Australia: COVID Scams: The Catalyst For Law Reform?

Have you been receiving more scam calls and messages recently? Have you stopped answering calls from unknown numbers? We certainly have.

According to the ACCC, Australians lost over $211 million to scams in 2021, representing an 89% increase on the amount lost in the year before. Further, phone- and social media-based scams are becoming a larger proportion of the overall scams seen in Australia, having 'exploded' since the COVID-19 pandemic began.¹

Many scammers took advantage of the global shift to online shopping, e.g. by sending fake links to "track your package" or to release it for delivery (which, if clicked, cause malware to be installed on your device), by posing as an online retailer requiring your credit card details to "process a refund" (read: steal your identity and financial information), or by setting up fake websites and investment platforms cloning the names and addresses of legitimate businesses and mirroring real time trading events to trick people into "investing" in non-existent cryptocurrency, as this young couple unfortunately found out to the tune of $110,000.

Several scams were specifically designed to take advantage of the uncertainty and isolation caused by the pandemic. Some scammers would, for example: present opportunities to invest in a fake vaccine company or to purchase phony medication; pose as medical professionals, claiming that your relative has the virus and that you must pay for their treatment; offer fake check-in apps to track your activity; or set up fake social media profiles to carry out 'romance scams', building your trust in order to request money or personal information from you.

Even the scam-savvy - those who have avoided financial loss or identity theft - have grown so fatigued by the inundation of scam calls and texts over the last few years that an appetite for change has become ubiquitous. In early November 2021, the Australian Labor Party published its plan to tackle the issue, pledging to establish a National Anti-Scam Centre, which would bring together key industry and enforcement entities with the aim of better protecting Australian consumers. But is an Anti-Scam Centre what we're missing? What protections are already in place and why aren't they working?

What are your rights?

Currently, there are several frameworks under which a victim of a scam may be eligible to take action. However, it is worth noting at the outset that:

• if you cannot identify the person/entity responsible for the scam, it is extremely difficult to obtain any resolution; and
• if no financial loss was suffered, your options are limited and you may at best be able to restrain that person/entity from engaging in the same behaviour, but unable to prevent all future unwanted contact.

With this in mind, we set out below the options available to you if you find yourself on the receiving end of a scam.

No loss and no culprit? Currently, if you have not suffered any financial loss and you cannot identify the person or entity who contacted you, you have very limited rights to relief.

There are certain scam-related crimes which do not involve financial loss, for example:²

• possessing or dealing with identification information with the intention of committing, or facilitating the commission of, an indictable offence;³ and
• dishonestly making false or misleading statements with the intention of obtaining property belonging to another or obtaining or causing a financial disadvantage.⁴

If the activity appears to constitute such a crime, you may report it to ReportCyber,⁵ who will pass it to law enforcement agencies for assessment and possible investigation. Note, however, that not all reports will be investigated or pursued by police. In particular, if the culprit still cannot be identified (e.g. because they have used technology to mask their identity), or if the culprit cannot practically be brought to justice (e.g. because they are located overseas), law enforcement agencies may not be able pursue the report.

Otherwise, you can attempt to better protect yourself from future unwanted contact (e.g. by blocking an email or phone number or reporting the unwanted contact to Scamwatch⁶), but this will not prevent future unwanted contact nor provide you with any compensation for the nuisance or invasion of privacy suffered.

Loss and no culprit? If you have suffered monetary loss but cannot identify the person or entity who contacted you, there is no guarantee that you will be able to recover your losses. If the activity appears to constitute criminal fraud, such as fraud by:

• dishonestly obtaining property belonging to another;⁷ or
• dishonestly obtaining or causing a financial advantage;⁸

you may report it to ReportCyber as described above. ReportCyber may then be able to use law enforcement resources to help identify the offender and bring them to justice. If successful, the offender could be sentenced to up to 10 years' imprisonment, and/or to compensate you for your economic loss. However, with limited initial information about the culprit, there is no guarantee that they will be found.

In such circumstances, your ability to recover your losses will largely depend on whether your financial service provider, or the platform on which your funds were transferred or lost (e.g. Facebook, PayPal, Gumtree), is willing and able to compensate you.

