By Andrew Klein

Dedicated to every Australian who has been told their money is safe — only to discover it was never protected.

I. Introduction: A Test Transaction

On a routine visit to a Melbourne venue, my card was scanned without my knowledge. Within hours, a $1.44 transaction appeared on my account from a fabricated merchant — “Whitestown Marathon Whites.” The amount was small. The implications were not.

This was not an isolated incident. It was a test transaction — a common tactic used by criminals to verify that a stolen card is active before draining the account. The bank could not stop the transaction. The bank could not freeze the funds. The bank could not tell me where the money was going.

The bank could only tell me to wait.

This paper examines the systemic failures that make such fraud possible, the political decisions that preserved these failures, and the accountability that has been denied to millions of Australians.

II. The Scale of the Problem

The statistics are staggering:

Metric                                                                                                        Figure

Australians who experienced card fraud (2024–25)           2.3 million (10% of adults)

Total card fraud losses (2025)                                                       $2.2 billion

Counterfeit/skimming fraud (FY25)                                            $7.1 million

Scam complaints to AFCA (2025)                                                111,373 — a record high

Card fraud reimbursement rate                                                    As low as 2–5% of customers   receive compensation

Contactless schemes now account for 62 per cent of card fraud incidents in Australia. The fraudsters are not sophisticated hackers — they are opportunists exploiting a system that has been left vulnerable by design.

III. How the Fraud Works

A. The Technology

RFID-enabled contactless cards broadcast data to any reader within range. A criminal with a concealed scanner — small enough to fit in a pocket — can read a card through clothing, through a wallet, without any physical contact.

B. The Test Transaction

A small charge — often under $5 — is made to verify the card is active. This transaction appears as a fabricated merchant name. The bank does not block it. The bank does not freeze the funds. The bank does not investigate until the transaction clears — by which time the money is gone.

C. The Profitable Delay

The money sits in a “pending” state within the payment network’s settlement system. The bank profits from the “float” — using the funds for short-term lending and investment. The bank earns merchant fees on the transaction. The bank experiences no loss.

The customer carries the cost. Of money. Of time. Of stress.

IV. The Hayne Royal Commission: Recommendations Abandoned

A. The Commission

In February 2019, Commissioner Kenneth Hayne delivered the final report of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry. The report made 76 recommendations.

Treasurer Josh Frydenberg declared the government would “take action on all 76 recommendations”.

B. The Reality

By January 2021, analysis showed 45 of the 76 recommendations had yet to be implemented and four had been abandoned.

What was abandoned:

· Recommendation 1: That laws requiring banks to lend responsibly “should not be amended.” Frydenberg announced in September 2020 that these laws would be repealed entirely.

· Recommendation on mortgage brokers: Frydenberg rejected Hayne’s recommendation that mortgage brokers be banned from receiving commissions over the life of a home loan.

· Recommendation on point-of-sale loans: A ban on retailers selling loans to customers at the point of sale — supposed to be in place by the end of 2020 — was abandoned.

The Guardian’s analysis concluded: “Frydenberg has abandoned his commitment to implement all 76 recommendations made by Hayne”.

Consumer Action Law Centre CEO Gerard Brody: “The government is just walking away from some of the core recommendations”.

C. The COVID Excuse

The government claimed the pandemic necessitated delays. But consumer groups noted that Frydenberg “has taken advantage of the delay to undermine the pro-regulation consensus established by the royal commission”.

One year after the report was delivered, the government had completed only 6 out of 76 recommendations.

V. The Banking System: Designed to Fail Customers

A. HSBC: A Case Study in Systemic Failure

In June 2026, HSBC Australia was ordered to pay $35 million after admitting to widespread scam protection failures.

The findings:

· Unauthourised transactions jumped 380 per cent in 2023 and 2024.

· Investigations of scam reports took an average of 144 days.

· In some cases, victims’ accounts were frozen for up to 542 days.

· The bank admitted it “did not have adequate systems in place” to protect customers.

ASIC Chair Sarah Court: “HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money”.

Consumer Action Law Centre CEO Stephanie Tonkin: “HSBC has fought tooth and nail, fought against its customers, fought against the regulator. These scam victims were gaslit by their own bank”.

