Action on scams, spam and telemarketing: April to June 2026

Our key actions
	$3.96 million in penalties paid by Latitude Finance Australia for spam law breaches. $59,400 in penalties paid by SpinTel for mobile number fraud law breaches.
	176.9+ million scam calls and 55.1+ million scam SMS blocked by telcos from April to June 2026 – with 4.2+ billion scams blocked in total since rules came into force.
	39,562 sender IDs registered on the SMS Sender ID Register before the 1 July 2026 launch.

* You can obtain accessibility information below each graphic displayed in this report.  

We had 2 key compliance priorities for the 2025–26 financial year for unsolicited communications and scams:

1. Disrupting mobile number fraud – We monitored telco compliance with rules directed at fraud prevention and took strong enforcement action when we found non-compliance. Mobile number fraud can result in financial losses and emotional distress for those impacted.
2. Combating spam and telco scams – This is an enduring priority, and in 2025–26, we focused on persistent unwanted spam or telemarketing. We escalated our approach to businesses that failed to respond to our compliance alerts and early warnings. Unwanted spam or telemarketing can have a range of adverse impacts on consumers. This ranges from frustration through to financial loss and serious impacts on mental health and wellbeing.

Disrupting mobile number fraud

Key actions and outcomes in the quarter included:

• We announced that SpinTel Pty Ltd paid a $59,400 penalty after we found it breached identity verification requirements (under the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020) 10 times between 18 February and 17 March 2025. This allowed scammers to exploit weaknesses in its system to gain access to one-time codes used in multifactor authentication to take over consumers’ mobile services. This resulted in financial losses for some consumers. We also accepted an enforceable undertaking from the telco.
• We also announced Yomojo Pty Ltd received a formal warning after we found that, between 15 October and 19 November 2025, it failed to publish advice on its website informing customers who suspect they have been a victim of mobile number porting fraud to immediately report it to police.
• We gave compliance alerts to multiple telcos about potential mobile number fraud so they could take early action to protect consumers.

Combating spam and telco scams

Key actions and outcomes in the quarter included:

• Telcos reported blocking more than 4.2 billion scams since anti-scam rules registered by the ACMA came into force. This includes over 3.1 billion scam calls since December 2020 to the end of this quarter, and more than 1.1 billion scam SMS since July 2022 to the end of this quarter. The ACMA and telcos use blocking statistics to identify trends and inform disruption activities. 
• We provided anonymised scam call data to telcos to inform their blocking activities.
• We collaborated with the National Anti-Scam Centre to share information on scam trends and align educational material for consumers.
• We announced that Latitude Finance Australia paid a $3.96 million penalty after we found it had breached the Spam Act more than 2.7 million times. This included sending more than 2.3 million marketing messages without accurate contact information. A total of 344,416 of these messages also lacked a working unsubscribe function. We also accepted enforceable undertakings from the company. 
• We gave 858 compliance alerts to businesses to promote early remediation of possible scam, spam and telemarketing law issues.

In April to June 2026, we significantly increased outreach activities and onboarding support for stakeholders across the economy, government, and in the telco sector, to prepare for go-live of the SMS Sender ID Register on 1 July 2026.

The register is being implemented as part of the Australian Government’s Fighting Scams initiative to:

• address scams and online fraud
• protect Australians from financial harm. 

It helps prevent impersonation scams and gives people more confidence that branded SMS and MMS messages are legitimate. From 1 July 2026, unregistered sender IDs are labelled as ‘Unverified’ under a single message thread on people’s phones.

At 30 June 2026:

• 27,361 entities had registered 39,562 sender IDs
• 400 telcos had been approved to participate in the register. 

Registration and related support is ongoing for businesses, organisations and telcos who wish to apply to register their branded SMS and MMS sender IDs.

Find out more about the SMS Sender ID Register. 

Check the list of participating telcos.

We have seen recent examples of businesses automatically adding email addresses to marketing lists on the basis of:

• one-off purchases
• enquiries
• general contact. 

These examples suggest that there is a misunderstanding about what constitutes obtaining consent under the Spam Act 2003.

A business may generally ‘infer’ they have permission to send marketing messages on the basis of an existing relationship. This applies in cases where there is a provable, ongoing relationship and where the marketing is directly related to that relationship. For example, where someone has an account with a bank and the marketing is directly relevant to that account (and the person hasn’t opted out of receiving marketing in a preference centre).

Consent cannot generally be inferred on the basis of an existing relationship where someone has made a one-off purchase or enquiry. 

Consent also cannot be inferred to send commercial messages to someone about a product or service that is unrelated to an existing relationship with them. For instance, a telco sending a customer information about an energy services product.

It is always clearer and more consumer-friendly to obtain a person’s ‘express’ consent to receive marketing messages. People can give express consent by:

• filling in a form
• ticking a box on a website
• over the phone
• face-to-face.

Express consent should include clear information about:

• what the consent is for
• how long it lasts
• how it can be withdrawn. 

Consumer-friendly practice is to make the information clearly available at the point consent is obtained. This is preferable to including it as part of general terms and conditions or privacy policies buried in links or requiring click throughs.

Regardless of which type of consent is used, it is up to businesses to keep clear records to prove they have consent. This includes details about when and how it was obtained.

Businesses using a list purchased from a third-party supplier are responsible for retaining evidence of consent. Remember, under the Spam Act, it is up to businesses to prove that they have a person's permission to send them marketing messages.

We have published information about consumer consent.

You can also learn more about the consent and unsubscribe laws.

Within the quarter:

• We received more than 5,400 complaints from consumers about alleged breaches of telemarketing and spam laws.
• Solar, insurance and real estate were the most complained about industries.
• Scams made up 9.7% of the complaints we received about telemarketing and 6.8% of the complaints we received about spam.

Across the full 2025–26 year, complaints about telemarketing, spam and scams reduced from the previous year (2024–25) and continued the downward trend in these areas from the 2023–24 year.

Please note: These are a subset of all complaints received by financial year.

Where we receive enough information to identify the alleged caller or sender, we alert businesses and telcos about potential compliance issues raised in complaints. One alert can relate to several issues or complaints.

Please note: Compliance alerts for potential mobile number fraud are a new initiative in 2025–26.

We investigate where we see serious and/or systemic indications of non-compliance. Within the quarter, we:

• Had 7 investigations at enforcement stage, including 5 new matters progressed from the previous quarter. 
• Announced 3 outcomes from previously closed investigations.
• Finalised 3 investigations (one each for the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020, the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022, and the Spam Act) with breach findings for all three investigations.

Monitored compliance with 20 court-enforceable undertakings.

For the 12 months to the end of the quarter, we took an average of 3.5 months to complete an investigation. All investigations were completed within 6 months.

View our enforcement actions for breaches of spam and telemarketing laws.

View our enforcement actions for breaches of scam laws. 

Find out more about scam, spam and telemarketing rules, including how to make a complaint. 

Subscribe to our newsletters to get updates about our actions on scams, spam and telemarketing.