Banks and telcos must join AFCA from 1 September but scam complaints do not start until 2027

From tomorrow, every designated bank, telco and digital platform in Australia must be a member of the Australian Financial Complaints Authority for the purposes of scams.

If you are scammed on 2 September, you cannot take that complaint to AFCA.

The membership obligation starts on 1 September 2026. The right to complain starts on 31 March 2027. In between sits a seven month window in which the obligation exists and the remedy does not, and almost nothing written about this framework has said so.

Australians reported losing $2.18 billion to scams in 2025. For culturally and linguistically diverse communities, the median reported loss was $750, nearly double the $400 median for everyone else.

What the law is, and what commenced when

The Scams Prevention Framework Act 2025, Act No. 15 of 2025, received assent on 20 February 2025 and commenced the following day. It amends the Competition and Consumer Act 2010, inserting a new Part IVF.

That is the trap in most coverage. The Act commenced in February 2025. The dates people are quoting for 2026 and 2027 come from a separate instrument made more than a year later.

That instrument is the Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026, made by the Assistant Treasurer and Minister for Financial Services, Dr Daniel Mulino, on 22 May 2026 and commencing on 29 May 2026. It is the instrument that decides who is covered and from when.

It phases the obligations in three stages, in identical terms for each sector. Until 1 September 2026, only the code-making provisions and the authorisation of an external dispute resolution scheme apply. From 1 September 2026 until 31 March 2027, the requirement to be a member of a scams external dispute resolution scheme is added. From 31 March 2027, the whole of Part IVF applies.

A second instrument, made on 2 June 2026 and commencing 1 July 2026, authorises AFCA as the external dispute resolution scheme for all three sectors.

Who is actually covered

The designation names three sectors, and each is drawn more narrowly than the shorthand suggests.

Banking means a service provided by an authorised deposit-taking institution in the course of its banking business in Australia, plus purchased payment facilities where those are provided by such an institution. So the major banks, the mutuals and the credit unions are in. Non-bank payment providers, fintechs that are not authorised deposit-taking institutions and cryptocurrency exchanges are not. The sector regulator is ASIC.

Telecommunications means a voice call service or a message service provided by a carrier and a public carriage service provider using a listed carriage service. That definition excludes voice calls and messages carried wholly over the internet. So a scam call over the mobile network is inside the framework and the same conversation over an internet messaging app is not, unless it is caught by the third sector. The sector regulator is ACMA.

Digital platforms means a designated instant messaging service, a designated internet search service or a designated social media service, and the definitions carry careful exclusions. Search covers paid advertising material on general purpose search engines. Social media excludes instant messaging, voice and video calling, email, gaming, review sites, education, health and, notably, dating and matrimonial services. The instrument names no sector regulator for digital platforms, and the ACCC has said it fills that role as well as being the general regulator.

No individual businesses are named anywhere. Capture works by service definition, so there is no published list of designated companies to check yourself against.

The catch, in the instrument’s own words

The external dispute resolution authorisation contains a single sentence that governs everything a consumer can actually do.

It provides that the operator of the AFCA scheme may only consider complaints if the matter to which the complaint relates occurs on or after 31 March 2027.

So membership from 1 September 2026 buys a consumer nothing on its own. It puts firms into the scheme and makes non-membership a contravention, which for a company carries a maximum penalty in the tens of millions. It does not create a complaint pathway for anything that happens before the end of March next year.

Anyone telling readers they can take a scam to AFCA from September is wrong, and the correction matters because a person who loses money in October and believes they have a remedy may not pursue the ones they do have.

What does exist right now

Two things do apply already, and they are more useful to a reader today than the framework.

From 12 March 2026, AFCA expanded its existing scams jurisdiction to cover receiving banks, and the unauthorised opening of accounts and credit facilities, including where the complainant is not a customer of that bank. In practical terms, that reaches the account the money was sent to, not only the account it left. For a victim whose funds went to a mule account at a different institution, that is a live avenue now.

