Vodafone’s parent company has publicly challenged rival Aussie Broadband after analysing suspect calls on its network and finding that an overwhelming proportion travelled through Symbio, an internet-phone business owned by Aussie Broadband. The dispute raises an urgent consumer-protection question: how much responsibility should wholesale telecommunications operators carry for stopping scam traffic before it reaches an Australian phone?
According to an investigation reported by ABC News, TPG Telecom assessed calls identified as scams on Vodafone’s network and traced more than 24 million of them through Symbio. TPG said 98 per cent of the suspect scam-call traffic it examined had come via that business. The numbers are the result of TPG’s analysis, not a finding that Aussie Broadband or Symbio employees deliberately defrauded callers. This distinction is essential to understanding what the figures do — and do not — establish.
Symbio is a wholesale provider of telephone numbers and internet-based calling capacity. Its customers can sell services to other businesses, which in turn can deal with further users. Aussie Broadband chief executive Brian Maher told the ABC that these layers make it difficult to see all of the people ultimately using a number. Maher said the business disconnects persistent bad actors when it can identify them and is prepared to work with TPG on reducing scam activity.
TPG executive Vanessa Hicks said the company had been sharing evidence about suspicious campaigns and wanted faster action closer to the source. Her complaint reflects a basic problem for a network receiving calls: it may detect patterns suggesting fraud, but it cannot simply decide to shut another provider out without considering the impact on legitimate calls. The result is a dispute over how quickly information should be exchanged and which company is best placed to intervene.
The ABC’s reporting described a case in which callers impersonated police, including officers from the Australian Federal Police and stations in several states. A person receiving such a call may hear a calm, plausible explanation and see apparent supporting material. That is why telephone scams are not just a technical nuisance. Criminal impersonation can exploit people’s fear of getting into trouble with law enforcement, even when the caller has no authority at all.
The Australian Communications and Media Authority said its checks on the particular police-impersonation activity showed notifications and blocking had occurred and did not identify non-compliance by an Australian telecommunications company in that case. That finding must sit alongside TPG’s commercial complaint. There is a material difference between an enormous volume of suspect traffic crossing a provider’s network and evidence that the provider breached a legal obligation in a specified incident.
There is also a separate regulatory history. ACMA’s published enforcement material lists compliance action involving Symbio entities under scam-call rules. Those earlier regulatory matters provide background for the public debate, but they should not be merged with the finding on the more specific police-impersonation case or portrayed as a new penalty arising from TPG’s analysis. The chronology and the scope of each regulatory decision matter as much as the headline numbers.
Maher argued that wholesaling itself can explain why Symbio might handle a substantial proportion of suspicious calls. A business carrying large volumes for other providers may see considerable problematic traffic without being the person originating the fraud. That explanation does not eliminate the consumer problem, but it indicates why effective enforcement requires information about the customer chain, the actual caller and the movement of telephone numbers between services.
A practical solution has to involve both prevention and accountability. Companies selling or reselling number services need robust processes for understanding their customers and responding when traffic is flagged. Receiving networks need reliable ways to identify patterns of impersonation and communicate evidence. Regulators need to assess compliance against the duties that actually apply, rather than treating a competitive allegation as a finding of lawbreaking. Those are different responsibilities within the same system.
For ordinary Australians, caller identity is especially difficult to verify because a familiar-looking number or convincing story is not proof that the caller represents a police station, bank or government agency. The sensible consumer response is to stop the conversation and independently locate a contact number from an organisation’s genuine website or published materials. No legitimate urgency described by an unknown caller removes the need for that verification.
The argument also highlights why counting blocked calls is not the same as proving the threat has ended. A network might stop enormous volumes of traffic while scammers change numbers, providers or tactics. The effect that matters is whether fewer fraudulent calls reach people, whether suspect accounts are identified quickly and whether customers have a clear process for reporting a suspicious approach.
