Bigger fines are only part of Australia’s new consumer-protection push

Telstra had procedures for checking customers’ identities. Its frontline staff failed to follow them in 15 unauthorised SIM swaps between January and October 2025, according to Australia’s communications regulator. Customers reported combined fraud losses of at least AUD 39,500.

The company paid an AUD 277,200 penalty.

The enforcement action, announced on September 3, also secured court-enforceable commitments to improve fraud prevention and train customer-facing staff. Investigators had found 13 instances in which extra protections were not provided to customers who had raised concerns, or whom Telstra had information identifying as being at risk of fraud. This followed monitoring after an earlier enforcement action involving the same rules.

That history gives Australia’s latest consumer-protection reforms a practical test. After a provider has paid a penalty and promised improvements, what will prevent the next customer from encountering the same failure?

Under reforms outlined on October 15, registered telecom industry codes will become directly enforceable. The Australian Communications and Media Authority, or ACMA, will no longer need to first order a provider to comply before taking action over a breach.

Maximum penalties for breaches of industry codes and standards will rise from AUD 250,000 to AUD 10 million, according to consumer advocacy group ACCAN.

There is a further measure that could affect a company’s ability to keep trading. The package provides for a registration scheme through which ACMA could exclude providers with serious compliance failures from the market. The regulator describes this as a last resort, with implementation details to be published before the scheme starts. Those details will determine how a provider’s record is assessed and when losing permission to operate becomes a realistic possibility.

Israel faces similar questions about how effectively regulators can protect consumers, particularly in the telecommunications market. As in Australia, the challenge is not only setting rules and imposing penalties, but also ensuring that providers follow them in practice and that customers can resolve problems without unnecessary hurdles. The comparison highlights a broader regulatory question: How to turn formal consumer rights into meaningful protections in everyday transactions.

The Telstra action came under existing mobile-fraud rules, separate from these changes to code enforcement.

ACMA’s work in another industry shows how little time can separate a protective measure from a breach. In announcing Picklebet’s AUD 19,800 penalty on October 22, the regulator described bets accepted from a customer who had joined BetStop, Australia’s national self-exclusion register, hours earlier. The incident happened on February 9. Picklebet closed the account later that day, but the restriction on providing betting services applied from registration.

Stronger BetStop laws, including substantially higher penalties, take effect on January 1, 2027.

Both cases leave work for management after the enforcement announcement. Telstra’s commitments concern how staff handle customers and recognise fraud risks. The Picklebet breach concerned whether an active restriction was applied to an account in time. Neither task is completed by paying a penalty.

Consumer groups have been pressing for changes before customers reach the point of making a complaint. In March, ACCAN and the Fair Call Coalition welcomed ACMA’s rejection of a proposed industry consumer code. They argued that the industry-led approach had failed to address harmful sales practices and inadequate credit assessments.

ACMA opened consultation on a replacement consumer-protection standard on September 29.

The draft includes requirements for responsible selling and arrangements governing sales incentives and performance payments. That brings managers’ decisions into the discussion alongside individual salespeople’s conduct. An investigation can establish what went wrong with a particular sale; scrutiny of incentive arrangements can examine whether the business rewards behaviour that its consumer-protection policies are supposed to prevent. The eventual requirements will need to be assessed against what companies actually change in their sales operations.

Cancellation procedures would also come under the new standard. The draft calls for simple, timely cancellations and informed consent before services are transferred. For customers struggling to pay, disconnection would be a last resort after reasonable steps to help them manage payment difficulties or obtain financial-hardship assistance.

These are still proposals. Customers cannot yet treat every measure in the draft as an obligation their provider must already meet.

ACMA’s October 7 figures recorded 748,501 complaints to telecom providers in 2025–26, down 10.8% from the previous year. Average resolution time improved from 5.9 days to 5.4 days.

The share escalated to the Telecommunications Industry Ombudsman nevertheless rose from 6.6% to 6.9%.

That percentage needs care. It does not establish that the total number of escalations increased, because there were fewer complaints overall. It does show that a slightly larger proportion needed outside help. And because the figures cover the period before the October reforms, they provide a starting point for assessing the changes, not evidence that the new powers have succeeded.

Future reporting will need to look beyond how much money regulators collect. Whether customers can cancel a service without a dispute, obtain help before disconnection or have a fraud warning acted on will say more about their experience.

Public submissions on the proposed telecom consumer-protection standard close on November 10, 2026.

This article was written in cooperation with Alex Kostadinov