Thousands of taxpayer-card transactions across federal departments were personal, not official, new Senate figures show. So far, every dollar we have traced has been paid back . That raises a narrower question than fraud, what prevention actually looks like .
Federal public servants paid back around $480,100 in personal spending charged to taxpayer-funded credit cards in the 2025-26 financial year, figures tabled to the Senate this week show.
Orders from Uber Eats and a single Defence transaction that brought the department’s total to nearly a quarter of a million dollars were part of the spending across at least eight departments and agencies.
None of the departments involved characterise the spending as theft or criminal misuse. "It's said by everyone that personal charges are banned on the cards and the money is repaid once identified.
It was never really a question of the money coming back. The harder question is what does a system designed to catch mistakes after the fact really prove?
The numbers, by department
Defence had the most total, 3,276 purchases the department itself says are “contrary to Defence policy,” worth about $240,000. At least $213,672 has already been paid back, a spokesperson confirmed.
Then DFAT with 2,029 inadvertent transactions totalling around $151,000 for the financial year. The department’s spokesperson said the largest transaction, more than $3,000, was repaid in full.
The Australian Federal Police recorded 987 incorrect personal transactions that cost more than $42,000. Between July 2025 and March 2026, Home Affairs staff were reimbursed for 477 purchases, totalling $28,400, including 149 Uber or Uber Eats orders worth about $5,500.
The Department of Prime Minister and Cabinet was repaid for 81 purchases, valued at about $2,400, again mostly Uber. Health $5,370.16 (accidental private purchases) (repaid) Employment and Workplace Relations $8,688.02 (repaid) Social Services $2,250.00
That is at least $480,100 across the eight departments and agencies cited in the figures, a minimum rather than a precise total, since the AFP's figure was only reported as "more than $42,000."
The same figures, two readings
Finance Minister Katy Gallagher has defended the existing processes. “The information supplied shows that the system is working, in that the inappropriate use is identified and paid back,” she said in a statement. “Agencies and secretaries are required to manage the matter at the departmental level.
One way of reading the figures is that misuse is being identified and the money is coming back in. Nothing in the tabled data says anything about a trend - the claim is harder to sustain as evidence the underlying rate of mistaken personal spending is actually falling. That’s just the total for one year.
Deputy Opposition Leader Jane Hume put the opposing frame. She said: “It is encouraging that these purchases are identified and the vast majority repaid, but the scale is concerning.” It's a critique that doesn't quite provide us a way out.
It’s also worth noting that the same repay-on-detection model has run under governments of both stripes without a structural redesign, so this is less a new failure than an old one nobody currently in office has moved to close.
What matters here is not the difference between "the system caught it" and "the system failed." Both readings agree with that. It's between a control that prevents the mistake and one that only ever cleans it up, and on the evidence tabled this week, Australia's public service credit card system remains very much the second kind.
Quick hits
Roblox has made a court-enforceable undertaking with the eSafety Commissioner after gaps in the platform’s child safety systems were found, including that adults could send connection requests to children without parental consent and that children’s accounts were not private by default.
The company has three months to comply, or face penalties of up to $100 million. Communications Minister Anika Wells said the founder of Roblox had promised her personally that the company would accelerate. eSafety estimates that 1.7 million Australian children use the platform.
Business leaders are divided on how much Australia’s migration intake should be cut. Federal budget forecasts show net overseas migration falling from around 300,000 to 245,000 this financial year, with the current permanent intake at 185,000 places. One Nation wants that cut to 130,000, the Coalition wants migration capped against housing construction but has not named a figure.
E-commerce entrepreneur Ruslan Kogan said the debate should be about which migrants Australia admits, not the raw number, while Leora Healthcare co-CEO Esha Oberoi – whose aged-care and disability business is more than 45 per cent visa holders – said she doesn’t know how the sector operates without continued migrant staffing.
