Allegra Spender (Wentworth, Independent) Share this | Hansard source

by leave—I move amendments (1) and (2), as circulated in my name, together:

(1) Schedule 1, item 1, page 13 (after line 24), after the paragraph beginning "The entity must keep" in section 58BC, insert:

The entity must publish information about scams detected, reported and responded to.

(2) Schedule 1, item 1, page 16 (after line 4), after section 58BG, insert:

58BGA Publishing information about scams detected, reported and responded to — civil penalty provision

(1) A regulated entity for a regulated sector contravenes this subsection if the entity fails to publish the following information on a publicly available website:

(a) the prevention, detection and disruption of scams over the last 3 month period (the reporting period);

(b) the response to scams over the last 3 month period (the reporting period);

(c) reports relating to scams over the last 3 month period (the reporting period);

within the period provided under subsection (2) and in accordance with the requirements under subsection (3).

(2) For the purposes of subsection (1), the period is within 30 days of the end of the reporting period.

(3) For the purposes of subsection (1), the information must:

(a) be in the form required by the SPF rules; and

(b) contain the details required by the SPF rules.

(4) Subsection (1) is a civil penalty provision.

Note: This means subsection (1) is a civil penalty provision of an SPF principle for the purposes of section 58FJ (about civil penalties).

As I mentioned in my speech in the second reading debate, I'm extremely doubtful that the Scams Prevention Framework Bill 2024 will be enough to incentivise businesses, including banks, telcos and social media companies, to properly address scams. I believe they will do as they have done, trusting the process to be delayed and slowed down and requiring individuals to pursue these actions in lengthy procedures over months and years. They can win the war by attrition.

I acknowledge that the companies are investing. I acknowledge that the companies hate to see these scams as well. There's no sense of bad faith, but I think the truth is that they have not done enough and I don't believe this bill drives them to do enough yet. The impact statement of the explanatory memorandum states that the regulatory cost between the SPF and the status quo is an initial investment of $100 million and ongoing investments of $31 million. However, the impact analysis estimates that 70 per cent of this cost is already accounted for by non-affiliated banks, with the four major banks expected to increase their funding by only $6.2 million on initial investments. This is despite ASIC finding that the scam strategy and governance of the four major banks is less mature than expected. Similar admissions are present in the sections covering telcos and social media companies.

Page 153 of the explanatory memorandum states that, under the SPF, 'there are unlikely to be significant additional costs for telecommunications providers who are compliant with current obligations'. The EM acknowledges that self-regulation has not worked, yet this bill will introduce minimal additional provisions on top of what these industries are already promising to implement. In perhaps the most overused quote, attributed to Charlie Munger, 'Show me the incentive and I'll show you the outcome.' This bill will not change the outcome, because it does not change the incentive. My amendments are pretty simple. I've spoken to bank CEOs on this topic, and they don't have a problem with it either. They say: 'Publish scam data. Publish the number of scams that different banks are dealing with.' We should publish the numbers—scams detected, reported and responded to, as well as the amounts lost and the amounts reimbursed—for all regulated entities quarterly, not when the regulator publishes aggregated information once a year, buried in the back of a financial model. The fundamental point I'm trying to make here is that without this separation of details, without this information at different levels, the banks will not have the strongest incentive to invest in scam prevention.

The only way to protect Australian consumers is to strongly incentivise banks to do it. A code can do this, but codes are always playing catch-up with the technology in place. I don't believe, honestly, that the federal government or the regulators are innovating at the pace required to understand where the technology can go. I think the private sector needs strong incentives to make the innovation that is required in this space. You can do that through reimbursement models or you can do it through publishing, at a bank level, data saying, 'It's this many scams; this is the percentage of losses; this is the reimbursement,' so consumers can make the right choices. And consumers can show, via their wallet, whether they want to support a bank that is protecting them from scams or whether they don't.

This is about putting the power to protect themselves from scams back in the hands of Australian consumers. We know that scams are so sophisticated these days. We know that these scams are run by organised international criminal cartels. It is incredibly hard for individuals to protect themselves from these scams, even savvy consumers who are doing a really good job of protecting themselves. They can't do it alone. If the Deputy Chair of ASIC can be scammed, anyone in this country can be scammed, whatever personal protections they are putting in place. So the question then goes to how they can protect themselves. This legislation is helpful, but the best way for people to protect themselves is for us to make sure that banks, telcos and social media companies are innovating—that they're putting their best minds to work on how to protect their consumers—and the best way to drive that investment in innovation isn't just regulation; it's actually transparency.

Shine a light on who's doing a good job and who's doing a bad job, and then you might get change. It's then that we might see real change in the Australian market, which is what we haven't seen. Since 2017, Europe has had some of the innovations that are just coming into place in Australia. Why haven't we had them? Because the incentives haven't been there. Let's stop playing catch-up.

See this speech in context