Australia

Australia's Scams Prevention Framework, explained.

The Scams Prevention Framework puts legal duties on banks, telcos and digital platforms to prevent, detect, disrupt, respond to and report scams. Track your SPF position in one dashboard, with the evidence to back it up.

Book a demo Request a takedown

18NOVWe’re sponsoringScams Prevention Framework SummitPark Royal Darling Harbour, SydneySee the event →

Legislation briefAU

Scams Prevention Framework, in the Competition and Consumer Act 2010

In forceMost obligations start 31 March 2027

Applies to: Banks, telcos and digital platforms (social media, search and messaging)
Regulators: ACCC overall and for digital platforms, ASIC for banks, ACMA for telcos
Complaints: AFCA, the single external dispute scheme
Impersonation: Covered in the draft codes: protect official channels, monitor, request removal
Max penalty: The greater of $50m, 3x the benefit or 30% of turnover

Sector codes are still drafts. Summary as of October 2026, not legal advice.

What the law asks

The six SPF principles, and how we help.

What each principle asks of you, in plain words, and what Unphish does for it.

Govern

Show who’s accountable for scams.

We give you monthly reports and board-ready metrics, so leaders can see what’s been found and removed.

In the dashboardGovernance records and board summaries.

Prevent

Stop scams before they reach customers.

We watch for lookalike domains and keep a list of your official channels, so fakes stand out.

In the dashboardLookalike domains on your watchlist.

Detect

Spot scams that use your name.

We monitor the web, social media, apps and messaging for fakes, 24/7.

In the dashboardScam signals detected over time.

Report

Share what you find with the ACCC.

We link fakes into campaigns and give you case packets you can pass on.

In the dashboardExportable evidence packs.

Disrupt

Act to take scams down.

We request removal of fake sites, accounts, apps and ads, and follow up until they’re gone.

In the dashboardDisruption actions and outcomes.

Respond

Deal with scam reports and complaints.

We turn customer reports into cases, each with a status and a timeline.

In the dashboardA timeline for every reported fake.

Based on the six SPF principles and the draft sector codes released in May 2026.

Key dates

When the SPF applies.

21 Feb 2025The SPF becomes law
Treasury Laws Amendment Act 2025
Done
23 May 2026First sectors designated
Banks, telcos and digital platforms
Done
May 2026Draft codes released
Including brand impersonation
Done
1 Sep 2026AFCA membership required
For designated businesses
Done
31 Mar 2027Most obligations start
Prevent, detect, disrupt, respond
Next
End 2027Scam intelligence sharing
Reporting to the ACCC expected
Coming

Dates from Treasury, ASIC and ACCC. Codes and later dates may change.

Who it covers

Who the SPF applies to.

Three sectors first, each with its own regulator and code.

BanksASIC

Authorised deposit-taking institutions, including banks, building societies and credit unions.

TelcosACMA

Phone and internet providers that carry calls and texts.

PlatformsACCC

Social media, search and messaging services over the size thresholds.

Everyone elseNot yet

More sectors can be designated later. Scams using your name still pass through the three above.

$2.18blost to scams reported in 2024

481,523scam reports in 2024

6principles every designated business must meet

Source: National Anti-Scam Centre, Targeting Scams Report 2024.

Check your business

Does the SPF cover you?

The first sectors are banks, telcos and digital platforms. Pick the one closest to your business to see what applies.

What to do now

A general guide, not legal advice. Check your position with your legal team.

SPF Compliance Dashboard

See your SPF position in one dashboard.

Track how your monitoring and takedowns line up with the six SPF principles, spot the gaps, and keep an evidence register you can export. We can add it to your Unphish portal.

Scams Prevention FrameworkSolstice Pay · Last 90 days

Example data

OverviewFramework alignmentThreat activityEvidence centre

Scam signals detected1,284↑ 36%

Disruption actions1,002↑ 48%

Evidence records986↑ 52%

Open threats24↓ 29%

Framework alignment6 principles

GovernPartial

Dashboards, case histories, access controls and audit records.

PreventPartial

Watchlists and monitoring of impersonation infrastructure.

DetectSupported

Continuous web, social and app monitoring for impersonation.

