Microsoft estimated a faulty July 2024 Windows update affected 8.5 million devices — fewer than 1 percent globally — yet the knock‑on effects reached far beyond those machines because enterprises running critical services were taken offline.
Why regulators are being asked to test household purchasing capability
Australia needs focused evidence that households can still buy essentials — food, medicine and fuel — if normal payment services become unavailable, a recent policy proposal argues. That evidence would give the government more time and greater freedom to respond to a significant disruption of payments services, the proposal says, and should isolate payment access as the issue under test rather than availability of goods or electricity.
Reserve Bank of Australia, APRA and the Council of Financial Regulators
The Reserve Bank of Australia (RBA) and the Australian Prudential Regulation Authority (APRA) are named to lead the assessment through existing payments‑resilience arrangements. The Council of Financial Regulators is to coordinate financial agencies while the Department of Home Affairs would support investigation of infrastructure dependencies.
The proposal points to existing tools: APRA’s operational risk management standard requires entities to maintain critical operations within defined tolerances and manage service‑provider risks. In March 2025 the Council of Financial Regulators identified supplier concentration, crisis testing and backup payments as priorities. And the RBA’s March 2026 Financial Stability Review describes the Industry Resilience Initiative, under which regulators oversee work to strengthen industry‑wide responses to significant payments disruptions.
Your town's IT department is one person. Maybe.
Ransomware crews target small municipalities because nobody's watching. Nubivance gives Maine and New Hampshire towns a security program sized to a town budget.
Protect the town officeCrowdStrike (July 2024) and Telstra (July 2026): how a single failure can cascade
Two recent incidents are cited as illustrating the problem of interdependence. The July 2024 CrowdStrike disruption — and Microsoft’s subsequent estimate that a faulty update had affected 8.5 million Windows devices — showed that a relatively small set of faulty endpoints can have widespread consequences when affected enterprises operate critical services other organisations rely on.
Telstra’s July 2026 mobile network outage, the proposal notes, was attributed by an external investigation to incorrect date information after planned maintenance. Although not the result of a cyberattack, the outage demonstrated that functioning banks could not complete purchases through merchant terminals that had lost their connection, highlighting how communications failures can break the payments chain.
Design and scope of the proposed pilot
The recommended approach is to build on existing exercises and corrective actions, and where gaps remain run a limited pilot. The pilot would:
- include supermarkets, pharmacies and fuel retailers in one metropolitan area and one regional community;
- assume goods and electricity remain available, isolating payment access as the only issue;
- require participants to agree a minimum level of purchasing service and a maximum tolerable interruption;
- test beyond expected recovery times to see whether alternatives can be persisted;
- use controlled demonstrations and simulated transactions that trace the full purchase lifecycle — from consumer payment through merchant acceptance and authorisation to the reconciliation and settlement of records after restoration;
- include consumer representatives testing alternatives for people without spare cash, a second account or reliable digital access.
How banks, retailers and consumers will be tested
The proposal calls for participation from banks, payment networks, technology and telecommunications providers, retailers and cash distributors. It emphasises scrutinising fallback options:
- Alternative electronic routes must be checked for hidden dependencies that could also fail with the primary provider.
- Offline payments require agreed transaction limits and clarity about responsibility for fraud and credit losses.
- Cash depends on distribution, merchant acceptance and workable procedures at the point of sale.
Results should show how quickly the agreed minimum service is restored, where it can be sustained, and whether records can be reconciled. Any unresolved findings must have an accountable organisation, a funded corrective action or an explicit risk decision and a retest date.
From findings to investment and public reporting
Findings from the assessment should guide investment decisions rather than presuming solutions. The proposal notes possibilities without asserting weaknesses: for example, that local personnel and recovery tools may be helpful if foreign specialists cannot assist in time, or that independent connectivity for each merchant might matter more than which payment platform is used if alternatives share the same communications infrastructure.
Investment choices should weigh maintenance and testing costs against the harm avoided and the time gained by the government in a crisis. A public summary is recommended to explain outcomes, limitations and corrective actions while avoiding publication of exploitable weaknesses. The proposal also acknowledges the limits of a small pilot and says follow‑on action would be required to establish nationwide readiness.
Australia’s central question is straightforward: can households still buy essentials when the payment rails are down? The recommended, tightly scoped testing — led by the RBA and APRA, coordinated by the Council of Financial Regulators and supported by the Department of Home Affairs — is framed to move that question from a policy assumption to an evidence base.
Source: Test whether Australians can buy essentials when payment systems fail — ASPI Strategist
