AFCA Proposes Doubling the Scam Cap to $1.26 Million Per Claim

On 31 August 2026 - one day before Australia’s Scams Prevention Framework required every regulated bank, telco, and digital platform to hold AFCA membership - the dispute body quietly opened a consultation that will set the financial stakes for every scam that gets through.

The headline number: AFCA is proposing to double its direct scam loss ceiling from A$631,500 to A$1.263 million per complaint. That cap applies once per scam, regardless of how many companies contributed to the failure. For a bank whose controls missed a payment redirection attack, this is not a regulatory fine. It is a payment that goes directly to the victim.

Submissions close 28 September 2026. AFCA’s board is targeting final approval by late December, with rules published in early 2027 and effective from 31 March 2027.

Why September 1 Changed the Stakes for Banks

Before the Scams Prevention Framework, AFCA’s jurisdiction over bank scam failures rested on the ePayments Code - a voluntary industry standard that banks signed up to in their own time. The 2026 SPF changed that structure entirely.

From 1 September 2026, every designated bank, telecommunications provider, and digital platform providing a regulated service must hold AFCA membership as a condition of operating under the SPF regime (ACCC). An entity that missed the September 1 membership deadline faces enforcement action and civil penalties.

That membership requirement is not symbolic. It means any customer affected by a scam can now bring a formal complaint to AFCA against their bank, telco, or platform - and AFCA can order compensation. The broader SPF obligations, which cover proactive prevention, detection, reporting, and response, apply from 31 March 2027, backed by civil penalties of up to $50 million per contravention.

The August 31 consultation closes the loop: it defines exactly how much AFCA can order each entity to pay when a claim is upheld.

There is also a floor to note. AFCA’s proposed rules include A$6,300 for indirect losses per entity and A$12,600 for non-financial losses such as distress and inconvenience. Neither of those categories is trivial in the context of a complex investment or payment redirection scam, where victims can spend months trying to recover funds and sustain real psychological harm in the process.

The Multi-Party Liability Rule Is the Real Change

The cap increase matters, but the structural change that will most reshape internal risk assessments inside banks and platforms is the multi-party joinder rule.

Under the proposed Scam Rules, AFCA would be able to join multiple regulated entities into a single complaint and divide liability among them (AFCA). Today, a victim of a sophisticated investment scam involving a fake social media ad, a phone-porting attack, and a fraudulent bank transfer must file three separate complaints against three separate entities. Many victims give up before they reach the third.

From March 2027, one complaint could put the bank, the telco, and the platform at the same AFCA table simultaneously - and AFCA would apportion the $1.26 million ceiling across them based on its assessment of who failed and by how much.

For compliance teams, this is a material shift in risk posture. Previously, a bank could take comfort in the fact that if a scam began on a social platform, that platform bore the first loss. Under multi-party joinder, that comfort disappears. The bank is in the room from day one, defending its own share of the outcome.

It also changes the calculus around scam reporting. Banks that delay investigating a scam complaint - or that pass the customer back to the platform - now face the risk that AFCA will view that delay as evidence of inadequate response, increasing the bank’s share of liability when the complaint is eventually resolved.

HSBC Showed What Inadequate Controls Cost

The AFCA consultation is a forward-looking proposal, but the Federal Court has already shown what inadequate scam controls cost under the current framework.

In June 2026, Justice Bennett ordered HSBC Bank Australia to pay a $35 million penalty after the bank admitted systemic failures in its internal transfer controls between May 2023 and May 2024 (ASIC). More than 1,000 customers reported unauthorised transactions with a combined value of $34.6 million. Investigations took an average of 144 days - a figure the court found excessive. HSBC has since paid approximately $21.5 million in direct compensation.

ASIC Chair Sarah Court called the penalty “the strongest scam wake-up call yet to the banking industry.” Under the proposed AFCA rules, that wake-up call arrives on a per-claim basis at up to A$1.26 million each.

