there is no published list of designated companies to check yourself against.

The catch, in the instrument’s own words

The external dispute resolution authorisation contains a single sentence that governs everything a consumer can actually do.

It provides that the operator of the AFCA scheme may only consider complaints if the matter to which the complaint relates occurs on or after 31 March 2027.

So membership from 1 September 2026 buys a consumer nothing on its own. It puts firms into the scheme and makes non-membership a contravention, which for a company carries a maximum penalty in the tens of millions. It does not create a complaint pathway for anything that happens before the end of March next year.

Anyone telling readers they can take a scam to AFCA from September is wrong, and the point matters because a person who loses money in October and believes they have a remedy may not pursue the ones they do have.

What does exist right now

One thing does apply already, and it is more useful to a reader today than the framework.

The ordinary internal dispute resolution process at your bank, followed by AFCA’s existing jurisdiction over financial firms, has not gone anywhere. AFCA determinations bind the member firm if the complainant accepts them, and the service is free to consumers.

As at June 2026 the role of Chief Executive Officer and Chief Ombudsman at AFCA was held on an acting basis by Dr June Smith. AFCA has also appointed a Chief Scams Officer, David Lacey.

What Australians lost, and the direction it moved

The National Anti-Scam Centre’s report Targeting Scams, published on 30 March 2026, is the authoritative national count. It combines data from Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, IDCARE and ASIC.

Australians reported losing $2.18 billion in 2025, an increase of 7.8 per cent on 2024. There were 481,523 reports, down 2.3 per cent. The median loss fell from $500 to $400.

The report’s own reading of that combination is that more people are being successfully targeted while the amounts lost are lower.

Across five years the trend is not a straight line. Losses ran $1.8 billion in 2021, $3.1 billion in 2022, $2.7 billion in 2023, $2.0 billion in 2024 and $2.2 billion in 2025. So 2025 is up on the year before and down nearly 30 per cent on the 2022 peak. Reporting it as scam losses soaring would be wrong.

By category, investment scams took $837.7 million, payment redirection $166.8 million, romance $139.9 million, phishing $97.6 million and remote access $69.9 million.

What the 51.4 per cent figure means

A number from that report has been circulating in a form that is simply wrong.

The report records that job and employment scam reports rose 102.4 per cent in 2025, and that the increase was driven partly by increased reporting from at-risk communities: 76.3 per cent from First Nations people, 114.0 per cent from people with disability, and 51.4 per cent from culturally and linguistically diverse communities.

The 51.4 per cent is a year-on-year increase in the number of job scam reports from people who identified as speaking a language other than English. It is not the share of job scam reports coming from those communities. Any article stating it as a share is reporting something that is not in the data.

The underlying figures are these. In 2025 there were 10,065 Scamwatch reports from people who identified as culturally and linguistically diverse. Of those, 2,282 reported money stolen, totalling $38.8 million. The median loss in that group was $750, nearly double the $400 median across all reporters in the combined national data.

The National Anti-Scam Centre’s 2025 report does not publish a category breakdown for culturally and linguistically diverse reporters. Identity theft reports from those communities rose 13.7 per cent, and the number reporting a loss to identity theft almost doubled.

One line from the report connects directly to the exploitation of visa holders: job and employment scams are on the rise within these communities as they are known to target international students and non-resident visa holders.

What the report cannot tell you

The report contains a footnote that decides how far any of this can be pushed.

The Scamwatch form provides an optional field for a reporter to indicate that they speak a language other than English.

So culturally and linguistically diverse in this report means only that. There is no breakdown by country of birth, by language or by community. The word India does not appear in the report.

Any claim about what Indian Australians specifically lost to scams in 2025 would be an invention, and none is made here.

There is a second limit. Scamwatch accounted for 39.2 per cent of all reports but only 12.8 per cent of all losses, and 85.9 per cent of Scamwatch reports involve no financial loss at all. The report warns explicitly against drawing conclusions about total losses from Scamwatch alone.

What is documented about scams targeting Indian Australians

Here the picture is thinner than the community’s experience suggests, and the gap is itself the finding.

Where the national report explains the very large threat-based losses in diverse communities, it attributes them primarily to Chinese authority scams, where scammers impersonate overseas law enforcement and threaten imprisonment or deportation. Australian regulators’ and police campaigns on fake authority scams have been predominantly focused on Chinese-language communities.

What to do with all of this

Until 31 March 2027, if you are scammed, your route is your bank’s internal complaints process and then AFCA’s existing jurisdiction. Report to Scamwatch and to ReportCyber, and contact IDCARE if identity documents are involved.

Tell older relatives the one thing that defeats every version of the authority scam. No Indian agency, no Australian agency and no High Commission will telephone to demand money or threaten arrest. Hang up and call back on a number you looked up yourself.

And if you work with community organisations, the numbers that should shape your programs are these. Threat-based scams are where the largest single losses fall, on the figures the National Anti-Scam Centre does publish. It is a small number of people losing very large sums, with a median above $54,000. That is where the money is going, and it is not where most scam education is aimed.