What to read
Submissions on Labor's fix to the negative-gearing “widow tax” – the change that protects a spouse inheriting a jointly owned investment property from losing existing negative-gearing treatment – close Friday 21 August. This week's price of Coalition support for the NDIS savings bill was that fix.
Thursday 20 August was also the final sitting day of this parliamentary fortnight, concluding a string of connected deals between Labour and the Coalition on the NDIS, gambling advertising and the widow tax, three bills that were really one negotiation.
What that cooperation will cost each side politically is an open question as we head into the next sitting period.
Appreciate the newsletter but aren’t ready to pay for a subscription? Grab us a beer or snag the exclusive ad spot at the top of next week's newsletter.
The deepfake economy
You’re scrolling and an ad plays. Decent production. A face you recognise — maybe finance commentator Alan Kohler explaining a “government-backed” trading platform, maybe a mining billionaire telling you she’s put her own money into it. None of it is real. The voice, the face, sometimes a whole fake news article sitting underneath as proof, all generated.
ASIC chair Sarah Court’s advice is blunt: a quick search isn’t enough anymore to separate real from fake, because the fake sites are built specifically to survive that check.
This isn’t a scattering of one-off cons. Nineteen thousand-plus sites and ads taken down in a year points to something closer to a production line.
SmartCompany identified at least eleven Australian public figures currently being used as bait, spanning business (Dick Smith, Gina Rinehart, Alan Kohler), economics commentary (Tom Piotrowski, Stephen Koukoulas, Alan Oster), politics (Anthony Albanese, Angus Taylor, Jacqui Lambie, Pauline Hanson) and broadcasting (John Laws).
None of them authorised any of it. None of them see a cent from it. They’re simply recognisable enough to make a fake platform look credible for the few seconds it takes someone to decide whether to click.
A note on how solid these particular numbers are: the 19,000-plus takedown figure and the 182 percent increase come from three outlets — SBS, the regulatory wire MLex, and SmartCompany — all reporting the same numbers on 17 August, not from an ASIC document we could locate and read directly. Treat the scale as well-reported rather than independently verified against a primary release.
The trend line isn’t in question, though. This is the third public warning ASIC has issued this year about the same deepfake mechanism, following releases in April and July, with the numbers worsening each time.
Part of why this particular scam works so well on a younger audience is distribution. It doesn’t arrive as a cold call anymore.
It arrives as a targeted ad in the same feed as content from a creator you actually follow, placed there by an algorithm that has no way of distinguishing a genuine endorsement from a fabricated one. It just knows the ad gets clicks, and shows it to more people who look like the people who already clicked.
Who’s actually on the hook
This is where the accountability trail splits in two, and splits right now.
Banks already have exposure. In June, the Federal Court ordered HSBC’s Australian arm to pay a $35 million penalty, not for a scam happening on its platform but for how it handled customers afterwards: an average 144-day delay investigating scam reports, and gaps in fraud controls on its internal payment rail.
HSBC has already paid roughly $21.5 million in compensation, with more due, and recovered $6.5 million for customers. That penalty sits under an existing rulebook, the ePayments Code, and a court that used it.
Social media platforms, where these deepfake ads are actually served, sit under a newer and different rulebook: the Scams Prevention Framework. Banks, telcos and digital platforms — social media, messaging services, search engines — were all formally designated as regulated sectors under the framework in May 2026, overseen respectively by ASIC, ACMA and the ACCC.
But the framework has a long runway before its penalties apply. Regulated entities must join the external dispute resolution scheme, AFCA, from 1 September 2026. The framework’s full prevent-detect-disrupt-report-respond obligations, with AFCA handling scam complaints, take full effect from 31 March 2027.
Once fully live, the penalties aren’t small: up to $50 million, or 30 percent of turnover, for failing to prevent, detect, disrupt or respond to a scam running on a platform’s own service; up to $10 million for governance and reporting failures.