And the ordinary internal dispute resolution process at your bank, followed by AFCA’s existing jurisdiction over financial firms, has not gone anywhere. AFCA determinations bind the member firm if the complainant accepts them, and the service is free to consumers.

[Unverified] AFCA’s current compensation limits could not be confirmed. The most recent figures found were a consumer cap of $1,263,000 and a small business credit facility cap of $6,317,000, both effective 1 January 2024 and indexed every three years, which puts the next adjustment at 1 January 2027. AFCA’s own site could not be retrieved to confirm they remain current, and what limits will apply to framework scam complaints is not published. Confirm with AFCA before relying on any figure.

[Unverified] AFCA’s leadership also could not be confirmed. As at June 2026 the role was held on an acting basis by Dr June Smith as Acting Chief Executive Officer and Chief Ombudsman. No announcement of a permanent appointment was found. AFCA has also appointed a Chief Scams Officer, David Lacey.

What Australians lost, and the direction it moved

The National Anti-Scam Centre’s report Targeting Scams, published on 30 March 2026, is the authoritative national count. It combines data from Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, IDCARE and ASIC.

Australians reported losing $2.18 billion in 2025, an increase of 7.8 per cent on 2024. There were 481,523 reports, down 2.7 per cent. The median loss fell from $500 to $400.

The report’s own reading of that combination is that more people are being successfully targeted while the amounts lost are lower.

Across five years the trend is not a straight line. Losses ran $1.8 billion in 2021, $3.1 billion in 2022, $2.7 billion in 2023, $2.0 billion in 2024 and $2.2 billion in 2025. So 2025 is up on the year before and down nearly 30 per cent on the 2022 peak. Reporting it as scam losses soaring would be wrong.

By category, investment scams took $837.7 million, payment redirection $166.8 million, romance $139.9 million, phishing $97.6 million and remote access $69.9 million.

The 51.4 per cent figure, corrected

A number from that report has been circulating in a form that is simply wrong, and this masthead nearly published it that way.

The report records that job and employment scam reports rose 102.4 per cent in 2025, and that the increase was driven partly by increased reporting from at-risk communities: 76.3 per cent from First Nations people, 114.0 per cent from people with disability, and 51.4 per cent from culturally and linguistically diverse communities.

The 51.4 per cent is a year-on-year increase in the number of job scam reports from people who identified as speaking a language other than English. It is not the share of job scam reports coming from those communities. Any article stating it as a share is reporting something that is not in the data.

The underlying figures are these. In 2025 there were 10,065 Scamwatch reports from people who identified as culturally and linguistically diverse. Of those, 2,282 reported money stolen, totalling $38.9 million, which is essentially flat on the $38.8 million reported in 2024. The median loss in that group was $750, half again as much as the $400 median across all Scamwatch reporters.

Within that group, investment scams took $15.8 million across 321 reports. Threat-based scams took $7.3 million across just 68 reports, a median of $54,900 each. Job and employment scams took $4.5 million across 230 reports, with a median of $4,500 and an increase of 119.8 per cent. Identity theft reports rose 13.7 per cent, and the number reporting a loss to identity theft almost doubled.

One line from the report connects directly to the exploitation of visa holders: job and employment scams are on the rise within these communities as they are known to target international students and non-resident visa holders.

What the report cannot tell you

The report contains a footnote that decides how far any of this can be pushed.

The Scamwatch form provides an optional field for a reporter to indicate that they speak a language other than English. It does not ask which language, and it does not ask about specific cultural background.

So culturally and linguistically diverse in this report means only that. There is no breakdown by country of birth, by language or by community. The word India does not appear in the report.

Any claim about what Indian Australians specifically lost to scams in 2025 would be an invention, and none is made here.

There is a second limit. Scamwatch accounted for 39.2 per cent of all reports but only 12.8 per cent of all losses, and 85.9 per cent of Scamwatch reports involve no financial loss at all. The report warns explicitly against drawing conclusions about total losses from Scamwatch alone.

