2.8 billion blocked calls, and the leak still remains

ACMA’s quarterly report today says telcos have blocked 2.8 billion scam calls since December 2020. It’s a good number. It’s the number the industry will quote for the rest of the year. It’s also been getting bigger every quarter while Australian scam losses have barely moved.

Both of those are true at once. The question is which one tells you what to do next.

The blocking is real work. Telcos have pulled enormous volumes of scam traffic out of the network — a billion scam SMS blocked since July 2022, hundreds of compliance alerts, fresh investigations in the quarter. None of it is theatre. It’s operational grind, and the public sees a thin slice of it.

But blocking is a volume control. It isn’t a leakage control.

Fraud doesn’t need most calls to get through. It needs one call to reach the right person at the right moment with enough believable context to keep them talking. A blocked-call total tells you how much traffic got stopped at the door. It tells you nothing about what happened in the kitchen after one caller got inside.

That’s why the loss figure has to sit next to the blocking figure. Australians can lose billions in the same year that billions of calls get blocked. The two numbers don’t argue with each other. They’re describing different halves of the problem.

The SMS Sender ID Register makes the same point in regulator language. ACMA isn’t building a brand-impersonation register because blocking solved SMS fraud. It’s building one because the sender name itself became the attack. A fake bank message gets more trust when the thread looks like it belongs to the bank. That’s not bad traffic. It’s bad trust.

The register moves the check closer to the name — it asks whether a sender is allowed to use the brand before the message lands. That’s a different kind of control from blocking suspicious volume after the fact.

Voice is still sitting behind all of this. There are blocking programs, numbering rules, compliance priorities, international arguments about attestation, and all of it matters. But the voice channel still has no plain customer-facing equivalent of a registered brand signal — nothing an ordinary person can lean on inside the conversation.

And voice fraud is turning into a leakage problem. The caller already has a name, a number, an address, a service history, a membership number, a family detail. The call is believable because that information leaked from somewhere else and got assembled into a script.

No blocking system solves that. It can thin the flood, raise the cost, clear out the obvious bad actors, make the scammer work harder. But once a call lands with real facts and a plausible voice, the defence has moved off the network and onto human trust.

That’s the ceiling.

The point isn’t that ACMA or the telcos are failing. It’s that getting good at one layer just shows you the next one. You can get very good at stopping obvious bad traffic and still leave a business and its customers exposed to the call that sounds normal enough to keep going.

The blocked-call number is the headline. The leaked-call number is the business case. Same week, different story.