The Scams Prevention Framework for small business: what it will (and won't) do
Scams Prevention Framework for small business: from 31 March 2027 banks must act on scams and AFCA hears complaints. What it covers and what it won't refund.
The Scams Prevention Framework (SPF) is a federal law that makes banks, telcos and digital platforms take reasonable steps to prevent, detect, report, disrupt and respond to scams, with most obligations starting on 31 March 2027. Small businesses that meet the size test can take scam complaints to AFCA. It is not a refund guarantee: compensation depends on whether your bank, or another provider involved, fell short.
This guide is for Melbourne business owners on the customer side of the SPF. It is general information, not legal advice.
What is the Scams Prevention Framework?
The SPF is a new Part IVF of the Competition and Consumer Act 2010, inserted by the Scams Prevention Framework Act 2025. It sets six principles every regulated provider must follow: run documented governance arrangements for scams, then take reasonable steps to prevent, detect, report, disrupt and respond to them. Sector codes and rules fill in the detail, and the principles are civil penalty provisions.
"Reasonable steps" is the phrase that will decide most disputes. The Act measures it against the provider's size, its services, its customer base and the scam risks it faces, with code compliance as the primary consideration. So the question won't be "were you scammed?" but "did the provider do what its code required?"
Australians reported $2.18 billion in scam losses in 2025, and payment redirection, the swapped-bank-details invoice fraud built around business payments, accounted for $166.8 million of it, according to ACCC figures reported by Cyber Daily. For the attack step by step, see how a payment redirection scam unfolds.
Who does the Scams Prevention Framework cover?
The first designation, signed by the Assistant Treasurer on 22 May 2026, brings in three sectors, each with its own regulator. The ACCC is also the general regulator for the principles, and the Australian Financial Complaints Authority (AFCA) is the single external dispute scheme for all three, as ASIC's SPF overview sets out.
| Sector | What is covered | SPF regulator |
|---|---|---|
| Banking | Services a bank or other authorised deposit-taking institution provides in Australia, such as your business account and the transfers you make from it | ASIC |
| Telecommunications | Voice calls and text messages carried over phone networks | ACMA |
| Digital platforms | Social media, instant messaging apps and paid ads on internet search engines | ACCC |
The first SPF Rules, in force since 1 September 2026, narrow this: a digital platform is covered only if its provider has revenue of $1 billion or more and the service averages 200,000-plus monthly active Australian users.
The gap that matters most to business: email
Email is not in the first designation. The government's explanatory statement says the instant messaging category is not intended to include emails, and internal business messaging tools are carved out too. Payment redirection typically starts in a mailbox, so the bank that processes your payment is regulated, but the inbox where the fraud was staged is not.
When does the Scams Prevention Framework start?
In stages. As at mid-October 2026, the only SPF duty providers face is AFCA membership; the obligations that protect your business account arrive on 31 March 2027.
| Date | What happens |
|---|---|
| 22 May 2026 | Banking, telecommunications and digital platform sectors designated |
| 1 September 2026 | Covered banks, telcos and platforms must be AFCA members; the first SPF Rules, on who is covered, commence |
| 31 March 2027 | Most SPF obligations commence, including scam reporting channels and internal complaint handling |
| By the end of 2027 | Further obligations expected |
A scam before 31 March 2027 is handled under the existing rules; AFCA's draft Scam Rules cover only conduct from that date. Much of the fine print is still unwritten. Treasury consulted on draft SPF codes and rules from 28 May to 25 June 2026, but by mid-October no sector code had been made, and ACMA was only directed on 6 October to advise on the telco code. AFCA consulted on its draft Scam Rules until 28 September 2026, with final rules expected in early 2027.
Can a small business complain to AFCA under the Scams Prevention Framework?
Yes, if your business passes the Act's size test. Section 58AH treats a business as an "SPF consumer" when it is a small business operator, meaning all three of these apply:
Fewer than 100 employees.
A company counts the staff of related companies in its group too.
Annual turnover under $10 million in the last financial year.
A principal place of business in Australia.
The test applies at the time of the scam, so growing past 100 staff later doesn't remove protection for that loss. The SPF rules can also exclude particular situations.
Your provider comes first. From 31 March 2027, each regulated bank, telco and platform must offer an accessible way to report a scam and an accessible, transparent internal dispute resolution process, and, once the SPF rules set out the detail, a written statement on whether it believes it met its obligations. AFCA comes next, and it has already widened its reach: since 12 March 2026 it can look at every bank involved in the flow of scam funds, not only your own, according to King & Wood Mallesons' SPF countdown briefing.
Will the bank refund a payment redirection loss?
Not automatically. The Act contains no refund guarantee; compensation follows a failure. AFCA can determine a complaint, and anyone who suffers loss because a provider breached an SPF principle or its sector code can sue to recover it within six years. If the bank, the telco that carried a spoofed text and the platform that ran a fake ad all fell short, liability can be split between them.
