Queensland's demerit points trade is a 'cybersecurity flaw,' ex-CIO warns

A 27-year-old woman has been charged with fraud after allegedly accumulating 1,150 demerit points and more than $600,000 in fines, the flashpoint for a 7.30 investigation that uncovered widespread demerit point trading on black markets.

Peter Grant, who oversaw the rollout of Queensland's licensing and registration system in the 1990s as the state's chief information officer, told 7.30 the government is now facing a problem it never designed for. Back then, he said, there was no social media and no need to defend against this kind of attack. He labels the manipulation a cybersecurity breach, because it corrupts a government business process. As he put it: people are gaming the system, and they've created a cyber breach.

Grant wants action, not reviews. The Queensland government has to show people can't get away with fraud, he told 7.30, calling it a high-priority initiative that should be near the top of the list for the integrity of the system. Premier David Crisafulli told 7.30 he thinks the loophole has been closed, but said other loopholes would be examined, adding no system can be made bulletproof. The Treasurer's Office said new measures were implemented in late 2025 under a new fines and integrity framework, while the Revenue Office and Department of Transport and Main Roads described their fraud detection as robust. Police raised detection concerns with both agencies and remain frustrated by inaction, 7.30 was told.

Dr Katie Williams, a former KPMG partner and senior lecturer at the University of Queensland Business School, said systems built correctly, monitored regularly and tweaked as needed make fraud harder to hide. She pointed to an opportunity to examine the enabling legislation in fine detail. RACQ executive manager of public policy Michael Kane said the state still doesn't know the size of the problem, but should. Griffith cybersecurity expert Dr David Tuffley said a taskforce could pin down how many people are exploiting the loopholes, though that would take courage from the government.

New South Wales is further along. Its Demerit Point Integrity Taskforce, launched in 2024, found people piling up hundreds, sometimes more than 1,000, demerit points while still driving, opposition roads spokesman Mark Coure told parliament, including unverifiable foreign licence details and social media ads offering to take points for cash. Proposed reforms would require passport numbers and country of issue when an overseas driver is nominated, and create offences for false disputes and fraudulent nominations. Roads Minister Jenny Aitchison said Revenue NSW systems are being integrated with Australian Border Force data to check whether a nominated overseas driver was even in the country, and Transport for NSW said the taskforce suspended 50 repeat offenders' licences and cancelled 190 vehicle registrations.

The schemes keep sprouting. Among the services 7.30 found was a website closely mimicking the official Service NSW portal, whose contact button redirected to WhatsApp. The person behind it claimed access to live dummy accounts registered under Service NSW and the know-how to get requests accepted instantly and automatically, offering to wipe a $434 fine and 3 points for $500 total, sorted in 3 minutes with payment only after it cleared. NSW Police said it was aware of reports about sites claiming to remove demerit points for payment, and that demerit point fraud seriously undermines the licensing system and road safety.