A Scam Complaint Can Become a Systemic Signal

A complaint can be resolved. A pattern cannot.

The proposed AFCA Scam Rules recognise that scam activity commonly occurs at scale. They allow AFCA to handle related complaints together, investigate potential systemic issues and require remedial action that can extend beyond the individual consumer who complained.

That changes the value of complaint data. Under SPF, the more important question may not be whether an organisation resolved one case correctly. It may be whether the same weakness is appearing across the second, tenth or hundredth case.

Similar scam complaints can be handled together

The proposed AFCA Rules preserve AFCA's existing flexible complaint-resolution model while adapting it to scam activity. AFCA may group SPF complaints and handle them together where this supports fairness, efficiency and consistency. The comparative rules document expressly identifies this as a clarification designed for the new SPF environment.

That is particularly relevant to scams because a single campaign may affect many consumers through the same infrastructure, scam narrative or payment network. Ten complaints may therefore represent ten separate consumer losses. Operationally, however, they may also represent one underlying scam campaign.

Systemic issues extend beyond the person who complained

The proposed AFCA Scam Rules retain and adapt AFCA's systemic-issues framework for the SPF jurisdiction. This means a complaint can lead AFCA to examine whether the underlying problem may affect consumers beyond the original complainant. The proposed Rules include dedicated provisions dealing with systemic issues and serious contraventions.

This matters because scam harm is often repeated. A weak control may affect one victim today and many others before the organisation recognises the pattern. Once repeated complaints reveal the same underlying weakness, the risk is no longer limited to individual redress. It becomes a control and governance issue.

Scale alone is not the real question

Not every large scam campaign necessarily means that a regulated entity has a systemic problem. Scammers themselves operate at scale. A platform, bank or telecommunications provider may therefore encounter many victims of the same external scam without having committed the same failure in every case.

The more useful systemic question is different: does the pattern reveal an error, weakness, deficiency or response problem that is capable of affecting other consumers? That requires organisations to distinguish between repeated scam activity and repeated control failure. Those are not the same thing.

Complaint intelligence can expose recurring control gaps

Consider a hypothetical investment scam. The first consumer reports an advertisement and later loses money. A second complaint identifies the same website. A third identifies a related receiving account. Further cases show similar customer warnings, similar payment behaviour and related scam infrastructure.

Viewed separately, each case may appear different. Viewed together, they may expose:

• recurring scam infrastructure;
• repeated beneficiary relationships;
• common customer journeys;
• ineffective warning design;
• delayed disruption;
• repeated failure to connect external intelligence; or
• a wider weakness in escalation.

At that point, complaint analysis becomes threat analysis.

AFCA also creates a pathway from complaints to regulators

AFCA's proposed Scam Rules contain mechanisms for systemic issues, serious contraventions and other reportable matters. The Consultation Paper also explains that AFCA will collect and report information relating to SPF complaints, outcomes and trends as part of its expanded role.

The result is a broader feedback path: Complaint → Pattern → Systemic issue → Remediation → Regulatory visibility.

That means the quality of internal complaint analysis can affect more than EDR outcomes. It can influence how quickly an organisation identifies emerging control weaknesses before they become externally visible.

AFCA decisions will also shape future expectations

Treasury's Internal Dispute Resolution Position Paper states that AFCA's decision-making under the SPF will be guided by SPF Code obligations, with the SPF intended to become the primary benchmark for assessing compliance in scam matters. Treasury also expects that published AFCA decisions will gradually build a body of decisions against those benchmarks, improving transparency and predictability over time.

This has an important consequence. The early SPF cases will not only decide individual disputes. They will begin showing the market how obligations such as reasonable steps, investigation, disruption and cross-sector responsibility are being interpreted in practice. Organisations that learn only from their own complaints will learn slowly.

A complaint should feed the prevention system

Traditional complaint handling often follows a linear process: Complaint → Investigation → Compensation → Close. That is a weak operating model for scams. A scam complaint can contain intelligence about:

• the lure;
• impersonated organisation;
• infrastructure;
• telephone or messaging identifiers;
• payment destinations;
• victim behaviour;
• scammer techniques;
• existing controls; and
• missed intervention opportunities.

That information should feed back into prevention. A stronger model is: Case → Pattern → Intelligence → Intervention → Improved Control. The objective is not merely to resolve the complaint. It is to reduce the probability that the same lesson has to be learned from another victim.

Cyberoo perspective

The biggest SPF risk may not be losing one complaint. It may be allowing the same control gap to produce the next complaint.

That is why scam intelligence should operate across cases rather than remain inside individual complaint files. Domains, narratives, impersonation identities, payment destinations and disruption outcomes become more useful when they are connected across events.

Under SPF, that also creates a powerful governance question:

What did the organisation learn from the first case, and what changed before the next one occurred?

If the same scam pattern repeatedly reaches external dispute resolution, the underlying problem may no longer be complaint handling. It may be threat visibility.

Frequently Asked Questions

Cyberoo perspective on readiness

A complaint should not be the end of the scam intelligence lifecycle.

The strongest operating model feeds the evidence, pattern and lessons from the complaint back into detection and disruption before the same weakness produces another loss.