There is a piece of Australian law worth understanding correctly, because a lot of the coverage around it reads as though small businesses have picked up a new compliance burden. They have not. If anything, the opposite happened.
Who the obligations actually fall on
The Scams Prevention Framework places legal duties on banks, telecommunications providers and certain digital platforms — to take reasonable steps to prevent, detect, disrupt, report and respond to scams. Those are the regulated entities. If you run a cafe, a trade business or a consultancy, the framework does not hand you a new obligation to discharge.
That is worth knowing before you pay anyone to make you compliant with it.
Where small businesses sit
Under the framework a small business is treated as a protected consumer where it has its principal place of business in Australia, fewer than 100 employees, and turnover under $10 million. Most Australian small businesses meet that.
The practical consequence: from 31 March 2027, a small business meeting those criteria can make a scam complaint to the Australian Financial Complaints Authority under the framework. Regulated entities have had to be AFCA members since 1 September 2026, and the substantive obligations apply from 31 March 2027.
Being able to escalate to an external dispute resolution scheme is a materially different position from writing off a loss because your bank declined to help.
What this does not mean
Two honest limits, because overstating this would be worse than not writing it.
- It is not a guarantee of reimbursement. It is a pathway to have a complaint independently considered, which is not the same as an outcome.
- It does not apply to every loss. Whether a particular incident falls inside the framework depends on the facts and on which regulated entity was involved.
What to do on the day it happens, before any of this applies
The complaint pathway opens in 2027. If money leaves your account this week, the sequence still matters, and speed matters most.
- Call your bank immediately and say the word “scam”. Recovery depends almost entirely on how fast the receiving account can be frozen, and that window is measured in hours. Do not email.
- Do not wait until you are certain. Reporting a payment you later find was legitimate costs you an apologetic phone call. Waiting to be sure costs you the money.
- Report it to Scamwatch and, if there was unauthorised access to your systems, to ReportCyber. These build the intelligence picture even when your own funds are gone.
- Tell your team the same day, without blame. Attacks arrive in waves and often target several people in the same business. A staff member who fears being blamed is a staff member who will not tell you about the next one.
Keep every record from that day. If the incident later falls within the framework, the contemporaneous detail is what a complaint rests on.
What is worth doing now
The framework changes who is accountable. It does not change the fact that the cheapest scam is the one that fails.
- Verify bank detail changes out of band. Invoice redirection remains the one that hurts businesses most: an email arrives, the account number has changed, the payment goes. Confirm by phone on a number you already held — never a number in the email.
- Decide who can authorise a payment, and write it down. Most successful attacks work by pressuring one person who was not sure whether they were allowed to say no.
- Keep the records. If you ever do need to escalate, the emails, the account details and the timeline are the case.
Nothing in the framework requires you to act before March 2027. Knowing that the accountability sits upstream — and that you have somewhere to take a complaint — is the part most business owners currently do not know.
Sources
- ACCC — Scams Prevention Framework — the regulated sectors and the framework's purpose.
- AFCA — Scams Prevention Framework — the source for the small business consumer definition and the 31 March 2027 complaint pathway.
- Treasury — Scams Prevention Framework: Protecting Australians from scams.