HSBC Bank Australia has admitted to serious failures in protecting customers from scams, with ASIC and the bank jointly seeking a $35 million penalty in the Federal Court.
The proposed resolution, which remains subject to court approval, follows an ASIC investigation into scam-related failings at HSBC between January 2020 and August 2024.
Alongside the proposed penalty, HSBC has established a large-scale remediation program. The bank has so far paid around $21.5 million in compensation and recovered a further $6.5 million that has been returned to customers.
During the period under investigation, HSBC received more than 1,000 reports of unauthorised transactions with a total transaction value of $34.6 million.
HSBC admitted that between May 2023 and May 2024 it failed to have adequate controls on its internal transfer system, exposing customers to a greater risk of unauthorised payments.
The bank also admitted it was aware from May 2021 of the growing risk of impersonation scams, where fraudsters masqueraded as HSBC representatives, while reports of unauthorised transactions surged approximately 380 per cent in 2023 and 2024, largely driven by impersonation scams.
According to the admissions, HSBC’s failures left customers at greater risk of financial and non-financial harm, with some suffering significant losses.
The bank also admitted breaching its financial services licence obligations due to major delays in investigating cases, which took an average of 144 days to finalise, and maintaining inadequate systems to help customers regain access to accounts locked after scam reports were lodged.
ASIC chair Sarah Court said the case was among the first of its kind globally.
“[T]his is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks.
“HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money,” Court said.
Among the affected customers were a 51-year-old NSW dental technician who lost $47,000, a 25-year-old NSW architectural assistant who lost $50,000, a Victorian couple in their 50s who lost $48,000 transferred from their home loan, and a 41-year-old Victorian father who lost $50,000.
“Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty,” Court said.
Some customers reported borrowing money elsewhere, taking on extra shifts at work or fearing they would struggle to meet home loan repayments.
Others described feelings of distress, guilt and panic, as well as the stress of being unable to access their money or accounts.
“Customers were left waiting months for answers, and delays in investigating and resolving their reports made the harm worse,” Court said. “ASIC has taken this action to hold HSBC to account, and we’re pleased affected customers are now being compensated.”
ASIC commenced civil penalty proceedings against HSBC on 13 December 2024. The bank has admitted it failed to do all things necessary to ensure its financial services and credit activities were provided efficiently, honestly and fairly.
The matter is being heard in the Federal Court on 18 June 2026 and concerns payments classified as unauthorised transactions under the ePayments Code, which is administered by ASIC.