Alternatively, you could try to unmask the wrongdoer yourself by applying to a court for preliminary discovery orders.⁹ Preliminary discovery orders are generally¹⁰ available where:

• after having made reasonable inquiries, an applicant still cannot locate or identify the wrongdoer for the purpose of commencing civil¹¹ proceedings against them; and
• another person (for example, an internet or phone service provider) may have information, or document/s, which could assist in ascertaining the location or identity of the wrongdoer.

If eligible for an order, you may be able to obtain the information or documents necessary to identify the wrongdoer, which would then enable you to take civil action (as described in more detail below). However, this option is not always realistic or as useful as it seems, including because:

• it requires the applicant to give up their time and money to pursue the court action/s; and
• the identity information obtained cannot be used to bring criminal action against the wrongdoer (unless the court grants leave to do so).¹]

Found the culprit? If you can identify the wrongdoer, you have several options:

• Criminal law: The activity may constitute one of several crimes of deceit, including (but not limited to):
  1. dishonestly obtaining property belonging to another;¹³
  2. dishonestly obtaining or causing a financial advantage;¹⁴

• possessing or dealing with identification information with the intention of committing an indictable offence;¹⁵ or

1. dishonestly making false or misleading statements with the intention of obtaining property belonging to another or obtaining or causing a financial disadvantage.¹⁶

If the activity does appear criminal, you may report it to ReportCyber/to police with a greater chance of the culprit being reprimanded (again, with up to 10 years' imprisonment and/or orders for compensation made where a loss is proven). However, even if law enforcement agencies decide to pursue the case, they will then be required to prove all elements of the cause of action to the criminal standard - beyond reasonable doubt - which can be problematic.

• Consumer law: A scam may also constitute a breach of the Australian Consumer Law (ACL) if it involves misleading or deceptive conduct in the course of trade or commerce. This includes providing misleading or deceptive information regarding:
• the quality or nature of goods or services offered;
• the extent to which a prospective consumer requires those goods or services and
• any other conduct which is likely to mislead or deceive.

Note that foreign entities trading in or selling to Australia are not exempt from liability under the ACL.

Although it is not necessary to prove that deception actually occurred or that loss was suffered in order to prove the breach, without evidence of loss you will not be able to claim damages. Rather, the court may order such other remedies as it sees fit, such as an injunction preventing the wrongdoer from engaging in such activity.

Other limitations to this action include that you must know the identity of the wrongdoer in order to commence action against them, and the activity must have occurred 'in trade or commerce', which can be tricky to establish.

• Other civil actions: Actions may also be available under the Privacy Act 1988 (Cth), for example if personal information has been accessed or disclosed without authorisation, and/or under the Corporations Act 2001 (Cth) and/or the Australian Securities and Investments Commission Act 2001 (Cth), in circumstances where, for instance, scams involve financial products and services, phone investment scams or illegal investment schemes. Further, there are certain common law actions which may be available, e.g. the tort of deceit, or civil fraud. Note, however, that several of these civil actions require a loss to be established before action can be taken or remedies can be obtained.

There are several bodies already tasked with protecting consumers from scams and related breaches, including the ACCC, the Australian Cyber Security Centre, the eSafety Commissioner, the Commonwealth Fraud Prevention Centre and the police.

However, despite the abundance of relevant laws and law enforcement bodies, scammers are notoriously difficult to bring to justice as wrongdoers are often either hidden behind several layers of anonymity or are otherwise uncontactable. As a result, a large proportion of scammers are not pursued - rather, victims are either unable to recoup their lost funds, or are left to request assistance from their financial institutions or from the platforms which lost their funds. Further, it seems almost impossible to prevent scammers from making such unwanted contact in the first place.

What has the Australian Labor Party proposed?

To help coordinate the efforts of the several industry and enforcement entities responsible for preventing and remedying scams, the Australian Labor Party has proposed the establishment of a National Anti-Scam Centre, which would bring together law enforcement, banks, telecommunications providers and consumer advocates, allowing real-time information sharing to better protect Australian consumers and small businesses.

Accompanying the Anti-Scam Centre is proposed (among other things) additional funding for identification recovery services, a new industry code for industry and government to clearly define their responsibilities in protecting consumers and businesses online, and measures to ensure that companies do not profit from fraudulent advertisements on their platforms. Labor is also calling for telecommunication companies, banks and retailers to change the way they communicate with their customers, to avoid consumers falling prey to such scams in the first place.

