You reported the scams. They came back stronger: Why the Australian scams prevention framework needs a cyber intelligence mindset

Australia has made a major policy move with the Scams Prevention Framework (SPF). But the SPF will only reduce harm if industry stops treating reporting as the finish line. Too often scam and phishing activity is detected, logged and escalated, yet the domains, ads, mule accounts, phone numbers and impersonation infrastructure behind the campaign remain live. That gap matters because modern scams behave less like one-off fraud incidents and more like distributed cyber operations, now accelerated by generative AI that helps criminals scale impersonation, fake content and adaptive lures at lower cost. The SPF is directly relevant here because it is designed to push action across the ecosystem, beginning with banks, telecommunications providers and digital platform services such as social media, paid search and direct messaging.

The numbers show why this topic is timely. Australians made 481,523 scam reports in 2025, with 274,577 involving financial loss totalling 2.18 billion. Online-based scams with a loss rose 31.8 per cent in 2025, while losses from those online contacts rose 21 per cent. Phishing scams alone caused 97.6 million in losses in 2025, and investment scams caused $837.7 million. At the same time, ASIC said on 8 April 2026 that in calendar year 2025 it coordinated the removal of 11,964 phishing and investment scam websites, up 90 per cent on the previous 12 months, and that more than 25,000 such sites have been knocked out since its takedown service began in 2023. ASIC also warned that generative AI is making scam content more polished, more convincing and harder to spot.

This session argues that the SPF is most useful when read not only as a compliance framework, but as an operational blueprint. Its logic is already cyber-operational: designated sectors are expected to prevent, detect, report, disrupt and respond. The challenge is that many organisations are still relatively mature in reporting, but weak in verification, correlation and disruption. They can collect signals, but they cannot consistently turn those signals into structured evidence, campaign-level intelligence and rapid intervention across channels. I will show how to reframe scam prevention as a closed-loop cyber intelligence problem: explainable verification of suspicious signals; structured evidence that can be reused across cases; campaign mapping across websites, social accounts, phone numbers, payment destinations and impersonated brands; and disruption workflows that feed outcomes back into monitoring, prioritisation and faster action. I will also argue for a more shared operational language for scams, closer to tactics and techniques than channel labels and case queues, so intelligence can be reused across institutions and sectors. This is a practical session for leaders and practitioners who want the SPF to do more than raise reporting volumes. It asks a harder question: how do we make reporting lead to disruption before more Australians are harmed?