How Australia’s Scams Prevention Framework protects payers beyond the border

From buyer beware to seller beware – the shifting liability for fraud losses

For most of the history of electronic payments, the fraud loss from a payment the customer authorised sat with the customer. If you pressed send, you owned the outcome. That paradigm is eroding, and the pattern is consistent: regulators are making the quality of a payment firm’s controls the test of who is responsible when problems occur. This is a shift in where liability for mistaken and fraudulent payments resides.

The UK moved first with the arrival of Confirmation of Payee (CoP) in 2020, and since October 2024 authorised push payment (APP) fraud must be reimbursed, up to £85,000, with the cost split between sending and receiving firms. In Europe, Verification of Payee (VoP) became mandatory for euro instant payments in October 2025. The PSR/PSD3 package goes further and a provider (sending PSP and/or receiving PSP) that fails to implement appropriate fraud controls is liable for the customer’s losses. Further, they must refund bank-impersonation scams. Australia has taken its own route – it inherits some of the practices from international markets together with a broader brush ecosystem approach (the first of its kind globally) that formalises the complaint and dispute process to manage grievances between payer and payment firm.

The Scams Prevention Framework Act 2025: Enforcing payment controls across the ecosystem

Australia’s Scams Prevention Framework Act 2025 sits in Part IVF of the Competition and Consumer Act. Treasury owns the framework and the rules beneath it, with ASIC as sector regulator for banks. Australia has uniquely taken an ecosystem approach whereby banks, telcos and digital platforms must prevent, detect, disrupt, respond to and report scams, with most obligations starting on 31 March 2027. The Australian Financial Complaints Authority (AFCA) is an independent, non-government dispute resolution scheme where consumers and small businesses can bring scam complaints. AFCA can assess whether each party met its obligations and allocate compensation accordingly.

This is not a blanket reimbursement for authorised push payment (APP) fraud, although the Australian federal government did mandate a A$3,000 automatic reimbursement for low value scam losses to pre-emptively head-off lengthy and costly legal and complaint processes. This measure mandates that banks, telecommunications providers, and major digital platforms (with over $1 billion global turnover or 200,000 active users) must automatically reimburse verified scam victims up to A$3,000. More importantly protections have been introduced to guard against larger losses. The complaints authority (AFCA) has the authority to legally order firms to pay compensation up to A$1,263,000 per scam complaint. Ultimately, there is full liability for breaches: if a bank, telco, or platform breached their mandatory duties—such as failing to implement Confirmation of Payee, they can be held liable for the entire amount lost.

Domestic controls are becoming border controls

Australia’s Confirmation of Payee, now live at more than 100 institutions and past 150 million checks in its first year, launched as a domestic-only safeguard. As we know, the beneficiary account in a payment-redirection or investment scam is frequently offshore. That gap is why cross-border scam controls are moving up the agenda for Australian payment firms.

The clearest cross-border signal on protection for frauds and scams comes from FATF. Revised Recommendation 16, agreed in June 2025 and due for implementation by the end of 2030, requires financial institutions to use tools that protect against fraud and error, such as verifying recipient account details. The draft guidance adds alignment checks for beneficiary institutions on cross-border transfers. The virtual asset Travel Rule sits under Recommendation 15 and points the same way. Although FATF does not allocate losses across parties or hear disputes it signals that verifying the payee is a supervisory expectation and failing to verify becomes very hard to defend when a customer complains following a loss.

Nothing in the cam prevention framework Australia is inherently local. The framework protects the Australian customer (a consumer or a small business) and is ambivalent on where the scammer’s account sits. As such cross-border payments to offshore beneficiaries are included in the scope of the framework.

Upfront controls help get every payment decision right

Domestic instant payments set the service expectation that cross-border is now chasing, under a G20 agenda of faster, cheaper and more transparent payments. Speed removes the recall window, so the only effective control is the one applied before money moves, a pre-payment check and control capability. The clear direction of travel is that what regulators define as reasonable protections for domestic payments also gets applied to international payment flows. The net effect is that an Australian payment firm will struggle to explain to AFCA why it name-checked a A$200 domestic transfer but not a A$200,000 payment to a new overseas supplier.  

IPID is a global payee and beneficiary validation service that improves the decision-making for moving money. Its differentiation is the breadth of its network for real-time name-matching of beneficiary accounts where account ownership checks are provided in over 50 countries. Many firms rely on historical observed payment activity, which says little about a first payment and ownership check to a new payee.

For payment firms, a pre-payment check turns cross-border scam  controls from an abstract obligation into evidence for a regulator or an AFCA complaint in Australia. For customers, it means fewer losses, fewer disputes and the confidence to pay across borders.