Australia now has a law that makes some of the biggest online businesses share responsibility for stopping scams. It is called the Scams Prevention Framework. Most small businesses will never be directly regulated by it. Yet anyone who advertises online or runs a website will feel its effects over time.
This article explains what the framework is and who it covers. It also looks at the parts most likely to touch web and marketing work. The rules are still being filled in through codes and other instruments, so treat this as a snapshot.
What the Scams Prevention Framework is
The Scams Prevention Framework Bill passed federal Parliament on 13 February 2025. It became the Scams Prevention Framework Act 2025. The law sets out obligations for businesses in sectors that scammers rely on. Those businesses must take reasonable steps to prevent, detect, disrupt, respond to and report scams.
The framework does not bind a sector straight away. A sector only comes under it once the government formally designates it. Each designated sector then gets its own mandatory code of conduct. The codes are meant to reflect the different ways scams work in banking, phone networks and online services.
Which sectors come first
The first three sectors are banks, telecommunications providers and certain digital platforms. The Senate committee report on the Bill lists the digital platform services as social media, paid search engine advertising and direct messaging. Superannuation, insurance and cryptocurrency were flagged as possible fast followers.
In late November 2025 Treasury released a draft instrument to designate the first three sectors. Consultation ran from 28 November 2025 to 5 January 2026. On 28 May 2026 the government announced that banking, telecommunications and key digital platforms had been designated as the first sectors. Draft rules and sector codes then went out for comment, with submissions closing on 25 June 2026. The government said these sectors must be ready for stronger obligations by 31 March 2027.
The six principles in plain terms
The Act is built around six principles that apply to every regulated business. They are governance, prevent, detect, report, disrupt and respond. Here is a short summary of each, based on the committee report.
- Governance means documented arrangements, performance targets and records kept for six years.
- Prevent means reasonable steps to stop scam activity before it reaches people.
- Detect means spotting scams, including as they happen, and investigating suspected scams within 28 days.
- Report means passing actionable scam intelligence to the regulator.
- Disrupt means acting to stop scam activity or prevent losses, with a safe harbour for good faith action of up to 28 days.
- Respond means giving people an accessible way to report scams and a fair internal complaints process.
Actionable scam intelligence has a specific meaning. A business has it when there are reasonable grounds to suspect an activity on its service is a scam. That might come from customer reports, from regulators or from its own checks. Once it exists, the business has duties to investigate, report and act.
Who enforces it and what the penalties are
The ACCC is the general regulator for the framework. ASIC looks after the banking sector code and ACMA looks after the telecommunications code. The ACCC enforces the digital platforms code. The National Anti-Scam Centre sits inside the ACCC rather than being a separate body.
Penalties are high. For the most serious breaches a company faces the greatest of about $50 million, three times the benefit gained or 30 per cent of adjusted turnover. Breaches of the governance and reporting principles carry a lower tier of penalties. These penalties apply to regulated businesses, not to the advertisers who use their services.
Consumers also gain new avenues. The Australian Financial Complaints Authority is set to act as the single external dispute body for scam complaints in the first sectors. People who lose money because a regulated business broke the rules can also sue. Courts must put redress for victims ahead of penalties.
Why web and marketing people should pay attention
Paid search ads and social media are named in the digital platform sector. That is where a large share of small business marketing happens. When the Minister introduced the Bill, he said digital platforms would need to verify and validate their advertisers. Businesses that buy ads may therefore see more identity checks and slower approvals over time.
Legitimate advertisers can make this easier on themselves. Keep your business name consistent across your ads, your website and your ABN record. Make sure your contact page, terms and policies are real and easy to find. Platforms looking for scam signals will find it harder to confuse an honest business with a fake one.
Your own website plays a part here too. Scammers often copy logos, product photos and text from real businesses to build fake stores. Knowing the basics of copyright law helps you act faster when your content turns up somewhere it should not. Platforms under the framework must offer an accessible way to report suspected scams, which gives you a clearer path to complain.
Online stores and brand impersonation
Fake online shops are a common scam. If you run a store, your customers may be targeted by copycat sites using your name. Building a WordPress ecommerce website with clear business details and secure checkout gives shoppers something to compare against. Tell customers which domain and payment methods you genuinely use.
The Assistant Treasurer’s release on the consultation also listed separate government action to curb businesses being impersonated in text messages and invoices. That matters for any business that sends order updates or bills by SMS or email. Keep your sending details consistent so customers learn what a real message from you looks like. Avoid putting payment links in messages where you can send people to your account page instead.
Practical steps for your own business
None of this requires a legal overhaul for most small operators. It does reward good housekeeping. Check that your domain, hosting and email accounts are in your business name and protected with strong sign in security. A host that offers useful web hosting services such as malware scanning and backups helps protect your brand online.
Professional firms should think about this in their marketing as well. Firms whose clients send large payments, such as lawyers and conveyancers, have good reason to guard against impersonation. If you follow the digital marketing techniques for property lawyers, add clear warnings about how you will and will not ask for payment. A short note on your website and in email footers costs little.
Finally, keep an eye on the codes as they are released. The rules for digital platforms will shape how ad accounts are checked and how scam reports are handled. Laws and processes change, and the detail will keep developing. Check official sources such as Treasury and the ACCC before relying on any summary.
Frequently asked questions
Does the Scams Prevention Framework apply to my small business?
Only if your business is in a designated sector. The first sectors are banks, telecommunications providers and certain digital platforms. Most small businesses that simply advertise online are not regulated businesses under the framework.
What does it mean for businesses that run online ads?
Platforms that sell ads must take reasonable steps to prevent scams, and the Minister said digital platforms would need to verify their advertisers. You may see more checks on your account. Keeping your business details accurate and consistent helps.
Who do I report a scam to?
Start with the reporting tools on the platform where you saw the scam. Under the framework, regulated platforms must give people an accessible way to report scam activity. If money has already been sent, contact your bank straight away as well.
When will the codes be in place?
The first sectors were designated in May 2026, and the government has said they must be ready for stronger obligations by 31 March 2027. The codes were still in draft at the time of writing, so check Treasury for the latest position. The committee’s report on the provisions of the Bill and the Assistant Treasurer’s May 2026 announcement set out the background.
This article is general information only and is not legal advice. Laws and processes change and can differ between states and sectors. Speak with a qualified lawyer about your own situation.
