2.8 billion blocked calls, and the leak still remains

ACMA’s quarterly report today says telcos have blocked 2.8 billion scam calls since December 2020. That is a fine number. It is the number the industry will quote for the rest of the year. It is also the number that has been getting bigger every quarter while Australian scam losses remain stubbornly large.

Both things are true. The question is which one tells you what to do next.

The blocking work is real. Telcos have taken enormous volumes of scam traffic out of the network. ACMA reports a billion scam SMS blocked since July 2022, hundreds of compliance alerts and new investigations in the quarter. This is not theatre. It is operational grind, and the public sees only a thin slice of it.

But blocking is a volume control, not a leakage control.

Fraud does not need most calls to get through. It needs the right call to reach the right person at the right moment with enough believable context to keep the conversation alive. A blocked-call total tells you how much traffic was stopped at the door. It does not tell you what happened in the kitchen after one caller got inside.

That is why the loss number matters beside the blocking number. Australians can lose billions to scams in the same world where billions of calls are blocked. Those two facts do not contradict each other. They describe different halves of the problem.

The SMS Sender ID Register makes the same point in regulator language. ACMA is not building a brand-impersonation register because telco blocking solved SMS fraud. It is building one because the sender name itself became part of the attack. A fake bank message can get more trust because the thread looks like it belongs to the bank. That is not just bad traffic. It is bad trust.

The register moves the check closer to the name. It asks whether a sender is authorised to use the brand before the message lands. That is a different class of control from blocking suspicious volume after the fact.

Voice is still behind that conversation. There are blocking programs, numbering rules, compliance priorities and international arguments about attestation. All of that matters. But the voice channel still lacks the plain customer-facing equivalent of a registered brand signal that ordinary people can rely on inside the conversation.

That matters because voice fraud is increasingly a leakage problem. The caller has a name, a phone number, an address, a service history, a membership number, a family detail, or a fragment of account context. The call is believable because information has leaked from somewhere else and been assembled into a script.

No blocking system can solve that entire problem. It can reduce the flood. It can raise costs. It can remove obvious bad actors. It can make the scammer work harder. But if one call lands with real facts and a plausible voice, the defence has moved from network volume to human trust.

That is the ceiling.

The point is not that ACMA or telcos are failing. The point is that success at one layer reveals the next layer. A system can get very good at stopping obvious bad traffic and still leave businesses and customers exposed to the call that sounds normal enough to continue.

The blocked-call number is the headline. The leaked-call number is the business case. They are not the same story.