Zali Steggall (Warringah, Independent) Share this | Hansard source

Today I welcome the Scams Protection Framework Bill 2024. It's not perfect, but it certainly goes a fair way to helping Australians fight against the growing threat of scams, because so far we are failing. Consumer groups have been raising the alarm for years in relation to this, and governments have been deaf to their concerns. There has been a lack of action from industry, banks, social media companies, telecommunication sectors and, realistically, the previous government and government to date in relation to fighting back against scams, protecting Australians and helping them actually recoup some of the losses.

In 2023, despite the banking sector implementing a voluntary code on scams, consumers were still wearing the cost of scams. Australia is amongst the top five most-scammed countries in the world. Australians were scammed more than $2.7 billion in 2023 alone. In 2022 it was more than $3 billion. We need to remember that these are not just numbers; these represent real people, real families, who are financially and emotionally devastated. The reality is that it's probably also the tip of the iceberg, because often people simply do not report scams; they're too embarrassed about having been duped. Sometimes it is a lifetime of savings that has been lost.

In my electorate of Warringah, we hear from many constituents about their experiences and feel the emotional distress that being caught up in a scam causes. It can come from young people and older people. It really does not discriminate. All feel a sense of shame and embarrassment that they have been duped. So my message to everyone is: please report it. Do not feel that shame, because it happens to so many people in our community.

Last year, an email came in from one of my own electoral officers, whose email was hacked, resulting in phishing scam emails being sent out to members of parliament in this chamber and having to be recalled. So we know we need greater protections. I welcome this Scams Prevention Framework legislation. It is a crucial step towards safeguarding Australian consumers from increasingly deceptive and harmful practices.

This bill does provide for the protection of Australian consumers from fraud, encourages corporate accountability and brings Australia further in line with comparable jurisdictions, like the UK and Singapore, but we haven't gone as far as some have. The power of the legislation will be in how consumers continue to report scams and how entities, banks and telcos act on those reports and do what is needed. Through reporting scams quickly to Scamwatch for consumers, consumers can disrupt a scamming activity and prevent it being effective for future victims. No matter what, when you get those spam SMSs and scam emails, reporting them to Scamwatch is incredibly important. It is part of that process of pre-bunking and protecting consumers. It ensures the scheme is robust by providing valuable intelligence to the industry to act.

I support the intent of the bill. However, I'll be moving an important amendment to strengthen the integrity of the framework and ensure that vulnerable customers will be able to have equal access in receiving compensation from regulated entities. There is a remaining concern that there is an information gap and a power gap, but there's also the concern that those that generally are able to recoup or to assist with recompense to victims are ultimately those that have access to the information and the data. There is a huge disadvantage when it comes to victims compared to entities.

The proposed bill places the onus on already vulnerable consumers to take on their bank, telco or social media platform, and it essentially is asking a victim to prove that the institution did not meet the requirements of the Scams Prevention Framework. That is a simply ridiculous proposition—that somehow a victim will be able to establish whether or not a Meta has generally met the requirements to ensure the Scams Prevention Framework is working. The onus introduces a significant barrier to getting any compensation for victims from these companies. It's a legalistic, resource-draining, time-wasting and complex task for the victim. Victims without the assistance of advocates will fall through the gaps. They're set up to fail under the current set-up of the proposed bill.

The amendment I have proposed and discussed and negotiated with the government places an obligation on businesses through an increased detailed certification requirement to show that they have met their obligations under the Scams Prevention Framework Bill, rules and sector-specific codes. The onus falls on them to show that they have complied. This amendment will be necessary, and I'll monitor the implementation of the amendment through the rules and the codes to make sure that regulated entities provide customers with the specificity that is required to prove that they have met their obligations. It can't just be that a Meta or a bank ticks and flicks whether or not they have complied. We have to make sure that this works and that they genuinely have assessed their processes and implemented the precautions and the Scams Prevention Framework. That means that if they haven't then they should be liable and victims should be able to get compensation.

This should help to bring greater transparency to the framework and empower consumers to have a fair go in getting dispute resolution and ultimately, hopefully, get compensation for their losses. The amendment has already been flagged by Treasury in the explanatory memorandum of the bill, and my amendment will make it law. Similarly, greater transparency means that companies will also have a clearer understanding of what is required of them under this legislation, providing them with regulatory certainty.

Consumer groups have consistently raised concerns about the slow response from industry and government. We already have strong frameworks in place for other areas of consumer protection, so why is it taking so long for scams? It has for too long been put off. Nevertheless, consumer groups are concerned that more can be done. This legislation should only be viewed as a start. During the period of review, it will be important to assess how well it is working.