ReportPartial

Exportable evidence and campaign intelligence for reporting.

DisruptSupported

Takedowns with registrar, host and platform escalation.

RespondOut of scope

Complaints and compensation stay with your own team.

Disruption over timeRemoved Escalated

Removed74%

Escalated17%

Monitoring9%

Recent threat activityView all →

Threat	Channel	Detected	Status
Fake login page	Web	14 Sep	Removed
Fake support account	Social	13 Sep	Removed
Lookalike domain	Web	12 Sep	Escalated
Copied app	Mobile	11 Sep	Removed
Fake investment site	Web	10 Sep	Monitoring

Evidence centreSPF evidence register

Detection evidenceOriginal URL, screenshots, timestamps and source
Disruption evidenceTakedown requests, escalation history and outcomes
Governance recordsCase audit trail, actions, ownership and approvals
Reporting exportsPeriod summaries and downloadable evidence packs

Illustration with example data for a fictional brand. The dashboard maps Unphish capabilities to the SPF principles; it isn’t a legal compliance assessment. Ask us about setting it up for your organisation.

What’s at stake

Why getting this right matters.

Maximum penalty$50m+

The most serious breaches carry the greater of $50 million, three times the benefit gained, or 30% of adjusted turnover.

Other breaches$10m

A lower tier of penalties applies to other breaches of the SPF and the sector codes.

ComplaintsAFCA

Customers can take scam complaints to AFCA, which can decide on compensation.

What we take down, across all clients

98%of scam websites 99%of phishing sites 99%of impersonation accounts 92%of fake apps

Penalty figures are a summary of the SPF law. Our results cover all Unphish clients, January to June 2026, rounded.

Who’s accountable

Who owns each part of the SPF.

The SPF spreads across teams. Here’s a typical split, and where Unphish fits.

TeamGovernPreventDetectReportDisruptRespond

Compliance and riskGovernPreventDetectReportDisruptRespond

Fraud and financial crimeGovernPreventDetectReportDisruptRespond

SecurityGovernPreventDetectReportDisruptRespond

Customer care and complaintsGovernPreventDetectReportDisruptRespond

Board and executivesGovernPreventDetectReportDisruptRespond

UnphishGovernPreventDetectReportDisruptRespond

LeadsSupportsA typical split. Yours may differ.

Around the world

How the SPF compares.

WhereMain rulesWho it coversImpersonationPenalties

Australia Main rulesScams Prevention Framework (SPF)Duties from 31 Mar 2027 Who it coversBanks, telcos and digital platforms ImpersonationDraft codes: protect official channels, monitor, request removal PenaltiesUp to $50m, 3x the benefit or 30% of turnover You’re here

United States Main rulesFTC Impersonation RuleIn force since Apr 2024 Who it coversAnyone impersonating a government agency or business ImpersonationImpersonating a business is unlawful. FTC asking about platform ad tools PenaltiesUp to $53,088 per violation, plus refunds to consumers View → United Kingdom Main rulesOnline Safety Act and APP fraud reimbursementScam ad codes in draft Who it coversOnline platforms, search services and payment firms ImpersonationPlatforms must tackle fraud. Draft codes add scam ad takedown PenaltiesUp to £18m or 10% of worldwide revenue View → European Union Main rulesDigital Services Act and Payment Services RegulationPSR not yet applying Who it coversOnline platforms and payment service providers ImpersonationNotice and action on illegal content. PSR adds impersonation fraud refunds PenaltiesUp to 6% of global turnover (DSA) View → Singapore Main rulesShared Responsibility FrameworkIn force since Dec 2024 Who it coversBanks and telcos ImpersonationCovers phishing scams impersonating legitimate businesses PenaltiesBanks and telcos that miss their duties cover losses View →

A simplified summary as of October 2026, not legal advice. Rules and dates change, so check the source for your obligations.

Get ready

Your SPF readiness checklist.

A starting point for brand impersonation under the SPF. One list for before 31 March 2027, and one for every month after that.

SPF checklistBrand impersonation

Before 31 March 2027

Join AFCA if your business is designated (required from 1 September 2026).
List your official channels: domains, accounts, apps and phone numbers.
Set up monitoring for lookalikes and impersonation.
Agree how fakes are reported and removed, and by whom.
Decide what you’ll record and who signs off.

