Given that this transaction will not be otherwise found fraudulent/reversed, does the platform actually has the right to indefinitely hold the monies they have no ownership over?
Indefinitely: yes; forever: no. Once the fraud investigation is completed the money would be released (if clean) or sent to the true owner (if fraudulent). If the contract is silent on how long this will take, it must be done in a reasonable time.
Is there any law that would protect the freelancer in that case?
Possibly. I'll get back to this.
What contracts are there?
I'm guessing that there are three contracts:
- One between the freelancer and the platform (the F-P contract),
- One between the client and the platform (the C-P contract), and
- One between the freelancer and the client (the F-C contract).
Under the F-C contract, the client owes the freelancer money. Under the C-P contract the platform agrees to collect the money from the client. Under the F-P contract the platform agrees to remit the funds to the freelancer (less the fee, I assume).
Under the F-P contract, the freelancer assumes the risk of fraud on behalf of the client. This is a perfectly sensible thing for a contract to address; contracts are fundamentally about risk allocation after all. So, if there is fraud or suspected fraud, the freelancer cops the loss. They have no cause of action against the platform because the platform is only doing what the F-P contract requires - that is, there is no breach of contract.
The freelancer does have a cause of action against the client under the F-C contract, so they can sue the client for the money. The client may raise the defense that they already paid the client through the platform - and then things get complicated.
The platform may also have a cause of action against the client under the C-P contract because they are out their fee. This doesn't help the freelancer because they are not privy to that contract.
Getting back to it ...
Australian Consumer Law applies to all three contracts (unless they were for more than $300,000 - if so, you'd already have called a lawyer). The freelancer could try to argue that assuming the risk of fraud was an unfair contract term and therefore void. It probably isn't.