There are a couple of other concerns that I'd like to raise. While I support the bill, I think it's necessary to raise for future consideration the codes and the rules. The government has removed the provisions relating to identification and special treatment for vulnerable customers from the exposure draft, so there is no direct oversight over these particularly at-risk customers. Further, the bill doesn't provide any obligations or support for ongoing education and awareness programs from the government. As I've mentioned previously in this chamber, due to the lack of government initiatives in my electorate and around Australia, our communities have taken education and digital literacy into their own hands, but more can be done by the government. For example, locally we have an organisation called Manly Computer Pals, and at Christmas last year they ran tutorials for seniors to help them avoid possible scams and raise their own levels of digital literacy.

We need to follow communities' leads and provide more information and education to make sure we arm consumers with the information and the tools to better protect themselves against scams, because the reality is that, as I said, scams happen to everyone—all age groups. Young people—in particular, the young professionals—get scammed in relation to funds they simply can't afford to lose. For example, a young constituent of mine wrote to me about losing a house deposit of some $100,000, as he was scammed when someone impersonated his lawyer. As, in this era, bank cheques are a thing of the past and many transactions are done electronically, that deposit was lost.

The real question then falls on who should be responsible for that compensation. Obviously, the financial institution has access to the data, right? They can see who the money is being transferred to. One of the calls is that we should have greater friction to ensure that financial institutions go through that step of checking with the customer, 'Is this really who you want to be sending this money to? Is this the right person?' Of course, there might be frustration for the customer from that increased friction and delay, but I think that is better than seeing money being scammed and going to the wrong providers.

That friction is within the power of the banks. At the moment the debate as well is that, if the banks were made solely liable for compensating victims of scams, that would incentivise them to put better friction in place because their money would be on the hook. Instead, the government is going for a model that's not an automatic compensation model, where there's a shared liability between platforms and banks and consumers to enable that compensation prospect. I think we need to monitor this carefully. Other jurisdictions have gone towards more of an automatic liability and compensation process.

It's important to make financial institutions more responsible through greater accountability, forcing them to take greater actions on scams. We know they say, 'We're working on it,' but they're not always doing enough. At the same time, I do hear their complaint that we can't just completely let consumers off the hook for that responsibility of due diligence. We all bear a responsibility when we are actioning or authorising a transaction to take a moment to verify that transaction, to make sure we are in fact not being scammed, but also to verify who we are authorising a transaction to. I do accept that there has to be joint responsibility from all in preventing scams.

Of course, there's also the role that social media platforms and online platforms play in publishing and enabling scams to happen because they give them the platform. For example, a scam is brought to a person via a Meta platform like Facebook; a transaction occurs, and the bank proceeds with the transaction. Should the bank be liable for the loss because they've enabled the money to be transferred? Should Facebook be liable because they have given a platform for the scammer to reach the consumer? Or is the victim responsible because they haven't taken due care and diligence? So where we allocate responsibility is important, but at the moment the onus falls too much, too heavily, on the victims, and there is not enough responsibility put on the big institutions, who have access to the means, the capacity and the resources to put in place greater protections.

This legislation is a step towards introducing that, but it is still being criticised as not being strong enough. We see New Zealand and Singapore moving in the direction of the UK by introducing measures for greater liability of the financial institutions, the argument being that the banks can see who the money is being transferred to. They can see what's happening. They have the capacity to prevent it. They then also have the means to recoup money from a Meta or a Facebook, for example—the next step of recovery—if the responsibility lies with them.

I hear the concerns of consumer groups that there is still too much onus on victims, and I'll monitor closely whether or not we have an improvement in the amount of money victims are able to be compensated—whether this legislation goes far enough. The UK has gone out the furthest. As I said, New Zealand and Singapore are moving in the direction of the UK. I think Australia and the government need to be mindful of whether or not this legislation works. Hopefully, this is about more than just providing an avenue to recoup money for victims. It has to be about protecting the integrity of our systems to build a greater sense of security in an increasingly complex digital world.

Scammers are evolving, as many in this place have noted. So too must our response to them. Whether it's through fake investment schemes, identity theft or fake job advertisers, Australians are being targeted with alarming frequency. As I said, in my office I receive regular phone calls from constituents who have been scammed. They get in contact with the office because they are distressed and have little to no way to seek redress or to get their money back. We really need to make sure we are doing more. For example, one constituent called with an online jobs scam which resulted in a loss of $40,000. She was out of work and struggling to find new work to support two young children, she had an unexpected large repair bill with her house, and she was lured into a scam mimicking a big employer. As a result, she lost significant money, which really made a difference. These are sophisticated scams. They're set up with group chats and staffs and terms of employment. It's really important that that be reported and that we have the resources to crack down on it.

Individual stories tell us a lot. They tell us about the sophistication. We need to make sure we do more. I would like to thank CHOICE and the Consumer Action Law Centre, who have relentlessly advocated on behalf of scam victims. We know we can do more. I will support this legislation—as amended, when I do so in the consideration in detail stage—but I urge the government and the opposition to keep a vigilant eye to make sure compensation for victims improves in Australia.

See this speech in context