The commercial structure of telephone networks explains why the dispute is more complicated than one company making a call to one customer. Wholesale carriers connect services and move traffic on behalf of other providers. A suspicious call may originate through several commercial relationships before it reaches a handset. The provider whose name appears in a network trace is not necessarily the person who created the fraudulent message. Nonetheless, a chain of intermediaries can make it harder for a receiving provider to identify where scrutiny and technical controls should be applied. That is the specific governance challenge raised by the Vodafone and Symbio figures.
Scams also impose costs beyond the price of the phone call. Australians can lose savings, disclose account credentials, authorise a payment under false pretences or spend substantial effort trying to recover an identity after an impersonation attempt. The National Anti-Scam Centre’s published report draws together complaints from several reporting bodies and identifies reported losses of more than $2 billion across multiple scam categories. That economy-wide total is not a figure for the Symbio traffic identified by Vodafone. It provides context for why regulators, financial institutions and carriers are all being pressed to improve prevention rather than relying entirely on individual vigilance.
The way a caller gains trust is central to the risk. A number displayed on a phone screen may resemble a local organisation, but it is not dependable proof of the caller’s identity. Criminals can borrow the language of banks, police or public agencies and create urgency around alleged account breaches or outstanding obligations. Customers are often told not to disconnect, to move funds to a ‘safe’ account or to disclose codes intended for genuine sign-in attempts. Those are general warning signs, not allegations about any customer involved in this specific network dispute. Understanding the mechanism makes the public-safety angle clearer without overstating what the network evidence proves.
A household dealing with an unexpected demand should verify the organisation using a trusted contact channel rather than a number supplied by the caller. Someone who believes money or identifying information has already been shared should contact their bank or relevant provider quickly and make a report through the appropriate Australian scam-reporting service. Early action does not guarantee reimbursement. It may, however, help protect remaining funds, replace compromised credentials and create a clearer record for investigators. Advice to consumers is useful but cannot substitute for the upstream systems and obligations of businesses that carry large volumes of calls.
For telecommunications customers, the dispute raises an accountability question similar to those found in financial services: who monitors unusual activity, who can block it, and how quickly does one participant warn another? A receiving network may see repeated calling patterns while an originating or transit provider holds different identifying records. Sharing relevant technical intelligence within lawful limits can improve detection, but the commercial incentives and contractual responsibilities are not necessarily aligned. It would be premature to claim that any one contractual arrangement caused all the suspicious traffic. The public case for cooperation is that no single participant sees the entire route on its own.
The regulatory distinction also needs to remain precise. The fact that an authority investigates a particular impersonation campaign does not mean it has found every carrier in that chain non-compliant. The reported regulatory position on the specific campaign should be presented alongside, not replaced by, Vodafone’s allegations and the response from Aussie Broadband. Historic compliance action concerning other circumstances cannot be silently repurposed as evidence of an offence in this incident. Such separation is essential if the dispute becomes a commercial or legal contest and the public expects accurate reporting rather than an accusation of guilt by association.
Consumer confidence has a direct business consequence. Customers who cannot trust incoming calls may avoid legitimate contact from utilities, banks or health services, making it harder for organisations to perform routine work. Financial institutions can bear the cost of investigating disputes, and businesses can lose transactions when customers ignore genuine notifications. That does not imply a specific revenue loss for the companies in this story. It shows why the threat sits at the intersection of consumer protection, telecommunications infrastructure and the cost of operating trustworthy services.
Vodafone’s data therefore deserves investigation without being turned into a verdict. Aussie Broadband has a right to explain the role of its wholesale subsidiary and the limits of its visibility; customers and regulators have a legitimate interest in whether better safeguards can be demonstrated. The decisive measure will be what technical and procedural changes follow, not the intensity of the exchanges between competing providers. The reported calls are a serious signal of exposure, while responsibility for particular offences must be established by evidence.
The immediate position is contested, rather than settled. TPG says its data reveals an unacceptable concentration of scam calls through Symbio. Aussie Broadband says the wholesale structure is complex and has pledged cooperation. ACMA has described the regulatory outcome of the specific impersonation episode. The next measure of success is not which company’s accusation produces the strongest headline, but whether the operators and regulator can demonstrably reduce the calls reaching Australians.
