Good morning. I would like to begin by acknowledging the Traditional Custodians of the lands on which we all meet today. I'm on the land of the Gadigal people of the Eora nation, and I pay my respect to their Elders past, present and emerging. I extend that respect to any Aboriginal and Torres Strait Islander peoples who are joining us today.
I also extend my thanks for Graeme and the team at Comms Day for the invitation and for putting on another terrific summit.
For some time, we have been very focused on the importance of the telecommunications sector to our social life and the economy, to consumers and business.
This was brought into sharp focus during the pandemic, when telco services became our lifeblood, allowing us to work, educate and maintain our social connections. Indeed, the Australian telecommunication sector is to be congratulated for its performance during the COVID-19 pandemic.
Today I would like to cover a challenging area of work – the sophisticated and large-scale targeting of Australians by scammers. I will then cover the successful work to address it by the ACMA, telco sector and key collaborators and the ongoing work needed to protect consumers and harden our telecommunications networks to scammers.
Scams are an area the ACMA has a particular focus on, especially given the scale of the problem, and the serious harms involved.
As a sectoral regulator, with a wide range of available interventions, we are uniquely positioned to work with industry to achieve outcomes for consumers and the industry itself.
Scammers are effectively undermining confidence in our telecommunications networks and services. Mention ‘scams’ to anyone and the depth of frustration quickly becomes evident.
At an aggregated level, almost every Australian adult and business is impacted by phone scams – most of us screen calls and have adopted workaround behaviours.
Research we conducted last year shows 98% of Australian adults receive unsolicited communications on their phone. 86% reported scam calls, with 4-in-10 receiving scam calls at least weekly. I am sure there are people in this room who receive them much more frequently.
The majority of Australians are annoyed by scam calls and around a third of us also feel anxious, distressed or vulnerable.
Phone scams are not just a by-product of our fast-moving digital world. They are at best intrusive and annoying; at worst, life-changing.
First, there are the financial losses to scammers. From January to March this year, Scamwatch reported that financial losses associated with phone scams increased 61% on same period in 2021 – rising from around $20 million to $33 million. Alarmingly, reported losses from SMS scams increased by a staggering 331% for the same period – from around $1 million to over $4 million.
We know the total losses are likely to be much higher, as people who lose money to scams or fraud sometimes feel ashamed and embarrassed. This can lead to under-reporting, or it not being reported at all.
At the more extreme end, when a person has their identity stolen, they may experience repeat and ongoing victimisation due to unauthorised use of their identity and ongoing financial impacts.
And ultimately, there are also the very real emotional and psychological impacts that phone scams have on victims. As a submission to the Productivity Commission stated:
‘… behind the mind-boggling statistics are real human beings, who are crippled by debt, traumatised by their ordeal and are stuck wondering how to rebuild their lives’.
It is not an exaggeration to say that Australia is being targeted by scammers on an industrial scale. Recent media coverage reinforces the need for strong customer authentication rules.
Our data indicates the average reported loss to these types of identity scams is around $28,000 per person, and some people lose hundreds of thousands of dollars.
So, let’s look at what the ACMA is doing to address these challenges.
The ACMA has a key role to play in combating scams as the sectoral regulator for telecommunications, with the added responsibility for enforcing Australia’s spam and telemarketing laws.
In early 2019, we began our Scam Technology Project to investigate technological ways to stop scams in the Australian context.
To inform this work, we partnered with the Australian Competition and Consumer Commission and the Australian Cyber Security Centre. We also comprehensively consulted with industry and our international regulatory partners through the Unsolicited Communications Enforcement Network.
In late 2019, these efforts came together with the release of our Combating Scams Action Plan. The Plan recognised that effective scam mitigation would require ongoing action from government, the telco industry and consumers.
In response to the Action Plan and mounting evidence of the harms occurring, a number of initiatives were actioned:
- We stood up our collaborative Scams Taskforce made up of industry, regulators and other key entities like the financial sector, AFP, ATO, Home Affairs, ID Care, Services Australia and Aust Post
- Communications Alliance developed the Reducing Scam Calls Code, which we subsequently registered in late 2020.
- We made new rules to help stop mobile porting fraud and scammers targeting weak points in the security arrangements for customers interacting with their telcos, such as when swapping SIMs. These rules place obligations on telcos to undertake multi-factor ID checks when dealing with customers.
