Best Fraud Prevention Practices in Australia’s Banking Sector

Australians lost $2.18 billion to scams in 2025, a 7.8% rise on the year before despite growing industry investment in controls across the banking sector. Investment fraud led to $837.7 million. Payment redirection scams added $166.8 million. AI-powered deepfakes now appear in the majority of high-impact fraud attempts targeting financial services customers.

Three regulatory frameworks are converging simultaneously. The Scams Prevention Framework (SPF) Act 2025 came into effect in February. AUSTRAC’s reformed Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regime phased in from March 2026. The ABA Scam-Safe Accord established industry commitments that now define the market baseline for responsible banking fraud prevention in Australia.

Compliance teams are also managing real-time payment fraud from PayID and the New Payments Platform (NPP), plus new data-sharing fraud surfaces from the Consumer Data Right (CDR). This article maps each obligation to its fraud prevention implications and identifies where fraud prevention best practices in Australia tend to break down under operational pressure.

What Fraud Risks Are Australian Banks Facing in 2026?

The National Anti-Scam Centre recorded 481,523 scam reports across all channels in 2025. Older Australians (65 and above) absorbed 26.5% of total losses despite representing 17.1% of the population, a pattern regulators attribute to systemic control failures rather than individual lapses.

About 27% of Australians reported witnessing a deepfake scam in the past 12 months, which makes up around one in four Australians. AI-generated voices are now used to mimic relationship managers. Deepfake video calls impersonate senior executives. Payment redirection emails arrive with near-perfect brand replication. Financial fraud prevention in Australia is no longer addressable through rule-based batch processing designed for multi-day settlement. For compliance teams, the challenge has shifted from detecting catalogued fraud types to building systems that can catch attack patterns that have not been seen before. Fraud prevention in Australian institutions now requires continuous, adaptive controls rather than periodic policy reviews.

The Scams Prevention Framework Act 2025: What Banks Must Do Now

The SPF passed the Federal Parliament on 13 February 2025 and took legal effect on 21 February. Banks are the first sector formally designated under the framework, reflecting where regulators assess harm to be most concentrated.

The legislation names six obligations. On prevention and detection, banks must deploy technology controls that block scam transactions before settlement and run real-time monitoring rather than end-of-day batch review. The disruption obligation goes further. Banks must take active steps to interrupt a suspected scam transaction even when the customer has authorized the payment, reversing the long-held assumption that authorized transfers rest solely with the customer.

On the consumer side, response obligations require a 24/7 scam reporting channel with acknowledgement within 24 hours. Banks must also report actionable scam intelligence to regulators and industry networks and maintain a documented governance framework that covers anti-scam strategy and board-level oversight.

Banks that fail to demonstrate Australian fraud compliance with these obligations face civil penalties of up to $50 million.

On consumer liability, Australia’s approach differs from the UK’s Payment Systems Regulator, which mandates reimbursement for authorized push payment fraud victims up to £85,000 regardless of fault. Under Australia’s SPF, a bank that can evidence it met all six obligations has a strong defense against consumer loss claims. One that cannot be directly exposed.

What Does AUSTRAC’s AML/CTF Reform Require from Banks?

The Australian Transaction Reports and Analysis Centre (AUSTRAC) administers Australia’s AML/CTF regime. Its role in fraud risk management across Australia extends beyond financial crime specifically. The suspicious matter report (SMR) infrastructure it operates to surface patterns that connect individual fraud incidents to organized crime networks spanning multiple institutions.

Banks must submit an SMR within three business days of forming a reasonable suspicion, or within 24 hours when terrorism financing is implicated. AUSTRAC processes over 200 million transaction reports annually and has recorded a 258% increase in SMRs since 2017.

It has also separately flagged that the proportion of banks actively submitting suspicious matter reports remains too low, meaning a material share of detectable fraud activity goes unreported.

