CBA says 48-hour cross-industry mandates must be enacted to stop scammers

CBA wants policymakers to include rules in the Scams Prevention Framework that require within 48 hours action by telcos, social media providers and banks, to disrupt scams.

CBA executive Kate Crous,says entities within the scams ecosystem should take action “as quickly as practicable”. Picture: Adam Yip

Commonwealth Bank is urging that rules be included in the Scams Prevention Framework requiring telecommunications firms, social media and banks to take action within 48 hours to disrupt scams, when they’ve received verifiable intelligence.

CBA’s executive with accountability for scams, Kate Crous, told The Australian the bank’s view was that entities within the scams ecosystem should take action “as quickly as practicable”.

“If there is a dodgy SMS or URL that is going out, feeding that back into the ecosystem for the appropriate organisation to take action on that as quickly as possible, to prevent widespread harm occurring from that particular vector … is what we’re aiming to do,” she said.

CBA – which has lodged a submission on the topic to a Senate economics committee – is concerned about a provision within the proposed Scams Prevention Framework legislation that effectively allows entities up to 28 days to disrupt activity related to scams, on the basis of actionable intelligence.

The bank suggests instead that regulated entities have 48 hours to investigate and validate the legitimacy of an account, before deciding whether to close it or suspend use or access.

“You wouldn’t want a bad investment scam advert to be up for 28 days if you knew about it on day one,” said Ms Crous, who is also CBA’s executive general manager of everyday business banking.

Consumer Action Law Centre chief Stephanie Tonkin.

The Scams Prevention Framework, which imposes tougher obligations on entities to stop and prevent scams and can lead to fines of up to $50m, is at a critical juncture.

The legislation is scheduled for debate in the House of Representatives on Wednesday afternoon and Thursday in Canberra, as the government seeks its passage ahead of entering caretaker mode during an election campaign. A federal election must be held by May 17.

Assistant Treasurer Stephen Jones, who is retiring from politics at the election, on Tuesday said: “It is clear that there is strong support for the legislation to pass. We will work through some of the details, but the overwhelming message from this inquiry is that strong prevention measures are needed.”

CBA and its big bank peers are keen to see the telecommunications and social media companies caught by the new regime, but there has been resistance.

Meta, in its submission, said it had “significant concerns”, warning the proposed dispute resolution scheme could “make Australia an even more attractive target for scammers”.

Telstra said a “punitive and prescriptive regime” was not required for the telco to take scams seriously.

Consumer groups made a joint submission on the Scams Prevention Framework and the enacting legislation, arguing Australia needed to move swiftly on the issue, but with a greater and clearer focus on better protecting the public from scams.

Consumer Action Law Centre chief Stephanie Tonkin last month told The Australian the proposed legislation was “so high level” it was difficult to ascertain what the system would look like, and how a customer would be compensated in a timely way if a company failed to meet their ­obligations.

CBA – which reports interim results next week – will tell investors it has experienced a reduction of about 70 per cent in customer scam losses in the first half of the fiscal year, compared to the same period two years earlier.

Ms Crous said that result was helped by blocking and holding measures related to cryptocurrency-related transactions, CBA’s name and caller checking technology and work it had conducted with telcos to stop or block scammers. “There’s not just one panacea in the fight against the criminals,” she added.

CBA has previously cited figures showing its name checking technology prevented scam payments worth more than $40m last financial year, while it stopped more than $370m in mistaken payments being made in the same period.

Last fiscal year, CBA spent more than $800m on protection and prevention measures across scams, fraud and financial and cyber crime.

National Australia Bank executive for group investigations Chris Sheehan last month hit out at social media platforms and telcos for not “owning their accountability” in preventing scams. He cautioned that almost all scams originated on an online platform or via telecoms carriers. NAB had stopped close to $50m of customer funds going to potential scammers in the final two months of last year, Mr Sheehan said.

The Australian Financial Complaints Authority is receiving $14.7m over two years to take responsibility for all scam complaints under the mooted scams framework, while social media giants and telecoms companies would become members of the dispute resolution body and subject to a levy. AFCA’s extended responsibilities would come despite reports aggrieved banking, insurance and superannuation customers are facing delays of up to six months to have case managers assigned to complaints at the dispute resolution body.

CBA’s submission urged the government to ensure that AFCA, as the go to compensation complaints body for scams, was “appropriately funded and resourced”.

The bank also said rather than giving AFCA discretion to determine how to apportion liability to entities that did not comply with their obligations under the scams framework, a more formal “mechanism for apportionment” would be CBA’s favoured way to determine levels of blame.

“What we’re asking for is clarity in the legislation, so that it’s well laid out and helps everyone be able to invest effectively, understand what their accountabilities are, and then deliver to those,” Ms Crous said.

The bank’s submission noted that since April 2024 CBA had made more than 5,900 entries to the real-time data sharing, anti-scam intelligence loop.

The entries contained scam phone numbers and web addresses for blocking and taking down by telcos and digital platforms. The bank said more than half of the entries related to content from Meta’s platforms.

Originally published as CBA says 48-hour cross-industry mandates must be enacted to stop scammers