Test whether Australians can buy essentials when payment systems fail
Australia needs to assess its ability to sustain essential purchases during prolonged digital disruption. Maintaining access to food, medicine and fuel would give the government more time and greater freedom to respond to a cyberattack on payment services.
Resilience testing should in particular establish whether households can still buy essentials during a prolonged outage of technology or telecommunications infrastructure shared by banks, payment providers and retailers. It should assess how these organisations keep purchases possible and how quickly individual financial institutions recover.
The Reserve Bank of Australia (RBA) and the Australian Prudential Regulation Authority should lead this assessment through existing payments-resilience arrangements. The Council of Financial Regulators should coordinate financial agencies, with the Department of Home Affairs supporting investigation of infrastructure dependencies.
The work should review existing exercises and corrective actions that have already been undertaken. Where gaps remain, a limited pilot involving supermarkets, pharmacies and fuel retailers in one metropolitan area and one regional community could test payment alternatives.
Australia already has substantial resilience arrangements. The prudential regulator’s operational risk management standard requires entities to maintain critical operations within defined tolerances and manage service-provider risks. In March 2025, the Council of Financial Regulators identified supplier concentration, crisis testing and backup payments as priorities. And the RBA’s March 2026 Financial Stability Review describes the Industry Resilience Initiative, through which regulators oversee work to strengthen industry-wide responses to significant payments disruptions.
The assessment that I propose should establish whether these arrangements would ensure households could buy essentials when a single outage brings down the payment services of several organisations. Existing findings should be used; targeted exercises should fill evidence gaps.
The July 2024 CrowdStrike disruption illustrates the problem. Microsoft estimated that a faulty software update had affected 8.5 million Windows devices, fewer than 1 percent of the number operating globally. Yet the consequences of the fault were widespread, because affected enterprises operated critical services that were relied on by others, whose functions, therefore, were also brought down. A dependency’s significance rests on the functions it supports and on available alternatives.
Telstra’s July 2026 mobile network outage also illustrates such a chain of dependence. Telstra’s external investigation attributed the outage to incorrect date information spreading after planned maintenance. The outage was not evidence of a cyberattack but nonetheless demonstrated that functioning banks couldn’t complete a purchase through a merchant terminal that has lost its connection.
The pilot should assume goods and electricity remain available, isolating payment access as the only issue tested. Participants should agree on a minimum level of purchasing service and a maximum tolerable interruption. Testing should extend beyond expected recovery times to establish whether alternatives can be sustained.
Controlled demonstrations and simulated transactions should trace each full purchase, from payment through merchant acceptance and authorisation to checking and settling records after restoration. Consumer representatives should test alternatives for people without spare cash, a second account or reliable digital access.
Fallbacks need scrutiny. An alternative electronic route may also depend on the failed provider of the shared service. Offline payments require transaction limits and agreed responsibility for fraud and credit losses. Cash depends on distribution, merchant acceptance and workable procedures. Each option should be demonstrated under the scenario’s constraints.
Banks, payment networks, technology and telecommunications providers, retailers and cash distributors should participate. Results should show how quickly the minimum service becomes available, where it can be sustained and whether records can be reconciled. Unresolved findings need an accountable organisation, a funded corrective action or an explicit risk decision, and a retest date.
Findings should guide investment. If foreign specialists cannot assist in time, local personnel and recovery tools may help. If payment alternatives share communications infrastructure, independent connectivity for each merchant may matter more than the payment platform. These are possible findings, not established weaknesses.
Investment should weigh maintenance and testing costs against harm avoided and time gained. A public summary should explain outcomes, limitations and corrective actions – without revealing exploitable weaknesses. A limited pilot cannot establish nationwide readiness. Follow-on action would be needed.
Australia needs evidence that households can still buy food, medicine and fuel when normal payment services remain unavailable. Domestic ownership or hosting alone cannot demonstrate that capability. Testing complete purchases across organisational boundaries would show where alternatives work and where further preparation is needed.
About Author
.jpg "The Great Process Re-Engineering: Who’s Running the Agents?")
