Preparing for the Scams Prevention Framework: A Capability Checklist for Banks

Abstract

The Scams Prevention Framework (SPF) introduces new expectations for how banks detect, prevent, and disrupt scams across the financial ecosystem.

Preparing for SPF requires institutions to assess capabilities beyond transaction monitoring, including intelligence collection, infrastructure visibility, monetisation analysis, and cross-sector collaboration.

The Shift Introduced by the Scams Prevention Framework

Australia's Scams Prevention Framework (SPF) represents a significant shift in how scam risk is expected to be managed across industries.

Traditionally, financial institutions have focused primarily on detecting suspicious transactions or fraudulent account activity once a payment attempt occurs. While these controls remain essential, they address scams only at the final stage of the scam lifecycle.

In practice, most scams begin much earlier.

They often originate through phishing campaigns, impersonation messages, fraudulent advertisements, or coordinated social engineering targeting victims across digital platforms.

The Scams Prevention Framework recognises that preventing scams requires earlier detection, improved intelligence sharing, and coordinated disruption across sectors.

For banks, this means assessing whether existing capabilities extend beyond traditional fraud monitoring.

For a broader overview of how the framework operates across sectors, see What Is Australia's Scams Prevention Framework.

The framework was developed through policy consultations led by the Australian Treasury, which emphasised stronger cross-sector coordination to reduce scam harm. (Source: Australian Treasury SPF consultation - consultations led by the Australian Treasury)

From Fraud Detection to Scam Prevention

A key implication of SPF is the shift from transaction-focused fraud detection toward ecosystem-level scam prevention.

Banks may increasingly need to consider signals that appear before a financial transaction occurs.

Examples may include:

• scam reports from customers
• phishing infrastructure targeting bank customers
• impersonation campaigns involving trusted brands
• suspicious receiving accounts associated with scam operations
• payment destinations linked to multiple scam victims

These signals may originate outside the bank's internal systems but still influence financial harm within the banking system.

As a result, preparing for SPF may require expanding operational capabilities across several areas.

The following checklist outlines several capability layers banks may consider when evaluating SPF readiness.

SPF Capability Layer 1: Scam Reporting and Signal Collection

Effective scam prevention begins with the ability to collect signals about scam activity from multiple sources.

Many institutions already receive scam-related information from customers or internal investigations. However, SPF readiness may require ensuring that these signals are captured consistently and analysed systematically.

Possible capability questions include:

• Can customers easily report suspected scams through multiple channels?
• Are scam reports collected in a structured and searchable format?
• Can scam reports be analysed to identify recurring patterns or themes?
• Are signals from customer reports integrated into intelligence workflows?

Organisations that can collect and structure scam signals effectively may be better positioned to identify emerging scam campaigns.

SPF Capability Layer 2: Actionable Scam Intelligence

Collecting signals alone is not sufficient. Institutions must also be able to analyse and interpret these signals to understand scam operations.

This is where Actionable Scam Intelligence (ASI) becomes important. For a deeper explanation of this concept, see Why the Scams Prevention Framework Requires a New Category: Actionable Scam Intelligence.

Actionable intelligence transforms raw data into insights that support operational decisions.

Capabilities in this layer may include:

• correlating scam reports with infrastructure indicators
• identifying patterns across multiple incidents
• recognising coordinated scam campaigns
• producing intelligence that supports operational disruption

Possible assessment questions include:

• Can the organisation identify connections between multiple scam reports?
• Can scam incidents be grouped into identifiable campaigns?
• Can intelligence outputs support operational response decisions?

SPF Capability Layer 3: Scam Infrastructure Visibility

Many scams rely on technical infrastructure that operates outside financial institutions but directly affects their customers.

Examples include phishing websites, impersonation domains, malicious applications, or fraudulent advertising campaigns.

Infrastructure visibility refers to the ability to identify and understand this external scam environment.

Possible capability questions include:

• Can the organisation identify phishing domains targeting its customers?
• Can impersonation campaigns be detected across digital platforms?
• Can infrastructure clusters linked to scam activity be identified?
• Can infrastructure intelligence be shared with partners for disruption?