- Along with the telco industry, we advocated for new regulations under the Interceptions Act to support scam SMS filtering.
- And, we’ll soon consider registering new rules developed by Comms Alliance to help prevent SMS scams from reaching Australians.
These interventions have seen well over half-a-billion scam calls blocked by telcos in the first 16 months of the Reducing Scam Calls Code operating, and around a 95% decrease in reported mobile porting fraud. We hope to see a similar drop-off in SIM-swap scams after our new rules come into effect on 30 June.
We are also seeing promising very recent data that scam call complaints to Scamwatch and the ACMA have dropped dramatically in the period from Jan to March this year – a 49% decrease for Scamwatch and 70% decrease for the ACMA. We will be actively monitoring to see if this trend continues. Given the agility of scammers, we need to exercise some caution about shorter term trends.
We have also seen the introduction of successful ‘Do Not Originate’ trials that have prevented scammers using the numbers of trusted brands and government bodies, like the Australian Tax Office, to attempt to add legitimacy to their scams.
In the ATO case, telcos used software to identify calls that had been over-stamped with public-facing ATO phone numbers – and blocked them if they weren’t originating from the ATO’s provider.
While this will not stop scammers randomly ringing Australians and pretending to be from the ATO, it will stop specific ATO numbers appearing in the CLI display on the recipient’s phone, thus making the scam seem much less convincing. It also prevents ATO staff from receiving call-backs from understandably frustrated Australians.
It's also promising that we are seeing telcos continue to develop their capability to address scammers. One telco recently reported it blocked over 90 million calls in a 4-month period, a significant increase on its efforts in previous periods.
We also recognise that some providers have been proactive in introducing measures to protect their customers from identity theft, while others have recently taken major initiatives to identify and block scam SMS.
While the numbers of blocked scam calls are huge, no-one has visibility of the actual scale of the problem. It is probably conservative to say that 2 to 4 billion scam calls are received in Australia each year. And despite the successes in combating phone scams to date, it is clear more needs to be done.
The potential ‘whack-a-mole’ nature of addressing scams should not be underestimated or dismissed. However, every scam call that doesn’t reach a consumer is a good outcome, and every initiative that helps to disrupt the scammers ‘business’ model and make Australia a harder target, is important.
With concerted disruption, including on other platforms and apps, we can push Australians way down on the list of desirable scam targets and save consumers millions of dollars.
Combating scams is a seriously challenging business. And while we are having some wins, set-and-forget industry efforts and regulatory obligations are not going to effectively address the problem.
Scammers will ruthlessly test perceived and actual weaknesses in systems, processes, regulations and markets. They will also ‘socially engineer’ scam outcomes by continually testing and manipulating consumers.
The scale and sophistication of the third-party bad actors causing the problem means industry, government and consumers must remain vigilant and embrace new initiatives. It is this collaboration that will enable further successes.
In their mission to find new victims (or revenue streams), scammers will try and find the weakest link in a system, meaning rules must be uniformly applied and complied with. Rules must also be outcomes-focused, with their effectiveness monitored, and adapted as required
But rules are only one mechanism we have, and telcos can – and should – always do more.
Here I note and applaud Telstra’s recent announcement about SMS filtering under its ‘cleaner pipes’ initiative. We look forward to understanding the impact of Telstra’s initiative in due course.
There needs to be a robust framework established to share and disseminate information about scams across industry and government, ideally in real-time, or as close to it as possible. I note that under the new rules, telcos now have obligations to provide information promoting scam awareness to their customers.
Providers need to develop automated compliance systems, and actively monitor for international better practice. I note TPG Telecom’s initiative at our recent Scams Taskforce meeting to engage industry in considering whether STIR-SHAKEN protocols are suitable or not to the Australian telecommunications environment.
Alongside these stronger rules and frameworks, there needs to be greater information-sharing among telcos, between telcos and government, and within the international regulatory community.
I am pleased that the ACMA and ACCC are now providing de-identified complaint data to telcos to facilitate blocking scams, and we are seeing some evidence of notifications across industry between providers.
Calling out the weak links is also important – if other telcos are the source of, or transiting, scam calls tell us. This will help us enforce the rules, noting phone scams are a currently compliance priority for the agency.
