Summary

  • Australia already has scam-call and SMS traceback rules, but ACMA says some providers have limited visibility beyond their immediate network neighbours and may not know whether they originated, transited or terminated a specific scam communication.
  • A new sector code can allocate duties; accountability will depend on whether each provider can preserve and exchange incident-level path evidence without treating presence on a route as proof of fault.

The missing entry in the incident record

The consumer sees a call or message. The regulator sees a chain. Between them sits a question that can decide whether the next investigation moves quickly or stalls: which telecommunications provider carried which part of the communication, and what could it see at that point?

ACMA’s 13 October speech describes a market in which a service that looks simple to a customer may involve several businesses. The retail provider remains responsible for its direct customer engagement, the regulator says, but the underlying voice, text or data service may involve other providers. In service complaints, ACMA still hears of customers being sent back and forth. In its investigations, it encounters arguments that another company in the supply chain was responsible, sometimes one it says cannot effectively be held to account for the outcome. The speech does not absolve the retailer; it separates the customer relationship from the full delivery path. ACMA’s speech

Scam communications make the distinction more urgent. ACMA says providers have restricted understanding of how traffic moves across networks, limited knowledge of chains beyond adjacent telcos, and in some cases cannot accurately identify whether they were the originating, transit or terminating provider in relation to a particular scam. ACMA says that uncertainty delays disruption, makes vulnerabilities harder to find and impedes action against a provider that has failed consumers or other providers.

This is an evidence problem before it is an argument about liability. A provider cannot give a useful account of its role if the relevant event record does not connect the communication it received, the next handoff, the time window, the service function it performed and the action it took. But a record that shows a provider on the path is not by itself proof that the provider caused the scam or breached a rule. The distinction matters: attribution should make responsibility investigable, not predetermine the result.

Australia has tracing rules already

The gap is not that Australia has no scam rules. The ACMA-registered C661:2022 Reducing Scam Calls and Scam SMs code establishes processes to identify, trace, block and otherwise disrupt scam calls and messages. ACMA says it can act when a provider breaches the code. The code also provides a framework for providers to exchange information and trace a communication towards its origin. Existing enforcement against providers shows that the code is an operational instrument, not merely a statement of intent. C661:2022

The SMS Sender ID Register adds another role-sensitive control. In its consultation material, ACMA defines an originating provider as one that agrees to send sender-ID messages for a customer or messaging provider, a terminating provider as the carrier responsible for delivering them to recipients on its network, and a transit provider as one that carries them between other telcos. The described traceback process moves from the terminating provider to the previous provider and then upstream until the origin is identified. Those definitions concern sender-ID messages; they should not be assumed to describe every call, text or data path in the same way. ACMA’s Sender ID Register consultation paper

This existing machinery sharpens the question. A trace procedure can exist while an individual provider still lacks a reliable map of the path it participated in. Contact lists, traceback deadlines and blocking instructions cannot compensate for an event record that fails to identify the relevant handoff, role or time. Nor does a chain of provider contacts automatically establish who had the ability to prevent a particular communication.

The distinction between an organizational map and an incident map is central. A provider may know its commercial peers but not every downstream destination. It may carry a message without being the originator, or deliver a message without having selected its sender. Those differences affect what evidence each provider can reasonably preserve and what action it can take. A future rule that assigns the same duty to every participant without respecting those differences risks producing either overbroad liability or easy deflection.

The new framework is designated, but the code is still ahead

The Scams Prevention Framework designation places covered Australian voice-call and message services in a regulated telecommunications sector and names ACMA as sector regulator. The designation describes services supplied through a carrier and a public carriage service provider; those capacities may sit with the same business or with different businesses. It therefore recognizes a delivery structure that can cross corporate boundaries.

Designation is not the same as every substantive obligation having begun. Section 102 of the instrument establishes a transition for covered telecommunications services. From 1 September 2026 through the end of March 2027, most of Part IVF’s substantive framework remains within the transition exception, while provisions relating to sector-code making, certain dispute-resolution matters and external dispute-resolution arrangements are treated separately. The separate SPF Rules 2026 commenced on 1 September and include a narrow private-line exception; they do not remove the general need for a telco sector code.

ACMA’s annual work program lists the telecommunications sector code as work for the second half of 2025–26, subject to delegations and designations. In October, the regulator said its experience with the existing scam code and the Sender ID Register was informing the new code and a proposed Know Your Customer / Know Your Traffic approach. That is a stated direction of work, not a final code or a published requirement to maintain a particular incident-level route ledger. ACMA’s work program

The distinction matters because the new code is being designed while the sector is already working through older rules and live cases. The separate draft Telecommunications Consumer Protections Industry Standard, open for consultation until 10 November 2026, addresses consumer safeguards and remedies; it is not the SPF scam code. ACMA says it is considering supply-chain responsibilities as it calibrates that draft, but neither proposal should be described as a completed answer. TCP Standard consultation

What an accountable route would have to show

ACMA’s statement points toward a practical test for the coming code: can an investigator reconstruct an incident across providers quickly enough to identify the role each played and the evidence available to it? The answer need not be a universal public network map. Such a map could expose sensitive routing information and would be difficult to keep current. The immediate requirement is narrower: an authenticated, time-bounded record for a relevant event, linked to each handoff and retrievable through a defined process.

That record would need to distinguish at least four things. First, the role a provider performed on that event, rather than a broad business label. Second, the adjacent handoff: what was received, when it arrived and where it went next. Third, what signals the provider could reasonably see, including whether the information was enough to identify a suspicious communication. Fourth, what action followed: trace response, blocking, escalation, preservation or a reasoned decision not to act.

Those are tests for code design, not requirements ACMA has already imposed in these terms. They also do not imply that every operator must retain every packet or expose its topology to every other company. A proportionate design could keep full path data within the responsible provider and give a regulator or authorized traceback participant a narrowly scoped event record, with access logging and safeguards for customer and network information.

The evidence chain must work in both directions. A terminating provider should be able to ask upstream for a trace and receive a useful response. An originating provider should be able to identify the account or messaging intermediary from which a communication entered its network, subject to the applicable code and privacy rules. Transit providers need a way to state what they carried and what they could observe without claiming knowledge they did not have. Each step should have a clock, an event reference and an auditable response.

That model would also make enforcement more discriminating. If records show a provider was merely a transit point with no view of the sender identity, its responsibility differs from a provider that contracted with the originator or ignored a trace request. Conversely, the absence of a direct customer relationship cannot itself be a shield where the provider had a relevant role and a clear obligation. The purpose of attribution is to make those distinctions testable against evidence.

ACMA’s cumulative figures—more than 3.3 billion scam calls and 1.1 billion scam texts stopped over the periods it cites—show substantial disruption activity. They do not reveal how many unique scam attempts existed, how much activity was prevented by each provider, or whether the route can be reconstructed for a case that got through. A volume of blocked traffic cannot substitute for a measure of traceback quality or response time. The regulator’s own account of visibility limits is a reason to ask for those measures, not to infer that existing controls have failed across the board.

Sources: ACMA, 13 October 2026 speech; ACMA, C661 overview; C661:2022 code; ACMA, SMS Sender ID Register consultation paper; SPF Regulated Sectors Designation 2026; SPF Rules 2026; ACMA 2025–26 work program; TCP Standard consultation.