What is documented about scams targeting Indian Australians

Here the picture is thinner than the community’s experience suggests, and the gap is itself the finding.

Where the national report explains the very large threat-based losses in diverse communities, it attributes them primarily to Chinese authority scams, where scammers impersonate overseas law enforcement and threaten imprisonment or deportation. Australian regulators’ and police campaigns on fake authority scams have been predominantly focused on Chinese-language communities.

The clearest Australian police warning naming Indian Australians came from NSW Police in March 2026, covering authority scams targeting Chinese, Vietnamese and Indian communities across Sydney. The method described is a caller impersonating an embassy or police official, claiming the victim’s passport and personal details were found on a person arrested overseas, and threatening extradition or deportation unless money is transferred offshore. Contact comes through spoofed Australian numbers and through messaging apps.

The reported losses in that warning were $27,000 from a 26-year-old man, more than $57,000 from a 45-year-old woman, and more than $17,000 from a couple aged 87 and 77.

Detective Acting Superintendent Jason Smith, commander of the Cybercrime Squad, gave the line that families should pass on: “These calls, and the threats made, may appear real, but they are not.” He added that “some of these victims are vulnerable members of our community who are losing thousands of dollars in their savings”.

The High Commission of India in Canberra has issued two warnings of its own. In April 2025 it advised that its own helpline number was being spoofed, with callers impersonating immigration department or High Commission officials, and directed people to the Australian Cyber Security Hotline on 1300 292 371. In August 2025 it warned that fraudsters were impersonating Indian law enforcement agencies and courts, falsely accusing recipients of legal matters in India, and sometimes instructing victims to contact the High Commission to lend the story credibility.

[Unverified] The term digital arrest, widely used in India for this method, does not appear in the national scams report and could not be found in any Scamwatch, ACCC or Australian police alert. The mechanism is documented in Australia under the labels threat-based scams and authority scams. The courier or parcel variant familiar from Indian coverage could not be found in any Australian regulator or police warning at all.

The asymmetry is worth naming. The most detailed warnings aimed at this community come from the Indian High Commission, not from Australian regulators.

What to do with all of this

Until 31 March 2027, if you are scammed, your route is your bank’s internal complaints process and then AFCA’s existing jurisdiction, which since March 2026 also reaches the bank that received the money. Report to Scamwatch and to ReportCyber, and contact IDCARE if identity documents are involved.

Tell older relatives the one thing that defeats every version of the authority scam. No Indian agency, no Australian agency and no High Commission will telephone to demand money or threaten arrest. Hang up and call back on a number you looked up yourself.

And if you work with community organisations, the numbers that should shape your programs are these. Threat-based scams accounted for 7 per cent of reports from diverse communities and 52.7 per cent of their losses in that category. It is a small number of people losing very large sums, with a median above $54,000. That is where the money is going, and it is not where most scam education is aimed.

Sources

Every date, figure and quotation in this article is drawn from the sources below. They are listed so you can check the record yourself.

• Federal Register of Legislation, "Scams Prevention Framework Act 2025, No. 15, 2025"
• Federal Register of Legislation, "Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026, F2026L00627"
• Federal Register of Legislation, "Competition and Consumer (Scams Prevention Framework, External Dispute Resolution) Authorisation 2026, F2026L00685"
• Australian Competition and Consumer Commission, "Scams Prevention Framework"
• National Anti-Scam Centre and Australian Competition and Consumer Commission, "Targeting scams, report of the National Anti-Scam Centre on scams data and activity 2025"
• Australian Competition and Consumer Commission, "Continued action critical to combat fraud as annual scam losses exceed $2 billion"
• Minter Ellison, "AFCA expands scam jurisdiction, what banks need to know"
• Cyber Daily, "AFCA to become Australia's central scams complaints body under new prevention framework"
• NSW Police Force, "Police alert, authority scams targeting multicultural communities"
• High Commission of India, Canberra, "Advisory on scam calls"
• Scamwatch, "Scam alert, police and digital currency exchange impersonation scam"