Thousands of taxpayer-card transactions across federal departments were personal, not official, new Senate figures show. So far, every dollar we have traced has been paid back . That raises a narrower question than fraud, what prevention actually looks like .Federal public servants paid back around $480,100 in personal spending charged to taxpayer-funded credit cards in the 2025-26 financial year, figures tabled to the Senate this week show.Orders from Uber Eats and a single Defence transaction that brought the department’s total to nearly a quarter of a million dollars were part of the spending across at least eight departments and agencies.None of the departments involved characterise the spending as theft or criminal misuse. "It's said by everyone that personal charges are banned on the cards and the money is repaid once identified.It was never really a question of the money coming back. The harder question is what does a system designed to catch mistakes after the fact really prove?The numbers, by departmentDefence had the most total, 3,276 purchases the department itself says are “contrary to Defence policy,” worth about $240,000. At least $213,672 has already been paid back, a spokesperson confirmed.Then DFAT with 2,029 inadvertent transactions totalling around $151,000 for the financial year. The department’s spokesperson said the largest transaction, more than $3,000, was repaid in full.The Australian Federal Police recorded 987 incorrect personal transactions that cost more than $42,000. Between July 2025 and March 2026, Home Affairs staff were reimbursed for 477 purchases, totalling $28,400, including 149 Uber or Uber Eats orders worth about $5,500.The Department of Prime Minister and Cabinet was repaid for 81 purchases, valued at about $2,400, again mostly Uber. Health $5,370.16 (accidental private purchases) (repaid) Employment and Workplace Relations $8,688.02 (repaid) Social Services $2,250.00That is at least $480,100 across the eight departments and agencies cited in the figures, a minimum rather than a precise total, since the AFP's figure was only reported as "more than $42,000." The same figures, two readingsFinance Minister Katy Gallagher has defended the existing processes. “The information supplied shows that the system is working, in that the inappropriate use is identified and paid back,” she said in a statement. “Agencies and secretaries are required to manage the matter at the departmental level.One way of reading the figures is that misuse is being identified and the money is coming back in. Nothing in the tabled data says anything about a trend - the claim is harder to sustain as evidence the underlying rate of mistaken personal spending is actually falling. That’s just the total for one year.Deputy Opposition Leader Jane Hume put the opposing frame. She said: “It is encouraging that these purchases are identified and the vast majority repaid, but the scale is concerning.” It's a critique that doesn't quite provide us a way out.It’s also worth noting that the same repay-on-detection model has run under governments of both stripes without a structural redesign, so this is less a new failure than an old one nobody currently in office has moved to close.What matters here is not the difference between "the system caught it" and "the system failed." Both readings agree with that. It's between a control that prevents the mistake and one that only ever cleans it up, and on the evidence tabled this week, Australia's public service credit card system remains very much the second kind. Quick hitsRoblox has made a court-enforceable undertaking with the eSafety Commissioner after gaps in the platform’s child safety systems were found, including that adults could send connection requests to children without parental consent and that children’s accounts were not private by default.The company has three months to comply, or face penalties of up to $100 million. Communications Minister Anika Wells said the founder of Roblox had promised her personally that the company would accelerate. eSafety estimates that 1.7 million Australian children use the platform.Business leaders are divided on how much Australia’s migration intake should be cut. Federal budget forecasts show net overseas migration falling from around 300,000 to 245,000 this financial year, with the current permanent intake at 185,000 places. One Nation wants that cut to 130,000, the Coalition wants migration capped against housing construction but has not named a figure.E-commerce entrepreneur Ruslan Kogan said the debate should be about which migrants Australia admits, not the raw number, while Leora Healthcare co-CEO Esha Oberoi – whose aged-care and disability business is more than 45 per cent visa holders – said she doesn’t know how the sector operates without continued migrant staffing.What to readSubmissions on Labor's fix to the negative-gearing “widow tax” – the change that