Some legal commentary describes a lighter “reasonable steps” obligation applying from as early as 1 July 2026, ahead of the formal AFCA and enforcement dates. Sources vary on the exact sequencing here, which is flagged in this issue’s claim ledger as the main area of date uncertainty.
Put the two tracks side by side. Losses tied to fake celebrity endorsements: $7.4 million and rising, this year. Enforceable consequences for the platforms actually hosting the ads: not yet, and not for at least another seven months. Banks answer to a court today. Platforms get a runway that extends into next autumn.
None of this makes the framework a bad idea — a $50 million penalty is real leverage, once it’s live. It does mean there’s a window, right now, where the fastest-growing version of this scam has almost nobody legally on the hook for hosting it, and that window closes on the platforms’ timeline, not on anyone else’s.
So what do you do with this
If an investment ad features a familiar face — a business figure, a politician, an economist — treat the face as a reason for suspicion, not reassurance. Don’t Google the platform’s name; these sites are built to survive exactly that check. Instead, search the actual company on ASIC’s Australian Financial Services licence register, which is free and public. If it’s not listed, nothing else about the ad matters.
If you’ve already sent money, go to your bank first, not the platform. The HSBC case shows your bank owes you a properly-run investigation right now, under rules that already exist and already have a court willing to enforce them.
Report the ad to the platform too, but don’t expect that report to carry any legal weight on their end just yet. That only changes once the framework is fully live.
Top picks
SmartCompany — “The top 11 Australian public figures most impersonated in investment scams” — the fullest public rundown of who’s being used as bait and the National Anti-Scam Centre figures behind it.
ASIC media release 26-127MR — Federal Court orders $35 million penalty against HSBC — the primary source on the bank-side penalty referenced throughout this issue.
ACCC — Scams Prevention Framework — the regulator’s own explainer of sector designations and compliance dates, the primary source for this issue’s timeline claims.
ASIC media release 26-162MR — record $830 million in civil penalties and $644 million returned in 2025–26 — the source for this issue’s enforcement-year digest item.
ASIC media release 26-185MR — ASIC protects consumers by removing high-risk financial sector participants — the source for the 10 August bannings, including the Shield and First Guardian references.
Netcraft — “Australia’s Scams Prevention Framework: what banks must do before March 2027” — a clear industry breakdown of the framework’s phased obligations and penalty tiers.
Reported today, and worth watching closely as the framework’s dates approach.
Follow us on all major podcasting platforms and social media channels for important updates. Your support keeps independent journalism alive!For more in-depth coverage on these stories and other news affecting Australia and the world, subscribe to readmencari.com. Support our independent journalism by listening to our podcasts on all major platforms and considering a subscription to help us continue delivering fearless reporting free from financial and political influence.
As well as knowing you’re keeping MENCARI alive, you’ll also get:
Get breaking news AS IT HAPPENS – Gain instant access to our real-time coverage and analysis when major stories break, keeping you ahead of the curve
Unlock our COMPLETE content library – Enjoy unlimited access to every newsletter, podcast episode, and exclusive archive—all seamlessly available in your favourite podcast apps.
Join the conversation that matters – Be part of our vibrant community with full commenting privileges on all content, directly supporting Mencari's
Stay with readmencari.com for continuous updates on these developing stories and more from across Australia, New Zealand, and the globe. Subscribe to our newsletter for daily briefings delivered straight to your inbox!
Got a News Tip?
Contact our editor via Proton Mail encrypted, X Direct Message, LinkedIn, or email. You can securely message him on Signal by using his username, Miko Santos.
🛑 More on Kangaroofern Media Lab
Read our last AU Politics newsletter : Bendigo Bank Axes 158 Roles
Read our last AI newsletter : Anthropic Raises $13B Series F
Read our last Tech newsletter : Australian Court Rules Apple
Read our last Podcast newsletter : Spanish podcast listeners seek more Latino cultural content:YouTube Unveils AI Podcasting Tools