A starting point, not legal advice.

Checklist

SPF checklistBrand impersonation

Every month

Review the new impersonation found.
Check what was taken down and what’s still live.
Keep evidence and timestamps for every case.
Report the results to your executives and board.
Update your list of official channels.

The draft codes propose keeping records for six years.

Checklist

Free guide

The SPF, explained for boards.

Our guide for boards and executive teams covers what the SPF requires, who it applies to, the brand impersonation obligation and what a compliant programme looks like.

What is the Scams Prevention Framework?03
Who is regulated first04
Why non-regulated companies should listen05
The brand impersonation obligation06
Detect obligation and scam intelligence09

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

From the blog

More on the SPF.

Jul 2026Why audit trails matter more than ever under the SPFEvery decision, piece of evidence and action in an investigation should be on record. Jul 2026How the SPF turns brand impersonation into a compliance issueFake sites, lookalike domains and fake profiles are now a regulatory matter. Jun 2026The SPF doesn’t require takedowns. It requires disruption.Why the difference matters for how you plan your response. Jun 2026The SPF 28-day investigation clockWhat happens once you receive actionable scam intelligence. Jun 2026What “reasonable systems” means under Australia’s SPFOne of the framework’s most important phrases, and one of the least defined. Jun 2026Australia’s Scams Prevention Framework: what every business needs to knowThe essentials, including who it covers and what it asks of you.

Read the source

Federal Register of LegislationScams Prevention Framework Act 2025 TreasurySPF codes and rules exposure draft ACCCScams Prevention Framework ASICScams Prevention Framework

FAQ

SPF questions, answered.

What is the Scams Prevention Framework?

The Scams Prevention Framework (SPF) is an Australian law that started on 21 February 2025. It puts legal duties on designated businesses to prevent, detect, disrupt, respond to and report scams, and to govern how they do it. Sector codes set out the detail for each industry.

Who does the SPF apply to?

The first designated sectors are banks, telcos and digital platforms, which covers social media, search and messaging services over set size thresholds. The Government can add more sectors later. ASIC regulates banks, ACMA regulates telcos, and the ACCC regulates digital platforms and the SPF overall.

When do the obligations start?

Designated businesses needed AFCA membership from 1 September 2026. Most obligations start on 31 March 2027, and scam intelligence sharing is expected from the end of 2027. The sector codes were released as drafts in May 2026 and may change before they're final.

Does the SPF cover brand impersonation?

Yes. The draft codes expect businesses to protect their official channels, monitor the internet for material impersonating them, and request removal of what they find. Fake websites, social media accounts, apps and ads using your name all fall into this.

How does Unphish help with the SPF?

We monitor for impersonation of your brand 24/7, take down the fakes we find, and link related fakes into campaigns. Every case keeps its evidence, timeline and outcome, so you have records of the action you've taken and reports for your executives and board.

What are the penalties?

For the most serious breaches, the maximum penalty is the greater of $50 million, three times the benefit gained, or 30% of adjusted turnover. Lower penalties apply to other breaches. Customers can also take complaints to AFCA.

Is this page legal advice?

No. This page is a general guide to the SPF and how Unphish can help with brand impersonation. The codes are still being finalised, so check your obligations with your legal team and the regulators' guidance.

Solutions for the SPF

The tools behind your record.

01Threat MonitoringDetect impersonation 24/7.Learn more →02TakedownDisrupt scams using your name.Learn more →03Threat IntelligenceLink campaigns and share what you find.Learn more →04Domain ProtectionPrevent lookalike domains.Learn more →

Industries most affected

Banking and Financial Services→Fintech→Crypto→Retail and E-Commerce→

See all solutions →

Try it

True or false?

Five quick statements about Australia’s Scams Prevention Framework. Which are true?

Most obligations start on 31 March 2027. If brand impersonation is part of your plan, we can help you get ready.

Talk to us →

See the SPF Compliance Dashboard.

Book a demo and we'll show you how Unphish tracks your SPF position, takes down impersonation and keeps the evidence, before 31 March 2027.

Book a demo Request a takedown