protects a spouse inheriting a jointly owned investment property from losing existing negative-gearing treatment – close Friday 21 August. This week's price of Coalition support for the NDIS savings bill was that fix.Thursday 20 August was also the final sitting day of this parliamentary fortnight, concluding a string of connected deals between Labour and the Coalition on the NDIS, gambling advertising and the widow tax, three bills that were really one negotiation.What that cooperation will cost each side politically is an open question as we head into the next sitting period. Appreciate the newsletter but aren’t ready to pay for a subscription? Grab us a beer or snag the exclusive ad spot at the top of next week's newsletter. The deepfake economy You’re scrolling and an ad plays. Decent production. A face you recognise — maybe finance commentator Alan Kohler explaining a “government-backed” trading platform, maybe a mining billionaire telling you she’s put her own money into it. None of it is real. The voice, the face, sometimes a whole fake news article sitting underneath as proof, all generated. ASIC chair Sarah Court’s advice is blunt: a quick search isn’t enough anymore to separate real from fake, because the fake sites are built specifically to survive that check. This isn’t a scattering of one-off cons. Nineteen thousand-plus sites and ads taken down in a year points to something closer to a production line. SmartCompany identified at least eleven Australian public figures currently being used as bait, spanning business (Dick Smith, Gina Rinehart, Alan Kohler), economics commentary (Tom Piotrowski, Stephen Koukoulas, Alan Oster), politics (Anthony Albanese, Angus Taylor, Jacqui Lambie, Pauline Hanson) and broadcasting (John Laws). None of them authorised any of it. None of them see a cent from it. They’re simply recognisable enough to make a fake platform look credible for the few seconds it takes someone to decide whether to click. A note on how solid these particular numbers are: the 19,000-plus takedown figure and the 182 percent increase come from three outlets — SBS, the regulatory wire MLex, and SmartCompany — all reporting the same numbers on 17 August, not from an ASIC document we could locate and read directly. Treat the scale as well-reported rather than independently verified against a primary release. The trend line isn’t in question, though. This is the third public warning ASIC has issued this year about the same deepfake mechanism, following releases in April and July, with the numbers worsening each time. Part of why this particular scam works so well on a younger audience is distribution. It doesn’t arrive as a cold call anymore. It arrives as a targeted ad in the same feed as content from a creator you actually follow, placed there by an algorithm that has no way of distinguishing a genuine endorsement from a fabricated one. It just knows the ad gets clicks, and shows it to more people who look like the people who already clicked. Who’s actually on the hook This is where the accountability trail splits in two, and splits right now. Banks already have exposure. In June, the Federal Court ordered HSBC’s Australian arm to pay a $35 million penalty, not for a scam happening on its platform but for how it handled customers afterwards: an average 144-day delay investigating scam reports, and gaps in fraud controls on its internal payment rail. HSBC has already paid roughly $21.5 million in compensation, with more due, and recovered $6.5 million for customers. That penalty sits under an existing rulebook, the ePayments Code, and a court that used it. Social media platforms, where these deepfake ads are actually served, sit under a newer and different rulebook: the Scams Prevention Framework. Banks, telcos and digital platforms — social media, messaging services, search engines — were all formally designated as regulated sectors under the framework in May 2026, overseen respectively by ASIC, ACMA and the ACCC. But the framework has a long runway before its penalties apply. Regulated entities must join the external dispute resolution scheme, AFCA, from 1 September 2026. The framework’s full prevent-detect-disrupt-report-respond obligations, with AFCA handling scam complaints, take full effect from 31 March 2027. Once fully live, the penalties aren’t small: up to $50 million, or 30 percent of turnover, for failing to prevent, detect, disrupt or respond to a scam running on a platform’s own service; up to $10 million for governance and reporting failures. Some legal commentary describes a lighter “reasonable steps” obligation applying from as early as 1 July 2026, ahead of the formal AFCA and enforcement dates. Sources vary on the exact sequencing here, which is flagged in this issue’s claim ledger as the main area of date uncertainty. Put the two tracks side by side. Losses tied to fake celebrity endorsements: $7.4 million and rising, this year.
