The Conventional Wisdom
Many compliance professionals believe that if a bank implements the required anti-fraud controls, it's fulfilled its duty. In this view, scam victims who authorize transactions are primarily responsible for their losses. The bank's role is to deploy the control framework, document it, and verify its operation. If a scam succeeds despite these controls, the customer is seen as having ignored the warnings.
This mindset shapes regulatory design in many places: deploy the controls, check the boxes, and move on.
The Flaw in This Thinking
Australia's scam prevention framework highlights a structural flaw that should concern every GRC leader: institutions self-assess their compliance with anti-fraud controls and use that assessment to deny reimbursement to scam victims.
Ken Palla, a fraud expert and retired director at MUFG Union Bank, describes it as "the fox guarding the hen house." Under Australia's framework, reimbursement depends on whether an institution failed to meet its obligations, but each institution determines its own compliance instead of an independent party.
The issue isn't just the conflict of interest. Many of the roughly 30 required controls are difficult to measure for compliance. Confirmation of payee is straightforward to verify. However, behavioral biometrics, which should detect unusual behavior, are harder to assess, especially when a scammer manipulates a customer into authorizing a transaction. A bank could have strong analytics and still miss scams like romance or investment fraud.
When the institution both operates the controls and judges their effectiveness, it's not a compliance program. It's a liability shield.
The Evidence
Consider how this plays out. A customer loses money to a sophisticated scam. The bank claims: "We had behavioral biometrics, transaction monitoring, and sent warnings. Our controls were compliant." The customer must now prove the controls failed, requiring technical expertise most victims don't have and evidence the bank controls.
The burden of proof is on the wrong party. The victim must show that the bank's controls were inadequate. You're asking someone who just lost their savings to audit enterprise fraud detection systems.
Compare this to the UK's mandatory reimbursement model, which shifts the default position. Even there, more than one-third of scam losses remain unpaid. When reimbursement is mandatory and the burden still falls on victims, imagine the outcome when institutions self-certify their way out of liability.
The problem with control definitions adds to the conflict. For clear-cut controls like confirmation of payee, compliance is binary. But for behavioral controls or AI-driven anomaly detection, what does "compliant" mean?
If your fraud detection model flags 2% of transactions for review, is that compliant? What about 5%? What if it catches 80% of known fraud patterns but misses a new social engineering approach? Without independent assessment criteria, "compliant" means whatever the institution decides.
What to Do Instead
If you're designing or advising on scam prevention frameworks, separate the compliance assessment function from the liable party. This is basic control design.
Here are three specific approaches:
Independent Compliance Verification. Require annual third-party assessment of anti-fraud controls, similar to SOC 2 Type II audits. The assessor evaluates whether controls meet defined effectiveness thresholds, not just whether they exist. Published control objectives with measurable outcomes replace vague statements with specific detection metrics.
Shared Liability with Rebuttable Presumption. Start with mandatory reimbursement, then allow institutions to show the customer ignored specific warnings or circumvented controls. This flips the burden: the institution must prove the customer's actions broke the control chain. You'll need clear standards for adequate warnings and customer actions that defeat the control.
Tiered Control Maturity Requirements. Define minimum, enhanced, and advanced control levels with specific criteria. Institutions at minimum levels reimburse by default. Enhanced and advanced tiers earn reduced liability based on verified effectiveness metrics. This incentivizes exceeding minimums rather than self-certifying at the lowest level.
For GRC teams at financial institutions, document your control effectiveness evidence now, before you need it for dispute resolution. If you're running behavioral biometrics, maintain records of detection rates, false positives, and model performance against known attack patterns. When you send customer warnings, log not just that you sent them but whether the customer acknowledged them and what action followed.
If you can't produce evidence that your controls work as designed when an independent party asks, your self-assessment isn't worth the paper it's printed on.
When Self-Assessment Works
Self-assessment is useful for internal control maturity and continuous improvement. Your fraud team should evaluate control effectiveness, identify gaps, and adjust detection models. That's operational excellence.
Self-assessment also works when liability doesn't depend on the assessment outcome. If you're measuring controls to improve your security posture rather than to deny customer claims, the conflict of interest disappears.
And yes, customers bear some responsibility. If you ignore warnings, confirm you want to proceed despite fraud alerts, and provide access credentials to a stranger, controls can only do so much. The question is who proves what happened.
The conventional wisdom fails when the party judging compliance has a financial incentive to find itself compliant, and the harmed party lacks access to evidence. That's not a compliance framework. It's a claims denial system with compliance language painted on top.
If your framework lets the fox count the chickens, don't be surprised when the inventory always comes up short.