The HSBC case involved unauthorised transactions rather than payment redirection specifically. But the principle the Federal Court applied - that a bank must maintain adequate controls, and that failure to do so makes the bank bear the loss - is exactly the logic AFCA’s proposed Scam Rules will extend to every regulated entity from March 2027. The question will be whether each entity’s controls were adequate for the type and value of the transaction involved.

Payment Redirection Is the Category Most Exposed

Of all scam types, payment redirection sits in the most directly exposed position under this framework.

ACCC’s ScamWatch recorded $166.8 million in payment redirection losses in 2025, making it the second-largest scam category by dollar value (ACCC). Payment redirection - also called business email compromise or invoice fraud - works by substituting legitimate banking details with fraudulent ones at the moment a payment is arranged. A finance team pays what it believes is a valid invoice. The money lands with a criminal.

For every dollar lost in this category, the question under the new AFCA framework becomes: which regulated entity failed to prevent it? The bank that processed the payment without verifying whether the account number matched the intended recipient? The platform through which the fraudulent payment instruction arrived? The telco whose authentication layer was bypassed?

Under multi-party joinder, all three can be in the one complaint simultaneously.

The single intervention that directly addresses payment redirection risk at the payment rail is verification of the destination account - confirming that the BSB, account number, ABN, and account holder name all correspond to the entity the payer intended to pay. Confirmation of Payee, which reached industry-wide coverage in July 2026, covers this for consumer bank-to-bank transfers. But business-to-business payment flows - supplier onboarding, progress payment instructions, subcontractor bank detail updates, and property settlements - remain a gap that CoP’s infrastructure does not close.

That gap is where $166.8 million walked out the door in 2025. It is the gap AFCA’s proposed framework will ask regulated entities to account for.

What “Reasonable Steps” Actually Means in a Claim

AFCA’s proposed rules do not prescribe the exact controls each entity must have in place. They adopt a reasonableness standard: was the entity’s response to the scam appropriate given its role, the risk profile of the transaction, and the steps available to it?

In practice, the entities with the strongest position in an AFCA claim will be those that can produce a record showing they took steps to verify the payment before it was processed. A bank that ran payee verification at the point of payment and generated a verification record has a defensible argument that it met the standard of care expected of it. A bank that processed a large B2B payment to an unfamiliar BSB with no check has no such record to produce.

The proposed timeline - submissions by 28 September, final rules by late December, obligations live from 31 March 2027 - gives regulated entities roughly six months to put those records in place. That is not a long runway for banks and platforms that have not yet systematically built verification into their B2B payment flows.

What Businesses on the Paying End Should Know

AFCA’s framework creates obligations and recourse paths for consumers. Business-to-business payments sit in a different position: a company that pays the wrong account because of a fraudulent invoice instruction has recourse through AFCA only if a regulated entity’s failure contributed directly to the loss.

A WA District Court ruling highlighted in the AUSTRAC Tranche 2 coverage from this blog established that a payer who failed to independently verify altered banking details bore the loss themselves - the responsibility did not shift to the bank. That principle means businesses cannot rely on AFCA to recover payment redirection losses that arose from their own failure to verify before paying.

Both sides of the payment rail face exposure. Regulated entities face AFCA claims from customers whose scams succeeded. Businesses that pay without verifying face bearing their own loss. The SPF and AFCA’s proposed Scam Rules address the first category. They do not eliminate the second.

The only protection that works across both is verification at the moment of payment - before money moves.

The Consultation Is Open Now

Written submissions to AFCA close on 28 September 2026. The framework is designed to give industry a chance to respond before final rules are set, and several points remain genuinely open: how liability will be divided across entities in multi-party claims, what records will constitute evidence of reasonable steps, and how the $1.26 million ceiling will interact with cases where victim losses exceed that figure.

Any bank, platform, or telco operating under the SPF should be tracking these questions closely. The answers will determine what “adequate controls” means in practice when the first AFCA claims under the new rules are filed in 2027.

---

ezyshield is on a mission to eliminate payment fraud in Australia. We verify the person, the business, and the bank account before money moves - so payments only ever land with who they’re meant to. Learn more