It's Often Legal to Drain a Partner's Joint Account

Location tracking. Shared logins. A joint account that empties overnight. A new study out of UNSW Sydney has found that a lot of the everyday tech abusers use to control partners isn't just under-reported. Much of it isn't even illegal.

Dr Rahat Masood, from the UNSW Institute for Cyber Security and the School of Computer Science and Engineering, led a team that crawled 306 government, non-government and commercial websites and pulled 52,605 web pages related to domestic and family violence, online safety or digital abuse. The goal: check whether support resources actually match how abuse happens today. They presented the findings in July at the Australasian Conference on Information Security and Privacy in Perth.

The short version: they don't match.

Why this hits close to home

If you've ever shared your location with a partner, split a phone plan, or kept a joint account for rent and bills, this is about you. Dr Masood's team found that 51% of Australian adults have experienced at least one form of technology-facilitated abuse. Among women stalked by an intimate partner, 54% reported electronic stalking in the very first incident. This isn't a niche problem. It's baked into how a lot of relationships already run.

What is technology-facilitated abuse?

Technology-facilitated abuse (TFA) is the use of everyday tech, smartphones, apps, social media, spyware, to monitor, control, harass or intimidate someone. Common forms include location tracking without consent, reading someone's messages or social accounts, installing browser spyware, locking someone out of devices or accounts, and sending threatening messages online. Dr Masood's team found that most support content online covers just three of these: hurtful comments, harassment and sexual abuse. Covert surveillance, economic abuse and long-term controlling behaviour, all of it TFA, made up less than 1% of the abuse-related pages they reviewed.

The gap in the law

Here's the part that surprised even the researchers. Dr Kayleen Manwaring, an Associate Professor at UNSW Law & Justice and a fellow member of the Institute for Cyber Security, says a lot of this behaviour hides behind ordinary legal arrangements. Phone plans, smart home systems and internet accounts usually sit in one person's name, often the abuser's, and owning the tech isn't against the law.

Joint bank accounts work the same way. Either account holder can generally withdraw the full balance at any time, no permission needed, and the bank isn't obligated to step in unless it's already been told otherwise.

"They can legally clean out the account from a commercial law perspective," Manwaring said. She added that once the money's gone, "there's usually very little you can do to get it back... because it's usually either been spent or hidden."

How the support system misses it

The study found three consistent gaps. Prevention advice mostly points people toward lawyers or doctors rather than practical steps they can take themselves. Support content tends to be generic digital-safety tips instead of guidance for specific situations. And the harms that get the least coverage, financial abuse and privacy violations, are also the hardest to find information about when someone does go looking.

Masood said most people don't discover they're being monitored through a dedicated tool or website. They find out by accident. "You go to a clinic, or you seek technology support, and then someone talks to you and you realise: why are you sharing your password? Why is this plugin in your browser? It looks like it's spying," she said.

Perspectives: what the system says it's doing

Australia's eSafety Commissioner has acknowledged the gap and is now running its third round of grants focused on education and awareness around tech-facilitated abuse, alongside dedicated reporting and takedown schemes for abusive content. The Commissioner's office is also pushing tech companies to meet baseline safety standards.

The banking sector has previously acknowledged the financial side of this problem too, separately from the UNSW research. Responding to a parliamentary inquiry into financial abuse in December 2024, Australian Banking Association chief executive Anna Bligh said banks "have a range of support options available to help victim-survivors escape abuse and recover, including assisting them to open new accounts, deal with joint accounts, provide advice on financial hardship." Bligh said financial abuse could lead to account suspensions or closures under bank terms and conditions.

Manwaring points out the legal remedy still mostly kicks in after the fact. "The law currently offers very little protection unless and until this sort of thing is reported to police, or in some cases, to the eSafety Commissioner," she said.

Why the data is thin

Part of the problem is that tech abuse rarely shows up as the primary complaint in police records, which are also unstructured and hard for researchers to access. Masood said that makes it "nearly impossible to quantify the problem accurately or translate it into policy, detection tools, or legal guidelines."

What's next

Masood's team is now building browser-based tools that flag potentially abusive or coercive language before a message gets sent, aiming to catch harmful behaviour earlier rather than after the damage is done. They're also chasing further grant funding with cyber security and AI researchers to develop practical prevention tools.

If you think you're being tracked, monitored or financially controlled by a partner, you can report it to the eSafety Commissioner, who runs a dedicated takedown and support pathway separate from going through police.

⚡ QUICK SUMMARY A UNSW study crawled over 52,000 web pages of domestic violence and online safety content and found Australia's support resources barely cover the tech abuse people actually experience.

Financial abuse and covert surveillance made up less than 1% of the content reviewed, even though 51% of Australian adults report experiencing some form of tech-facilitated abuse.

Legal experts say the law struggles here because the tech, and the money, is usually in the abuser's name. Either joint account holder can legally empty it, and there's often little recourse once the funds are gone.

The eSafety Commissioner is running grant programs and takedown schemes, and researchers are building tools to flag abusive messages before they're sent, but protection still mostly kicks in after abuse is reported.