The reformed AML/CTF regime commenced on 31 March 2026 for existing reporting entities. The new Customer Due Diligence framework replaces the prior Applicable Customer Identification Procedures (ACIP), with a three-year transition running to 30 March 2029. From 1 July 2026, tranche 2 entities, including legal, accounting, and real estate firms, come under mandatory AML/CTF obligations for the first time.

AUSTRAC’s published regulatory priorities for 2025-26 explicitly name data quality and real-time monitoring as active supervisory focus areas. Australia fraud detection solutions built on legacy batch identification procedures will not satisfy what AUSTRAC expects from institutions under active supervision.

ABA Scam-Safe Accord: What Australian Banks Have Already Committed To

The Scam-Safe Accord, signed by all Australian Banking Association (ABA) and Customer Owned Banking Association (COBA) member institutions, combines financial investment, technical controls, and sector-wide intelligence sharing into a single industry commitment. 

At its center is a $100 million investment in a national Confirmation of Payee system that verifies payment recipients against account holders before funds move, targeting payment redirection fraud at the moment it most commonly succeeds.

The biometric mandate adds a direct line of defense against synthetic identity fraud. From 2024, every new online account opening requires at least one biometric check. Fraudsters constructing fake personas to open mule accounts cannot pass biometric verification against genuine identity documents, which removes the path they rely on to enter the banking system undetected.

All members must also join the Australian Financial Crimes Exchange (AFCX) and the Automated Fraud Reporting Exchange (FRX), enabling real-time intelligence sharing across the sector. Mule accounts that migrate between institutions as each bank identifies and closes them no longer have that escape route. 

During 2024, the first full year under the Accord, Australia recorded a 25.9% reduction in scam losses. Banking fraud prevention in Australia grounded in these commitments is producing measurable results.

PayID, the NPP, and the Real-Time Fraud Risks Banks Must Address

The New Payments Platform (NPP) delivers 24/7 real-time settlement across the Australian banking system. Traditional multi-day transfers gave risk teams up to 48 hours to identify suspicious activity and intervene before funds cleared. Real-time payments remove that window entirely, making fraud detection and disruption requirements simultaneous rather than sequential.

PayID enumeration and social engineering

PayID allows account lookup by mobile number or email address. Fraudsters exploit this through bulk enumeration attacks, systematically querying the system to collect account holder names for targeted social engineering campaigns. AUSTRAC expects NPP participants to implement real-time monitoring and SMR practices specifically calibrated to the speed and finality of NPP transactions, rather than adapting controls built for batch settlement.

Consumer Data Right as a fraud attack surface

The CDR’s action initiation capabilities, extended to non-bank lenders in March 2025, allow accredited third parties to initiate payments on behalf of customers. When a CDR intermediary initiates an action, the data-holding bank loses visibility of the device metadata, IP address, and transaction timing signals it normally uses for fraud scoring. Fraud prevention strategies for Australian CDR participants need compensating controls that preserve risk signal continuity across the data-sharing boundary so that the bank’s fraud detection posture does not degrade when a third party acts on the customer’s behalf.

How Shufti helps Australian banks meet fraud compliance requirements

Australian compliance teams face a coordination challenge that single-point tools cannot resolve. Three frameworks with overlapping requirements and different enforcement timelines demand a unified approach. Shufti’s fraud prevention and AML screening capabilities are built for exactly this architecture.

Shufti’s AML Screening draws on 100,000+ data sources, 3,500+ global watchlists, 2.6 million PEP profiles, and 215+ sanction regimes, with data refreshed every 15 minutes. A 15-minute data refresh cycle gives AUSTRAC-regulated institutions the real-time monitoring posture the 2026 reform demands.

Document verification and face verification with iBeta-certified liveness detection address the Scam-Safe Accord’s biometric requirement for every new account opening.

Shufti’s fraud prevention solutions are configurable by channel and customer risk segment, letting compliance teams tune controls without engineering intervention.

If your institution is managing SPF, AUSTRAC, and Scam-Safe Accord obligations at the same time, book a demo to see how Shufti fits your compliance stack.