Improved infrastructure visibility may allow banks to detect scam activity before victims interact with fraudulent systems.

SPF Capability Layer 4: Scam Monetisation Visibility

A critical but often underdeveloped capability in scam prevention is visibility into how scam operations are monetised.

Scam losses frequently surface within the financial system even when scams originate through external platforms or impersonated services.

This is also consistent with complaint trends showing that scam-related disputes represent a growing proportion of financial complaints involving banks and payment providers.

(Source: Australian Financial Complaints Authority SPF information - Annual Reviews and complaint reporting)

In many scam types, the most valuable operational signal is not only the phishing website or impersonation message itself, but the payment endpoint through which financial harm ultimately occurs.

For banks, this means assessing whether they can identify patterns such as:

• high-risk receiving pathways linked to scam activity
• repeated beneficiary or mule accounts appearing across multiple victim reports
• payment destinations associated with known scam typologies
• connections between scam reports and monetisation endpoints

This capability allows institutions to move beyond identifying scam content and toward identifying the financial pathways through which scam operations generate harm.

Possible assessment questions include:

• Can the organisation identify scam-linked payment endpoints across multiple victim reports?
• Can scam reports be connected to mule or beneficiary account patterns?
• Can the organisation act on monetisation intelligence before further harm occurs?

Strengthening monetisation visibility can help banks identify relationships between victims, receiving accounts, and scam networks.

SPF Capability Layer 5: Scam Disruption

Once scam infrastructure and monetisation pathways are visible, organisations may be able to intervene more effectively.

Disruption refers to actions taken to interrupt scam operations and reduce harm.

Examples of disruption activities may include:

• removing phishing websites or malicious infrastructure
• restricting accounts associated with scam activity
• blocking high-risk payment endpoints
• coordinating disruption efforts with industry partners

Possible capability questions include:

• Can scam infrastructure be removed or disrupted quickly?
• Can accounts linked to scam monetisation be restricted?
• Are there operational processes for responding to intelligence alerts?
• Can disruption actions be coordinated with external partners?

Effective disruption often depends on having reliable intelligence about both scam infrastructure and monetisation pathways.

SPF Capability Layer 6: Intelligence Sharing and Collaboration

Scam operations frequently span multiple industries.

As a result, collaboration between organisations is an important part of scam prevention.

SPF encourages information sharing between financial institutions, digital platforms, telecommunications providers, and regulators.

Possible capability questions include:

• Can relevant intelligence be shared with industry partners?
• Are there processes for participating in cross-sector intelligence initiatives?
• Can intelligence be exchanged in a structured and actionable format?

The Australian Competition and Consumer Commission (ACCC) has highlighted the importance of coordinated intelligence sharing through initiatives such as the National Anti-Scam Centre.

(Source: ACCC National Anti-Scam Centre - collaboration led by the Australian Competition and Consumer Commission)

SPF Capability Layer 7: Governance and Operational Readiness

Finally, institutions may need to consider whether internal governance structures support effective scam prevention.

This includes ensuring that responsibilities for scam prevention are clearly defined and that operational teams can respond to emerging threats.

Possible capability questions include:

• Are roles and responsibilities for scam prevention clearly defined?
• Are operational teams trained to recognise scam signals and respond appropriately?
• Are internal processes regularly reviewed and improved?

Strong governance helps ensure that scam prevention capabilities operate effectively over time.

Conclusion

The Scams Prevention Framework represents a significant shift in how financial institutions approach scam prevention.

Preparing for SPF requires expanding capabilities beyond traditional fraud monitoring to include intelligence analysis, infrastructure visibility, monetisation insights, and cross-sector collaboration.

The broader implications of SPF for financial institutions are discussed in What SPF Means for Banks and Financial Institutions.

SPF readiness depends not only on detecting scam content, but on understanding where scam harm propagates and where it can be interrupted.

Institutions that can identify scam campaigns, trace monetisation pathways, and coordinate disruption across the ecosystem may be better positioned to reduce scam harm in the evolving regulatory landscape.

Frequently Asked Questions