Labor has referred to the UK's Fusion Cell initiative and Canada's Anti-Fraud Centre as examples of foreign governments successfully implementing similar systems. Note, however, that: (a) elements of the UK's initiative are currently being overhauled, including to respond to reported 'trust issues' in respect of the information being shared;¹⁷ and (b) several of Canada's initiatives came into effect only recently and appear to mirror Australia's ScamWatch and ReportCyber bodies.¹⁸

Where to next?

Although it is unclear whether Labor's proposed plan would bring about tangible change for Australian consumers, it is clear that action is needed. Australia's current frameworks offer almost nothing to prevent scammers from making endless unwanted contact, and offer very little to those who have suffered loss. In particular, where the scammer cannot be identified (which is usually the case), it is near impossible to recover losses or reprimand the culprit.

Rather, the onus is on individuals to better inform themselves and avoid falling prey to scams, seemingly with the expectation that we must live with nuisance calls, messages and social media contact. Until a more effective system is in place to prevent such contact occurring in the first place, some of the steps we can all take to better protect ourselves include:

• talking with others about scams and potential scams to "sanity check" them;
• keeping your details and devices secure, in particular, being careful about the information you share publically on social media such as location, interests, and personal details that might be used to trick you into thinking a scammer knows you;
• not clicking on hyperlinks in unsolicited text messages, direct messages and emails;
• being very sceptical of unsolicited calls offering financial or romantic opportunities. Use independent methods (i.e., something other than a website or social media account provided to you by the person) to verify whether someone is who they say they are;
• seeking advice if you are ever unsure about whether you are being scammed;
• reporting wrongdoing to ReportCyber and/or ScamWatch;
• regularly changing your passwords, and checking whether your email or phone has been the subject of a data breach here: https://haveibeenpwned.com/;
• using anti-spam and anti-scam technologies, such as spam filters which can be applied to text and email; and
• trusting your gut. If an offer seems too good to be true, it probably is.

Footnotes

1.https://www.accc.gov.au/media-release/losses-reported-to-scamwatch-exceed-211-million-phone-scams-exploding

2. For convenience, references are made in this article only to NSW criminal law, but it can be assumed that similar laws apply in all other Australian jurisdictions.

3.Crimes Act 1900 (NSW) ss 192J, 192K.

4.Crimes Act 1900 (NSW) s 192G.

5. ReportCyber is a national policing initiative run in conjunction with the Australian Cyber Security Centre (ACSC) (a government initiative).

6. Scamwatch is an initiative of the Australian Competition and Consumer Commission designed to help consumers and small businesses to recognise, avoid and report scams by sharing information and resources. Reporting a scam to Scamwatch will assist the body to monitor scam trends and warn the public about the latest kinds of scams, but will not result in any action being taken against an individual scammer or in relation to an individual report.

7.Crimes Act 1900 (NSW) s 192E(1)(a).

8.Crimes Act 1900 (NSW) s 192E(1)(b).

9. Note: Certain jurisdictions have different names for this type of order (e.g. 'pre-action discovery').

10. Note: These criteria can be found in Uniform Civil Procedure Rules 2005 (NSW) r 5.2(1). Different jurisdictions may have slightly different eligibility criteria.

11. Meaning any proceedings other than criminal proceedings. See 'Found the culprit?' section for a list of civil actions which may be available.

12. Due to the implied 'Harman undertaking', which attaches to all preliminary discovery orders and prohibits the use of information obtained via discovery for a purpose separate to the purpose for which the information was obtained. See also Deputy Commissioner of Taxation v Shi (2021) 392 ALR 1 at [50] regarding the requirement to obtain leave before using such information in criminal proceedings.

13.Crimes Act 1900 (NSW) s 192E(1)(a).

14.Crimes Act 1900 (NSW) s 192E(1)(b).

15.Crimes Act 1900 (NSW) ss 192J, 192K.

16.Crimes Act 1900 (NSW) s 192G.

17.https://www.ncsc.gov.uk/blog-post/get-ready-for-cisp-2

18.https://www.rcmp-grc.gc.ca/en/new-cybercrime-and-fraud-reporting-system

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.