Reported scam losses have fallen by 25.9% year-on-year per a press release from Australia’s Scamwatch. There are many lessons that can be learned from Australia’s success, and Commsrisk has tried to draw attention to those which are most pertinent to the communications sector. However, there are also some fundamentals that keep going AWOL when I listen to the anti-scam strategies being advocated by other people around the world. Here are three observations about Australia’s approach to scam reduction that are so fundamental that some people may not even be aware of them.
1. It’s about the money, honey.
Time and again we see measures of fraudulent activity which tell us the wrong things. Examples include the number of calls blocked, or changes in the number of complaints received by consumers. Those are not good metrics to determine success. A braindead scammer may have a machine that pumps out thousands of calls or messages that all get caught by a telco’s filters, but that proves nothing except that the scammer has not improved the methods they used. More elaborate scams also tend to be much more highly targeted at specific victims. They may focus on live conversation rather than the repetition of messages or recordings that are easier to detect because they have been repeated so often.
The most important scam measure involves counting the amount of money lost by consumers, and not confusing this figure with the amounts lost by businesses, as some have tried to do. These losses cannot be measured by telcos on their own. This further explains why nations must take a joined-up approach to scam reduction that encourages disparate business sectors to work together and establish common priorities, as the Aussies have.
2. Keep it simple, stupid.
So you were working on the draft specification for an untested technology that will leverage a series of capital investments that will need to go into future infrastructure over the course of the next five years and which will then allow you to make some positive steps towards… WRONG! Do something effective today. People are falling victim to scams right now. None of those victims are helped by a utopian plan that might get realized in a decade from now.
The Aussie approach to scam reduction has been characterized by simple bold improvements that were effected with minimal delay and fuss. In 2019, the leading Australian telcos began implementing blocks on inbound international calls that spoofed domestic numbers. Americans are still arguing about whether such blocks are even possible. In 2022, Australia wrote and adopted straightforward rules to reduce impersonation by SMS; these rules have been vigorously enforced since. In contrast, the US regulator is now hoping to punish a telco for not complying with a know-your-customer rule that has supposedly existed for years, although the substance of this rule has never been written anywhere. That is why the same company insists it will fight the US regulator over its alleged KYC failing but did not fight when the Australian regulator fined them for clear violations of their rules.
3. The needs of the many outweigh the needs of the few.
Mr. Spock from Star Trek was a cold, rational Vulcan who said it best. I am far more emotional, but I try to obey Spock’s principle too. There were times at this year’s Mobile World Congress when I wanted to scream: fraud prevention is not just about protecting banks and other big businesses. Impersonation of banks is a genuine problem, and it is good that work is being conducted that will help ordinary people validate the identity of banks and other big businesses when they communicate with customers. It is also good that banks and payment businesses are working on ways to stop transfers of money when victims have been duped by scammers. But not every kind of anti-scam control should be motivated by the desire to reduce the liability of banks and other financial firms.
Consider romance scams. Scams where somebody pretends to be in a loving relationship with the victim have been consistently listed amongst the top five scams afflicting Aussies. That is why the Aussie strategy is designed to tackle romance scams too. No romance scammer is pretending to be a bank manager. They may be pretending to be a hot young lady. They may be pretending to be the heir to a diamond mogul. They may even be pretending to be Brad Pitt. But they are definitely not pretending to work for a bank. So whilst I appreciate why the biggest whores working for providers of anti-scam tech would like to sell, sell, sell their network-based solutions to banks, the comms sector has a responsibility to protect all people from all kinds of scams. That means implementing controls that reduce the broadest range of scams, and not just those which can most lucratively be supplied to big businesses.