According to the same briefing, Treasury's consultation proposed automatic reimbursement for verified scam losses under $3,000, but that was not part of the SPF Rules made on 31 August 2026. AFCA's draft Scam Rules would cap direct financial loss at $1,263,000 per scam, and a claim above that amount couldn't go to AFCA at all. A redirected invoice can easily dwarf a $3,000 threshold, and a property settlement can exceed the AFCA cap.
Your side will be examined too. AFCA's draft rules require it to do what is fair in all the circumstances, and in a court claim under the Act, any share of the loss caused by your own contributory negligence is excluded when liability is apportioned. Confirmation of Payee, rolled out by Australian banks from July 2025, checks the name of the person or business you're paying against the BSB and account number you enter. A "no match" result is a warning, not a block. If someone clicked past one, assume that click will come up.
Why your own controls still matter
The SPF regulates the bank's side of the payment. Everything before the money leaves your account (the mailbox, the invoice, the decision to pay) is still yours, and those controls double as evidence if you ever complain. Key IT recommends:
Call-back verification, every time.
Confirm any change of bank details by ringing the contact on a number you held before the request arrived, not one quoted in it. Voice cloning means a familiar voice on an inbound call proves nothing, as our story on deepfake CEO calls shows.
Treat a Confirmation of Payee mismatch as a hard stop, in writing, so nobody overrides it under deadline pressure.
Two people for large payments.
One prepares, one releases, and the call-back is logged.
MFA on every mailbox.
Redirection commonly starts with a phished password. If an account is already behaving oddly, use our hacked Microsoft 365 account checklist.
DMARC on your domain, so your address is far harder to spoof to customers. Email's own "SPF" record is unrelated to this law; our SPF, DKIM and DMARC guide explains it.
Someone watching sign-ins.
New inbox forwarding rules and logins from odd locations are early signs of a compromised mailbox. Spotting them is a job for Key IT's 24/7 SOC service, bundled into our managed cybersecurity.
Businesses that move large sums on email instructions have the most to lose: see our pages for real estate agencies and conveyancers.
What should you do if a payment has already been redirected?
Ring your bank's fraud line straight away and ask it to contact the receiving bank.
Report the crime to ReportCyber on cyber.gov.au and keep the reference number.
Lock down the mailbox: reset passwords, sign out every session, delete rogue forwarding rules and keep the emails as evidence. Our incident response team can help.
Complain in writing to your bank, then go to AFCA if the outcome doesn't seem fair. For scams from 31 March 2027, ask whether the bank met its SPF obligations; once the SPF rules switch that duty on, it must answer with a written statement of compliance.
Frequently asked questions
Does the Scams Prevention Framework apply to my business?
Only as a protected customer, unless you are a bank, telco or large digital platform yourself. Your business is an "SPF consumer" if it has fewer than 100 employees, annual turnover under $10 million and its principal place of business in Australia. There is nothing to register for.
Is the Scams Prevention Framework the same as an SPF email record?
No. In email, SPF means Sender Policy Framework, a DNS record listing which servers may send mail for your domain. The Scams Prevention Framework is a 2025 federal law regulating banks, telcos and digital platforms. Same acronym, both fight fraud, but one is a setting your IT provider configures and the other is legislation.
When can a small business lodge an SPF complaint with AFCA?
For scams involving conduct on or after 31 March 2027. Complain to the provider first through its internal dispute resolution process, then escalate to AFCA if you're not satisfied. Earlier scams can still go to AFCA as an ordinary banking complaint, but the SPF obligations won't be the measuring stick.
Does the SPF cover scams that arrive by email?
Partly. Email isn't in the first designation, so your email provider has no SPF obligations for its email service. But if a fake emailed invoice leads you to pay through your bank, the bank's handling of that payment is covered, as is any scam text, or ad on a large social media platform, used in the con.
Will the SPF make my bank refund a redirected invoice?
Not automatically. A refund or compensation depends on whether the bank, and any telco or platform involved, failed to take the reasonable steps its SPF obligations require, and how much that contributed to the loss. Strong internal controls remain the surest way to avoid the loss rather than argue about it afterwards.
Who regulates the Scams Prevention Framework?
The ACCC is the general regulator and oversees digital platforms. ASIC regulates banks and ACMA regulates telcos, each enforcing its sector's SPF code once those codes are made. AFCA isn't a regulator: it is the independent dispute resolution scheme for SPF complaints, which covered providers had to join by 1 September 2026.
More insights
SPF, DKIM and DMARC explained
SPF, DKIM and DMARC explained in plain English: stop scammers sending email as your business, keep…
Read article →ScamsAnatomy of a payment-redirection scam
Payment redirection scams explained: how criminals swap a supplier's bank details via a hacked…
Read article →PrivacyPrivacy Act reforms 2026
Privacy Act reforms 2026 explained: the draft Bill's 72-hour breach reporting, processor rules and…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.