B. The Broader Pattern

HSBC is not an outlier. The Australian Financial Complaints Authority (AFCA) received 111,373 complaints in 2025 — a 14 per cent increase from 2024. Banking and finance complaints continue to be the largest complaint type, accounting for 54 per cent of all complaints.

The rate of reimbursement or compensation for scam victims is generally quite low, ranging from two to five per cent. The banks are not protecting customers — they are managing complaints.

VI. The Scams Prevention Framework: Too Little, Too Late

In February 2025, the Scams Prevention Framework Act was passed. It requires banks to:

· Prevent scams

· Detect scams

· Disrupt scams

· Respond to scams

· Report scams

· Govern against scams

Civil penalties of up to $50 million can be imposed for failures.

But the framework has critical weaknesses:

· It does not require banks to automatically compensate scam victims.

· It does not address the fundamental vulnerability of RFID technology.

· Full implementation will not occur until the end of 2027.

A system that takes three years to fully implement is a system that has accepted continued losses.

VII. Where the Money Goes

The “float”: Your money sits in the bank’s system while the transaction is processed. The bank can use that money for short-term lending and investment.

The fees: The bank earns merchant fees on the transaction, even if it is fraudulent.

The lack of loss: The bank is not at risk. The customer is. The bank is reimbursed through a process that costs them nothing.

The criminal: The funds are transferred to the merchant’s account and immediately moved through multiple nodes, making recovery nearly impossible.

The customer: Left waiting. Left stressed. Left to fight their own bank for reimbursement.

VIII. A System That Has Failed

The evidence is clear:

1. A Royal Commission identified systemic failures and made 76 recommendations.

2. A Treasurer promised to implement them all.

3. That Treasurer abandoned key recommendations.

4. A bank admitted to widespread failures and agreed to pay $35 million.

5. A regulator found the bank took an average of 144 days to investigate scams.

6. Complaints reached record highs — 111,373 in 2025.

7. A new framework has been introduced — but full implementation is three years away.

The system is not broken. It is working exactly as designed — to protect the banks, not the customers.

IX. A Call to Action

What Must Change

1. Phase out RFID cards — return to chip-and-PIN only. Contactless payments are convenient but fundamentally insecure.

2. Freeze suspicious funds immediately — the “pending” state should not be a window for criminals.

3. Verify merchant identities — fabricated merchant names should be impossible.

4. Implement the Scams Prevention Framework fully and now — not by 2027.

5. Hold banks accountable — the Hayne recommendations were abandoned. They must be revived.

The Cost of Inaction

· $2.2 billion lost to card fraud annually

· 2.3 million Australians affected each year

· 111,373 complaints to AFCA in 2025

The cost of change is far less than the cost of continued failure.

X. Conclusion: The Wrong Bear

A scammer took $1.44 from my account. It was not about the money. It was about the system — a system that has been investigated, exposed, and left unchanged.

The banks profit from inaction. The criminals exploit the gaps. And the customer carries the cost.

They have poked the wrong bear.

The Hayne Royal Commission made recommendations. They were ignored. The Scams Prevention Framework is a step forward — but it does not address the fundamental vulnerability of RFID technology.

Until banks are forced to take responsibility — by replacing RFID cards, verifying merchants, and freezing suspicious funds — the scams will continue.

And those responsible will be held accountable.

Andrew Klein

References

1. Australian Bureau of Statistics. (2026). Personal fraud, 2024-25 financial year. 

2. AusPayNet. (2025). Fraud Statistics Jul 24 – Jun 25. 

3. Australian Financial Complaints Authority. (2026). AFCA receives record number of complaints in 2025. 

4. The Guardian. (2021). Banking royal commission: most recommendations have been abandoned or delayed. 

5. The Guardian. (2020). Frydenberg’s move to dump lending laws ‘shortsighted’. 

6. ABC News. (2026). HSBC agrees to pay $35 million penalty after widespread scam failures. 

7. ASIC. (2026). $35 million penalty against HSBC for scam protection failures. 

8. Herbert Smith Freehills. (2026). Stage 1 of the Scams Prevention Framework. 

9. Shufti Pro. (2026). Best Fraud Prevention Practices in Australia’s Banking Sector. 

10. Choice. (2025). Banks imposing non-disclosure agreements on scam victims.