Telcos and the financial sector also need to better share data and work together to mutually protect their customers. The ACMA obtains data from both sectors that we believe would be of utility across the sectors. This proposal is being actively taken forward by Comms Alliance under our Scams Taskforce, where the telco and financial sectors have seats at the table.
As you’ve heard, a lot of this work is happening, including under the auspices of our collaborative Taskforce, led by ACMA member Fiona Cameron, but greater effort will be required if we are to address the harms seriously and consistently.
The Australian telecommunications environment has been a key target for scammers for some years, and it is well overdue that we use our unique environment as a strength. For instance, we have a limited number of carriers and, our telco market, while healthy, is also relatively small in numbers. These factors should enable us to effectively collaborate, build mechanisms to share information and take steps that will effectively stop scam activity reaching Australians.
The Do Not Originate approach is a good example, as is the continued focus on automated filtering technology. Traceback of potential scam calls and use of commercial arrangements to block calls via interconnect arrangements also hold good promise in our environment.
We have been building a formal information-gathering network with the Australian Financial Crimes Exchange, the Australian Securities and Investments Commission, the ACSC, the ACCC and some of our key international partners. This is helping us to detect emerging threats and risks, inform our compliance and enforcement actions and assess the effectiveness of the rules.
Internationally, sharing information and intelligence has never been more important. We now have MOUs in place with the US, Canadian and New Zealand regulators and are actively engaged with our fellow regulators in the UK and Singapore.
We are an executive member of the global Unsolicited Communications Enforcement Network (UCENet) and are actively working with key international partners to look for mutually beneficial ways to cooperate. There has also been a great deal of interest in the scam reduction initiatives taking place in Australia.
Ultimately, there will also always be a need for consumers to be alert and informed about how to identify and protect themselves from scams. To complement existing activities, including the scam alerts we issue when we identify emerging or significant threats, we’ve developed a comprehensive suite of consumer resources. These are focused on educating consumers to spot – and take action to stop – phone scams.
We’ve been actively pushing these materials – which are available in five languages and some specifically developed for First Nations Australians – through social media, and via fellow regulators and consumer groups. Our focus has been on reaching older Australians, as our research tells us they are more likely to benefit from greater awareness of how to identify and protect themselves from scams.
I would like to finish with several calls to action and a few acknowledgements.
Unfortunately, and as we all know, there is no silver bullet to eradicate phone scams. This is a fight that requires a concerted, ongoing, cooperative and adaptive response from industry and regulators.
In a very real sense, we are all in this together against a determined and agile adversary.
At the ACMA, our immediate focus will be on the new customer authentication rules that come into effect on 30 June. Our initial activity (including in the months between now and when the Determination comes into effect) will be on awareness raising and education on the new obligations.
We also expect that industry will pursue concerted efforts to implement compliance systems without delay, building on existing processes and/or efforts that have already commenced.
We would like to see:
- Industry finalising the revised reducing scam calls and scam SMS code for potential registration as a priority – we appreciate this is planned for late May.
- Industry actively staying on top of new international and domestic provider-level initiatives, including whether STIR-SHAKEN protocols should be adopted in Australia.
- Regulators and industry monitoring the effectiveness of the rules introduced to date, and being more responsive to agile scammer behaviour.
- Providers continuing to develop their capability to identify and block scams. Specifically, via automation, filtering and notification/traceback initiatives.
- More take-up by trusted brands of Do Not Originate initiatives.
- Industry and the financial sector exploring how they can better work together and share data and collaborative approaches to combat scams. I’m pleased to say a step in this direction has recently been taken under the auspices of our Scam Taskforce.
- More concerted work by providers to get consumer awareness messages about phone scams out to their customers. We have developed resources, available on our website. Please feel free to use or adapt them.
I would lastly like acknowledge the impressive work of the telco sector to date, and of individual providers who have strongly collaborated with us and led the way for the rest of industry.
It is only by continued strong collaboration across government, the telco industry, and the financial sector that we will keep succeeding. Every scam call or attempt blocked is a win for consumers, and serves to build confidence in our telecommunications networks and services.
We look forward to working with industry and our other partners in addressing this challenge.
Thank you.