What is the SPF?

Australians reported losing $2.18 billion to scams in 2025, up 7.8% on the year before. Across 481,523 scam reports, investment scams caused the largest losses at $837.7 million, followed by payment redirection scams at $166.8 million.

The Scams Prevention Framework (SPF) is the law designed to bring those numbers down. It took effect on 21 February 2025 and makes businesses responsible for protecting their customers from scams. In May 2026, the Government designated the first three regulated sectors: banks, telcos and digital platforms such as social media, search engines and messaging services.

From 31 March 2027, these businesses must take reasonable steps to prevent, detect, report, disrupt and respond to scams, or face penalties. If a business fails to meet its obligations and a customer loses money, the customer can seek compensation through the Australian Financial Complaints Authority (AFCA).

What does it mean for payments?

Banks are directly regulated. Fintechs and non-bank payment providers, including those holding an Australian Financial Services Licence (AFSL), are not covered yet. The law allows the Government to add new sectors, and Treasury has named payment providers, digital currency exchanges and superannuation funds as possible additions. Fintechs will feel the impact either way, because most rely on a bank to issue cards, hold funds or settle payments. As banks prepare for March 2027, they will expect the same standards from their partners. Regulators are not waiting either. ASIC has already secured a $35 million penalty against an Australian bank for scam prevention failures under existing laws.

In practice, expect to see:

• Payee checks before money is sent, especially to a first-time payee
• Extra questions or short holds on payments that don’t fit a customer’s normal transaction pattern
• Tighter controls on receiving accounts, so scammers can’t use them to collect funds
• Faster information sharing between banks and payment providers when a customer reports a scam

What customers should do

Treat any request to change banking details as a red flag. Confirm it by contacting the customer or supplier on a number you already have, not one from the email or invoice.

How Bolt Group can help

Bolt’s payments platform is built with scam and fraud controls at its core. Rigorous checks are completed before funds leave an account, and receiving accounts are continuously monitored for signs of scam activity.

• Transaction monitoring: risk rules assess payments as they happen, flagging activity that doesn’t fit a customer’s normal pattern, such as new payees, sudden large transfers or funds moving in and straight back out.
• Risk-based limits: transaction and spend limits are set according to risk profiles, limiting how much money can be lost before a scam is detected.
• Mule account detection: linked identity analysis connects accounts that share details such as devices, contact information or funding sources. This helps identify networks set up to receive and move scam funds.
• Case management and investigation: flagged activity is routed to a dedicated fraud team, so suspicious payments are reviewed and actioned quickly rather than sitting in a queue.
• Continuous calibration: monitoring rules are reviewed and tuned regularly against real outcomes, so controls keep pace as scam tactics change.

As banks and regulators raise expectations under the SPF, Bolt’s partners can rely on controls that are already built in rather than added later. The goal is to keep legitimate payments moving while stopping scam payments before the money is lost.

Stay informed

Scam tactics change quickly, and the best protection is knowing what to look for. These free government and not-for-profit services offer scam alerts, advice and support:

• Scamwatch: run by the National Anti-Scam Centre, with the latest scam alerts and a way to report scams.
• Moneysmart: ASIC’s consumer site, with guidance on investment scams and how to check whether a business is licensed.
• Australian Cyber Security Centre: cyber threat alerts and ReportCyber, for reporting cybercrime to law enforcement.
• IDCARE: free support if your personal information has been stolen or misused.
• AFCA: where to lodge a complaint if you have lost money to a scam and your provider has not resolved it.

The sooner a scam is reported, the better the chance of stopping the payment or recovering the funds.