For insurance brokers, two announcements from the Australian Financial Complaints Authority (AFCA) in late August and early September 2026 may appear procedural. They are not. AFCA confirmed 114 new organisations had joined as members under the Scams Prevention Framework (SPF) ahead of the September 1 deadline and opened a four-week consultation on the rules that will govern how it handles scam complaints from March 31, 2027. Behind both announcements sits a liability architecture that the government has explicitly said will reach the insurance sector – and an enforcement record that has already demonstrated it has teeth.
The Scams Prevention Framework Act 2025 passed Parliament in February 2025, requiring banks, telecommunications providers, and digital platforms to prevent, detect, disrupt, report, and respond to scams, backed by civil penalties of up to $50 million per contravention. Those penalties have since moved from statute to court order. In June 2026, the Federal Court ordered HSBC Bank Australia to pay $35 million after the bank admitted to failures in protecting customers from scams. Australian Securities and Investments Commission (ASIC) chair Sarah Court described the outcome as “one of the first of its kind globally” and said it was “the strongest scam wake-up call yet to the banking industry.”
ASIC’s investigation had analysed more than 1,000 reports of unauthorised transactions with a total value of $34.6 million between January 2020 and August 2024. HSBC has since paid approximately $21.5 million in compensation through a remediation program, with further payments to come. For brokers placing financial lines cover for bank clients, a $35 million court penalty alongside a separate $21.5 million remediation program is a concrete reference point for limit adequacy conversations at renewal.
When releasing the SPF’s draft sector codes and rules in May 2026, Assistant Treasurer Dr. Daniel Mulino said the government was moving “beyond voluntary action to a stronger, coordinated approach across the economy.” The government had already put the insurance sector on notice: in November 2024, when introducing the SPF legislation, it said the superannuation, insurance, and cryptocurrency industries would be “fast followers” and did not have to wait for government designation to begin work on improving consumer protections.
The Insurance Council of Australia (ICA) engaged with the process early. In a submission to the Senate Economics Legislation Committee, the ICA urged policymakers to consider the unique characteristics of the insurance sector, pointing out that common scams involving insurers – including phishing schemes, fraudulent insurance websites, and misleading requests for claim processing fees – differ from those targeting banks. The ICA called for a phased rollout and noted that scams often intensify following natural disasters, as consumers navigating urgent claims become more vulnerable. The ICA is also building infrastructure ahead of designation. In November 2025, it launched a national data analytics fraud detection platform developed with its counter-fraud and scams division, the Insurance Crime Intelligence Network of Australia (ICINA), enabling insurers to securely share fraud patterns, coordinate investigations, and identify emerging threats in real time.
The National Anti-Scam Centre’s Targeting Scams Report recorded combined scam losses of $2.18 billion in 2025, an increase of 7.8% from 2024. Investment scams led at $837.7 million, followed by payment redirection scams at $166.8 million and romance scams at $139.9 million, with the top five scam types accounting for 60% of total losses. AFCA received 5,977 scam-related complaints in 2024-25, a 45% drop from the prior year’s record highs. AFCA chief ombudsman David Locke cautioned against reading the decline as cause for comfort: “AFCA currently only sees a small proportion of scam complaints, and towards the end of the financial year we saw an uptick in some scam types that cause great harm.” AFCA’s proposed rules would allow it to bring several regulated entities into a single complaint and divide liability between them proportionately – a multi-party external dispute resolution model AFCA describes as the first of its kind globally. The consultation also proposes raising the direct scam-loss cap from $631,500 to $1.263 million, doubling the current ceiling for direct financial loss.
The SPF’s emerging liability architecture creates specific coverage conversations brokers should be having now – before their clients’ sectors are designated, and before claims test whether existing policy wordings are fit for purpose. Social engineering and funds-transfer fraud cover can carry sublimits materially below a policy’s headline cyber limit, and some policies may restrict or exclude losses arising from business email compromise or invoice fraud where there has been no covered system compromise. Payment redirection scams – which accounted for $166.8 million in reported losses in Australia in 2025 – illustrate the type of exposure brokers should examine when assessing how these risks are insured.
There is also a regulatory dimension brokers cannot overlook. Under section 912B of the Corporations Act 2001, AFS licensees that provide financial services to retail clients must generally have adequate compensation arrangements in place; for most licensees, this requirement is satisfied through professional indemnity insurance. For brokers, that makes it important to consider whether clients are adequately advised about material exclusions, sublimits, and uninsured scam exposures when arranging cover.
One question that remains unresolved in both the SPF legislation and accessible legal commentary is whether an insurer that pays a client’s scam-related claim could pursue subrogation against a bank or telco that an AFCA determination subsequently finds liable for the same loss. That is genuinely new legal territory – and the answer, when it comes, will matter significantly to how financial lines and cyber policies are priced and structured for designated-sector clients. It is a question worth raising with financial lines underwriters and legal advisers before the March 2027 operational date arrives. AFCA chief scams officer David Lacey framed the scheme’s ambition plainly. “Scams are one of the most significant issues affecting consumers today,” he said when appointed to lead the build-out of AFCA’s scams EDR function. The coverage and liability questions that follow from that statement are now squarely within the broker’s remit.
